Your obligations as an employer
Background checking in Australia is regulated from several directions at once: the Privacy Act 1988 and its Australian Privacy Principles (APPs) govern how you collect and handle check information, anti-discrimination law shapes what you may act on, and industry regulators decide which checks are mandatory for which roles. The obligations below apply to almost every employer that screens candidates.
Get informed consent before every check
Every check draws on a candidate's personal information, so the starting point is informed, written consent collected before the check runs — not after. Good consent names the specific checks being performed, explains why each is relevant to the role, and identifies who will see the results. Candidates are entitled to decline; you may treat a required check as a condition of the role, but you cannot run it quietly without them. For referee-based checks, the referee's information is personal information too — collect it through the candidate and tell referees how their responses will be used.
Handle check data under the Privacy Act
Check results are sensitive by nature — criminal history in particular is explicitly sensitive information under the Privacy Act, which means a higher consent bar and tighter handling. The APPs expect you to collect only what is reasonably necessary for the role, tell candidates how their information will be used and disclosed, secure it against misuse and unauthorised access, and limit internal visibility to people who need it for the hiring decision. Forwarding a check result around the office by email is the classic failure mode: access should be deliberate, limited and logged.
Keep records that prove the check happened
Regulators and auditors rarely ask "did you make a good decision?" — they ask "show us the record." For each screened candidate you should be able to produce the consent, what was checked, when, the outcome relied on, and who viewed it. At the same time, the Privacy Act expects personal information to be destroyed or de-identified once you no longer need it — so keep the evidence of process for as long as your industry requires, and purge detailed contents (especially for unsuccessful candidates) on a defined schedule rather than by default forever.
Run a fair process on adverse findings
An adverse finding is the start of a process, not the end of one. Before acting on it: disclose what was found to the candidate, give them a genuine opportunity to respond — records contain errors, and context changes assessments — and weigh the finding against the inherent requirements of the specific role rather than a blanket rule. Discrimination on the basis of an irrelevant criminal record is unlawful in some jurisdictions and can be examined by the Australian Human Rights Commission in others, and spent-conviction schemes in every state limit which older matters you may consider at all. Document the reasoning either way.
Know what is federal and what is state-based
The split matters in practice. Privacy, right-to-work and sanctions obligations are federal and apply uniformly. Working With Children Checks, spent-conviction periods, high-risk work licensing and most occupational licences are state and territory schemes with real differences — a WWCC from one state generally cannot be relied on in another, and renewal periods and exemptions vary. NDIS worker screening is nationally recognised but issued through state screening units. If you hire across state lines, your screening matrix needs a state dimension, not just a role dimension.