Companies in Germany that run background checks on job applicants often point to consent as their legal basis. Validato, a Swiss provider of background checks and human risk management, says that is usually the wrong starting point. In Germany, the stronger basis is legitimate interest under Article 6(1)(f) GDPR and Section 26 BDSG, not the applicant's signature on a consent form.


The reason is simple. There is a power imbalance between an employer and a job applicant. That imbalance puts the “freely given” requirement for consent under Article 7(4) GDPR in serious doubt. If an applicant feels they have no real choice but to agree, the consent is not legally solid.

Why Consent Alone Is Risky

Legal commentary on employee data protection in Germany points out that consent given during a hiring process can rarely be called voluntary if it is effectively a condition for having the application considered at all. The so called coupling prohibition in Article 7(4) GDPR blocks employers from tying consent to the chance of getting hired.


A company that relies only on a consent clause in its application form is building its screening process on shaky legal ground. It can be challenged later.

Legitimate Interest Is the Stronger Foundation

Legitimate interest asks for something more concrete. The employer must name a real, legitimate goal, for example protecting sensitive roles in financial services, critical infrastructure, or IT. Then the employer has to show that the check is suitable, necessary, and proportionate for that goal.


This is a higher bar to clear than simply collecting a signature, but it holds up much better if a regulator or a court ever asks questions.

So Why Does Consent Still Matter?

Even though consent is not the right legal basis for the check itself, it still plays a real role. A separately collected, documented consent proves that the applicant agreed to the review and confirmed details such as identity, CV history, and past roles.


Many organisations that hold information about a candidate, such as former employers, universities, or public registries, will only release it once they have a signed release from that person. Consent does not replace the employer's legal basis under GDPR, but it is often the practical key that opens the door with these third parties.


“Legitimate interest and consent are two different tools for two different jobs,” Reto Marti, Managing Partner at Validato, explains. “One justifies the check to the applicant. The other makes the check practically possible with outside institutions, and defensible if there is ever a dispute.”

What This Means for Employers in Germany

Validato recommends that German companies document both layers clearly: a written balancing of interests as proof of the legal basis, plus a separate, electronically signed consent from the applicant that spells out the scope and purpose of the check.


Employers who rely on a consent clause alone risk two problems at once: a legal basis that can be challenged, and practical roadblocks when trying to gather information. Validato's platform gives companies a documented interest assessment, a digital consent tool with e-signature, and more than 18 individually selectable screening modules, so both layers stay separate, clean, and provable from day one.