Background Checks Operate Within Clear Legal Guardrails

A background check is not a legal vacuum. When processing personal data within an employment relationship, Swiss employers must in particular observe the link to the role and necessity. The source document identifies Art. 328b CO as the central employment-law guardrail here: data should concern suitability for the employment relationship or be necessary for its performance. For screening, this means that technically available information should not automatically be collected as well. Companies must be able to explain why a particular verification module is relevant to a particular role. In parallel, the data protection principles of the FADP apply, including transparency, purpose limitation, proportionality and data security. A professional background-check process must take these requirements into account from the outset.

Proportionality Starts With the Position

The most important question is not: which checks can we carry out? But rather: what risks are associated with this role? A person with access to significant assets, highly privileged IT systems or particularly sensitive information carries a different risk profile than a role without comparable responsibility. This can lead to a different scope of checks. This differentiation is exactly what makes an approach risk-based. From this perspective, a comprehensive screening for every person in the company makes just as little sense as forgoing checks entirely for exposed roles. Instead, companies should define risk criteria and derive graduated screening packages from them. This way, the scope of checks is determined not by individual recruiters' gut feeling, but by a traceable, position-based logic.

The FADP Raises the Bar for Clean Processes

The revised Data Protection Act has been in force since 1 September 2023. The source document notes that certain intentional breaches of duty can be sanctioned with fines of up to CHF 250,000, typically against responsible natural persons. For background checks, however, this figure should not be understood as an isolated threat. What matters more is the underlying expectation of professional data processing: companies must know what data they collect, why they do so, who has access, how long information is stored, and which external service providers are involved. Particularly sensitive screening data should not be processed uncontrolled via email, local files or informal research processes. Data protection compliance thus results from the combination of a permissible scope of checks and clean operational implementation.

Low, Medium, High: Risk Classes Create Consistency

One practical approach is to divide positions into different risk classes. For a low-risk profile, basic identity and qualification checks may be sufficient. For medium- or high-risk roles, additional modules can be objectively justified if the responsibility of the role requires it. Which checks specifically belong to each class should be defined by each company based on its organisation, industry, regulatory requirements and actual risks. What matters is that the logic is documented and applied consistently. This makes it possible to explain to candidates, as well as to internal control functions, why two positions are checked differently. Human risk management thereby becomes a governance instrument: risks are assessed before checks are selected, rather than justifying as comprehensive a check as possible after the fact.

Validato Maps Risk-Based Screening Modularly

Validato is designed to assemble background checks modularly and by position. Companies can define different screening packages for different risk profiles and integrate them consistently into recruiting and – where legally and factually appropriate – in-employment processes. Available modules include identity, education and employment verifications, along with further modules for specific risk constellations. The digital consent of the person concerned and identity verification form a fixed part of the process. Validato understands human risk management not as the most comprehensive possible control of employees, but as structured decision logic: the responsibility of a position determines the risk – and the risk determines which checks are sensible and proportionate.

Risk-Based Background Checks Instead of One-Size-Fits-All

Would you like to define traceable low-, medium- and high-risk screening packages for different roles? Validato helps you build a modular and proportionate background-check process.