One of the most common questions employers ask is whether they can run a background check without consent. Or, put another way, is permission for background checks really needed? The short answer in Malaysia: yes, and you should not skip it. Here is why, and how to handle consent properly.

Note: This article is general information, not legal advice. For specific situations, speak to a lawyer.

Background check laws in Malaysia: the PDPA

Malaysia's Personal Data Protection Act 2010 (PDPA) governs how businesses collect and use personal data in commercial transactions, including employment. Among its principles, the PDPA expects organisations to:

• Tell individuals what personal data is being collected and why

• Obtain consent to process their personal data

• Use the data only for the stated purpose

• Keep the data secure

• Not keep the data longer than necessary

• Allow individuals to access and correct their data

A background check involves collecting and processing personal data, so these principles apply.

Can you run a background check without permission?

Running a background check without permission exposes your business to legal and reputational risk. It also damages trust. If a candidate finds out you screened them without telling them, they are unlikely to want to work for you. The safe and fair approach is always to get written consent first.

What a good consent form includes

• The purpose of the check (for example, assessing suitability for a specific role)

• The types of checks you will run

• Who will carry out the check (your company and your screening provider)

• How the results will be used and stored

• How long the results will be kept

• The candidate's right to access and correct their data

• The candidate's signature and date

Platforms like CheckDulu collect candidate consent up front as part of the process, so you do not need to manage separate paperwork.

What if a candidate refuses?

Candidates can say no. If screening is a genuine requirement for the role and you have applied it consistently, you may decide not to proceed. Explain your reasoning politely and keep it consistent for everyone applying for the same role.

Background check confidentiality

Consent is only the first step. Once you have a report:

• Limit access to the people involved in the hiring decision

• Do not share results with colleagues, other candidates or third parties

• Store reports securely, not in shared folders or chat groups

• Delete them when they are no longer needed

Checking current employees

The same principles apply to existing staff. If you plan to screen employees, for example when they move into a sensitive role or for ongoing monitoring, explain why and get their consent.

Consent builds trust

Being open about screening shows candidates you run a professional, fair business. It also protects you if your hiring decisions are ever questioned. Learn how consent fits into the full process in our employee background verification guide.

Check dulu before you hire

CheckDulu helps Malaysian SMEs run fast, consent-based background checks across 10+ public sources, including identity, education, criminal prosecution, civil litigation, Industrial Court records, regulatory watchlists, adverse news and fraud/scam records. Checks start from RM78, your first report is free, and results arrive within 24 hours. Run your first background check with CheckDulu.