Background and reference checks in Ireland
Reviewed by Mellow Editorial Team, HR & payroll content team
Carrying out background and reference checks in Ireland is lawful, but it must be done carefully within a framework set by data protection law, employment law, and sector-specific regulation. Done right, checks protect your business and your existing team; done carelessly, they expose you to GDPR complaints and discrimination claims.
Why the legal framework matters before you start
Ireland follows the EU General Data Protection Regulation (GDPR) and the Data Protection Acts 2018. Any information you collect about a candidate is personal data, and some categories — criminal records, health information — are "special category" data with stricter rules.
Before you run any check, you need a lawful basis. For most employment checks, that basis is either legitimate interests or, for special category data, explicit consent or a legal obligation. Consent in a recruitment context is tricky, because the power imbalance between employer and candidate means consent may not be freely given. Where possible, ground your checks in legitimate interests or a statutory obligation rather than relying on consent alone.
You also need to be transparent. Tell candidates in your privacy notice — before they apply, or at the latest when you make a conditional offer — what checks you intend to run, why, and what you will do with the results.
Step 1: Decide which checks are proportionate for the role
Not every role needs every check. Proportionality is a GDPR requirement, not just good practice. Match the check to the risk the role carries.
Common checks and the roles they suit:
- Identity verification — relevant for almost every hire; confirms the person is who they say they are
- Right to work — legally required for every hire; you must verify the candidate has permission to work in Ireland before they start
- Employment history / CV verification — appropriate for most professional roles; confirms dates, job titles and responsibilities
- Professional qualifications and licences — essential where a qualification is a statutory requirement (healthcare, law, financial services, construction)
- Credit and financial checks — proportionate for roles involving significant financial responsibility; not appropriate as a blanket check
- Criminal record checks — governed by the National Vetting Bureau; mandatory for roles involving children or vulnerable adults, available for certain other roles under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012–2016
- Reference checks — standard for most roles
Run only the checks that are genuinely relevant. Carrying out a criminal record check for a role with no safeguarding element, for example, would be hard to justify under a proportionality analysis.
Step 2: Make a conditional offer first
In Ireland, the accepted practice is to make a job offer conditional on satisfactory completion of checks, rather than running checks on a large pool of candidates. This limits data collection to people who are likely to be hired and reduces your exposure.
State clearly in the offer letter which checks will be carried out, the expected timeline, and what "satisfactory" means for each check. Be specific about what would cause you to withdraw the offer, so the candidate understands the standard being applied.
Step 3: Carry out the checks correctly
Right to work: Review original documents in person or via a trusted third-party service. Keep a copy of documents checked and the date of the check. If an employee's permission to work is time-limited, diary the expiry date.
References: Contact referees directly, with the candidate's permission. Ask consistent, job-relevant questions. Referees in Ireland are often cautious about what they will put in writing; a phone conversation frequently yields more useful information than a written reference form. Be aware that a former employer who gives a negligently misleading reference — positive or negative — can face liability, which is partly why references tend to be guarded.
Professional qualifications: Verify directly with the issuing body where possible. Do not rely solely on copies provided by the candidate.
National Vetting Bureau: Vetting must be initiated by a registered organisation, not by the individual or an unregistered employer. If your organisation needs to carry out statutory vetting, register with the National Vetting Bureau through An Garda Síochána's vetting unit. The process takes several weeks; factor this into your onboarding timeline.
Third-party screening providers: If you use a specialist background screening company, you remain the data controller. Carry out due diligence on the provider, have a data processing agreement in place, and confirm they operate within Irish and EU data protection rules.
Step 4: Handle results lawfully
Store results securely and access-restrict them to those who need to know. Do not share a candidate's background check results more widely than necessary.
If a check returns information that might lead you to withdraw the offer, give the candidate an opportunity to respond before you make a final decision. This is both fair procedure and good risk management — errors in third-party reports do occur.
Retain records for a reasonable period in case of a later dispute, but not indefinitely. Your retention policy should be documented and applied consistently.
Step 5: Apply checks consistently
One of the clearest routes to a discrimination complaint is running more intensive checks on candidates from particular groups. Apply the same checks to all candidates being considered for the same role. Document your process so you can demonstrate consistency if challenged under the Employment Equality Acts 1998–2015.
---
Run HR and payroll in Ireland with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle Ireland properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
[Start a free trial →](/register)