International Background Checks for Remote Hires and Contractors
How a US, UK or Australian small business can run a lawful, proportionate background check on an overseas hire: what can be verified, official police certificates by country, consent and data-protection limits, and a sample consent checklist.
Published October 2026 · Last reviewed October 2026 · RSW Editorial
The short answer
A lawful, proportionate background check on an overseas remote hire has four parts: confirm who the person is, confirm what they say they have studied and done, check a criminal record only where the role justifies it and an official certificate exists, and get written consent before any of it starts. RemoteStaffingWiki’s judgement is that a small business should ask the candidate to supply official documents themselves, then verify those documents with the issuer, rather than try to search foreign records on its own.
This page is written for small businesses in the US, UK and Australia making a first offshore hire or engaging an overseas contractor. It covers what can realistically be verified abroad, which official certificates exist in a handful of common hiring countries, the consent and data-protection rules that apply, how to scale the checks to the role, and a sample consent checklist. It is general information, not legal advice.
What you can actually verify abroad
A background check is a set of separate questions, each with a different source of proof.
| Check | What it answers | Usual source of proof | Main limit |
|---|---|---|---|
| Identity | Is this the person on the CV? | Government photo ID shown on a live video call, matched to the name on every other document. | A document can be genuine and still belong to someone else, so match the face and name live. |
| Right to work or reside | Can this person lawfully do this work from where they live? | Passport and, where relevant, a residence or work permit. | Rules differ by country and by whether the person is an employee or a contractor. See the work permit guide linked below. |
| Education | Does the degree exist and belong to this person? | The awarding institution or an official authentication service. | Paper copies can be forged; use the issuer or an official service. |
| Employment history | Did they work where they say, in the role and dates stated? | Written confirmation from the former employer, plus reference calls. | Former employers may confirm only dates and title, or not reply. |
| Criminal record | Does an official record show convictions in that country? | A police or justice-agency certificate that the candidate applies for. | A certificate covers only the issuing country’s records and only what that country’s law allows it to show. |
| Credit or financial history | Is there a financial-integrity concern for a money-handling role? | Often not available or not lawful for overseas hires. | Skip it unless a lawyer confirms it is lawful and necessary for the role. |
The honest gaps
The official certificates described later each say what they cover. The Australian National Police Certificate is described by the Australian Federal Police as a summary of a person’s offender history in Australia. The South African Police Service describes its certificate as stating whether any criminal convictions have been recorded against the individual. In both cases the document speaks for one country’s records. A person who has lived in several countries can have a clean certificate from one and a record in another.
Certificates also show only what the issuing country’s law lets them show. The Australian page notes that spent convictions and some guilty findings without conviction may be left off, depending on state or territory law, and the GOV.UK page says a basic check shows only convictions that are not spent. Treat a clean certificate as one piece of evidence, not a guarantee.
Turnaround varies, and the South African page warns of a backlog. Build the wait into your start date and agree who pays the certificate fee before the candidate applies.
Official criminal-record certificates in common hiring countries
Turnaround and fees are shown where the issuing body publishes them. A candidate normally applies in their own name, because the issuer verifies the applicant’s identity. The Australian page, for example, says a person cannot apply for someone else’s police certificate without that person’s consent.
| Country | Document name | Issuing body | Application details published by the issuer | Official link |
|---|---|---|---|---|
| India | Police Clearance Certificate (PCC) | Passport Seva, Ministry of External Affairs | The application guide lists six online steps (passport type, applicant details, family details, address details, other details, self declaration). No turnaround is stated on that page. | https://www.passportindia.gov.in/psp/ApplyPCC |
| Philippines | NBI Clearance | National Bureau of Investigation (Department of Justice) | The Citizen’s Charter lists requirements of two valid government IDs and fingerprint, image and signature capture. The fee line on that page lists several amounts, so check the current fee with the issuer. | https://nbi.gov.ph/citizens-charter/nbi-clearance-application/ |
| Mexico | Constancia de Antecedentes Penales Federales (federal criminal record certificate) | Órgano Administrativo Desconcentrado Prevención y Reinserción Social (OADPRS) | Applied for online with a Llave MX account or a CURP. No turnaround or fee is stated on the portal home page. | https://constancias.oadprs.gob.mx/ |
| South Africa | Police Clearance Certificate (PCC) | South African Police Service, Criminal Record and Crime Scene Management, Pretoria | Finalisation takes approximately 15 working days from receipt of all documents, excluding postal time. Fee R190 per application. The page notes a backlog that has extended waiting periods. | https://www.saps.gov.za/services/applying_clearence_certificate.php |
| Australia | National Police Certificate (NPC) | Australian Federal Police | Digital certificates often arrive within days when applying online, although some take longer. Fingerprint checks take at least 15 working days. Fee AUD 57, or AUD 114 with fingerprints. | https://www.afp.gov.au/our-services/national-police-checks |
| United Kingdom | Basic DBS check (basic disclosure) | Disclosure and Barring Service via GOV.UK | Costs £20. The page says it usually takes up to 3 days to process, then a paper certificate is posted. The page covers people working in England and Wales and shows only unspent convictions. | https://www.gov.uk/request-copy-criminal-record |
Our country guides give the wider hiring context for the Philippines, India, Mexico and South Africa. The GOV.UK basic DBS page covers jobs in England and Wales only.
Consent and data-protection limits
A background check collects personal data about a person, often sensitive data, and at least two sets of rules usually apply: the rules where you are and the rules where the candidate lives. This section summarises the instruments small businesses commonly meet. Each can change, and none replaces advice from a qualified lawyer.
United States: the Fair Credit Reporting Act
The Federal Trade Commission’s guide for employers explains that when you obtain background information, such as a credit or criminal report, from a company in the business of compiling it, the Fair Credit Reporting Act (FCRA) requires several steps before you get the report. You must tell the applicant in writing, in a stand-alone format that is not buried in an application, that you may use the information for employment decisions. You must get the applicant’s written permission. And you must certify to the reporting company that you notified the applicant, got permission, followed the FCRA, and will not misuse the information in breach of equal-opportunity law.
If you then decide not to hire based on such a report, the FTC guide says you must give the person, before the decision, a copy of the report and a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act”, and afterwards tell them they were rejected because of information in the report, who supplied it, that the supplier did not make the decision, and that they can dispute the report and get a free additional copy within 60 days.
The FTC guide does not discuss overseas candidates, so it does not tell you whether a given foreign hire falls inside or outside the statute. RemoteStaffingWiki’s guidance is to follow the notice-and-authorisation steps for every candidate regardless of location, because they cost little and they build the written consent trail that overseas privacy laws also expect. The same guide adds that federal anti-discrimination law, enforced by the Equal Employment Opportunity Commission, applies to background information “regardless of how you got the information”. That includes applying the same standards to everyone and taking care with policies, such as automatic exclusion for any criminal record, that could disadvantage people with a protected characteristic.
European Union: criminal data is specially restricted
Article 10 of the EU General Data Protection Regulation says that processing personal data about criminal convictions and offences based on Article 6(1) must be carried out only under the control of official authority, or when it is authorised by Union or Member State law that provides appropriate safeguards. Article 10 ties this processing to official authority or a legal basis in Union or national law. RemoteStaffingWiki’s reading is that a bare consent form may not be enough, so take advice. Under Article 3(2), the regulation can also reach a business outside the Union when it processes data of people who are in the Union in connection with offering goods or services to them or monitoring their behaviour, so a non-EU business hiring a person in the EU should take advice before collecting such data.
Article 44 sets the general principle for transfers of personal data to a third country: a transfer may take place only if the conditions in that chapter are met, including for onward transfers. Sending a candidate’s data from the EU to your country is likely to fall under these transfer rules (RemoteStaffingWiki’s reading). Ask a lawyer which mechanism covers your set-up.
India: the Digital Personal Data Protection Act, 2023
Section 3 of India’s Digital Personal Data Protection Act applies to processing of digital personal data within India and also to processing outside India if it is connected with offering goods or services to people in India. Section 7(i) lists as a “certain legitimate use” processing for the purposes of employment, or to safeguard the employer from loss or liability, such as preventing corporate espionage or protecting trade secrets. Section 16 lets the Central Government restrict, by notification, the transfer of personal data for processing to countries it names; the text does not name any country itself. Because the legitimate-use ground is framed around employment and the position of contractors is not addressed in the text, ask a lawyer whether your engagement is covered, and rely on documented consent where in doubt.
Philippines: Data Privacy Act of 2012 (Republic Act 10173)
The Philippine Act treats as sensitive personal information anything about “any proceeding for any offense committed or alleged to have been committed” by a person, the disposal of those proceedings, and any court sentence, along with education, health and government-issued identifiers such as tax returns. Section 13 prohibits processing of sensitive personal information except in listed cases, the first being that the data subject gave consent specific to the purpose before processing. Section 6 gives the Act reach beyond the Philippines in defined circumstances when the data concerns a Philippine citizen or resident. Section 21 makes the organisation that controls personal information responsible for it when it is passed to a third party, at home or abroad, and expects contractual or other reasonable means to give comparable protection. The National Privacy Commission publishes the Act and guidance at privacy.gov.ph.
Across all four sets of rules the basics are similar: say what you collect and why, keep to what the role needs, limit who sees it, and delete it when the reason ends. Our guide to data security when outsourcing covers the access-control side, and the remote hiring compliance guide covers the wider legal checklist.
The rules on candidate and employee data in Europe are summarised in our glossary entry on GDPR for remote hiring. When a screening firm handles candidate data for you, the terms are usually set in a data processing agreement, which our glossary explains.
What the candidate supplies and what a screening firm does
There are two routes, and a small business can combine them.
Route 1: the candidate supplies verified documents
- A government photo ID and a live video call to match it to the face.
- The official criminal-record certificate for their country, applied for in their own name, with the application receipt.
- Certified copies of degrees and transcripts, or access to an official verification record.
- Contact details for two or more referees and written permission for you to call them.
- Written permission for you to contact former employers and the awarding institutions.
This route puts the work of applying on the candidate, so allow extra time.
Route 2: a screening firm acts for you
A professional screening firm can contact institutions and former employers, and may obtain records the candidate cannot hand over directly. Questions to put to any firm: which countries and record types does it cover, and which will it refuse? On what legal basis does it collect each record? Where is the data stored, who sees it and how long is it kept? Does it supply the notices the FTC guide describes if you are a US business? Who is responsible for errors? Get the answers in writing.
Education verification through official services
Some countries run official academic-record services. In the Philippines, the Commission on Higher Education’s eCAV service describes itself as a means of official and secure verification of higher-education academic records, and its requirements page asks for transcripts and diplomas that are certified true copies signed by the current registrar of the higher-education institution. In India, the National Academic Depository, operated under the University Grants Commission, describes itself as an online store of academic awards that supports online verification “with prior consent of the student concerned”, and says paper records are susceptible to forgery.
Proportionality: match the check to the role
The FTC guide’s starting point is that it is not illegal to ask about a candidate’s background, but you must treat everyone equally and must not use background information in a way that discriminates. RemoteStaffingWiki’s guidance is to scale the checks to what the person can damage, and to write the scale down before you meet candidates so every applicant for the same role gets the same treatment.
| Role type | Access level | Suggested checks |
|---|---|---|
| General virtual assistant or admin support | Shared calendars and inboxes; no payment authority; limited customer data | Identity, two references, employment-history confirmation. A criminal-record certificate is optional and should be justified in writing. |
| Customer support or sales agent | Customer contact details and order history | Identity, references, employment history, and a criminal-record certificate if the role handles sensitive personal data. |
| Bookkeeper, accountant or anyone who can move money | Bank access, payment approval, financial records | Identity, education or licence confirmation, employment history, references, and a criminal-record certificate with a lawyer’s view on whether any credit or financial check is lawful. |
| Roles with health data or other highly sensitive personal data | Patient or client records, regulated data | All of the above, plus a data-processing agreement and an access plan, checked against the sector rules that apply to you. |
| Developer with production access | Source code, servers, customer databases | Identity, references, employment history, and a criminal-record certificate where the role justifies it, together with strict least-privilege access and logging. |
For a general virtual assistant, an intrusive check may not be proportionate, because the access you grant can be limited in the first place (RemoteStaffingWiki’s judgement). RemoteStaffingWiki’s judgement: limiting access is itself a control and may do more than an intrusive check. See the remote onboarding playbook for how to stage access during the first weeks.
Two cautions from the FTC and EEOC material. Do not ask medical questions before a conditional job offer. And take special care with blanket exclusion rules for any criminal record, because a policy that disproportionately disadvantages people of a particular race, national origin or other protected characteristic, and does not accurately predict who will be a responsible, reliable or safe employee, can have a disparate impact. Look at what the conviction was, how long ago it was, and how it relates to the job, and apply the same approach to every candidate.
Contractors and employees: who is being screened
The checks you run, and the consent you need, can depend on whether the person is an employee or a contractor, and on who is the legal employer. If you use an employer-of-record or similar arrangement, the provider may hold the employment relationship and run its own checks, so agree who collects which data. Our comparison of EOR, AOR and contractor-of-record models explains who is responsible for what, and the independent contractor entry defines the status. Test the engagement itself with the misclassification risk tool before you decide how much control your checks and onboarding imply.
Screening is also a step before payment and onboarding. Our guide to paying international contractors covers what to collect before the first invoice, and the work permit versus work visa entry explains why the right to work needs its own check.
Red flags: fake degrees and invented experience
The following are patterns to look at more closely. None proves wrongdoing alone, and each can have an innocent explanation. This list is RemoteStaffingWiki’s guidance.
- A degree or certificate that exists only as a scan, with no way for the issuer to confirm it.
- Dates that do not add up: a full-time degree overlapping a full-time job in a different city, or a job title that postdates the dates on the CV.
- Reluctance to give written permission for you to contact the institution or a former employer.
- Referees reachable only through a single mobile number or a free email address, with no company domain or verifiable role.
- Detailed answers about the tools on the CV that fall apart under a practical question, or a work sample the candidate cannot explain step by step.
Use the checks above to confirm facts and a paid, time-boxed work sample that mirrors the real job to confirm ability.
Reference calls across time zones
A reference call is the one check that gives you a human account of the person’s work. Overseas it fails mainly because of scheduling and language rather than honesty. RemoteStaffingWiki’s guidance is below.
- Ask the candidate to arrange the introduction and the time, then confirm directly with the referee at a business email address.
- Offer a short written questionnaire as an alternative if the referee cannot find a slot, and keep the questions identical for every candidate.
- Find an overlapping window in advance; the timezone overlap tool shows when working hours coincide.
- Use the same short script each time: dates of work, role, main duties, one strength, one development area, whether they would work with the person again and why or why not.
A sample consent checklist (RemoteStaffingWiki template)
This is the site’s own template, not a legal form. Have a lawyer adapt it to your location and to the candidate’s country before use.
- Purpose: the document states in plain words that you are carrying out checks to decide whether to engage the person.
- Stand-alone: US businesses using a reporting company should keep the FCRA notice as its own document, not part of the application, as the FTC guide describes.
- Specific list: it names each check, such as identity, education, previous employers, references and criminal-record certificate.
- Data and recipients: it says what data you will collect, who will see it, and which countries it will be sent to.
- Voluntary: it says the candidate can decline a check, and what the consequence is for the application, so consent is informed.
- Retention: it states how long you will keep the results and how they will be deleted, and that you will not keep a certificate longer than the role needs.
- Authorisation: the candidate signs and dates it, with a language the candidate can read confidently.
- Outcome: it says what you will do if a result is a concern, including a chance for the candidate to explain, in line with the pre-decision steps in the FTC guide for US reports.
- Rights: it tells the candidate how to ask for a copy of the data, correct it, or complain, with contact details for your privacy contact.
Sources
US Federal Trade Commission, Background Checks: What Employers Need to Know: https://www.ftc.gov/business-guidance/resources/background-checks-what-employers-need-know
Regulation (EU) 2016/679 (GDPR), Articles 3, 10 and 44, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
India, Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Electronics and Information Technology: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
Philippines, Data Privacy Act of 2012 (Republic Act 10173), National Privacy Commission: https://privacy.gov.ph/data-privacy-act/
India, Passport Seva, Apply for Police Clearance Certificate: https://www.passportindia.gov.in/psp/ApplyPCC
Philippines, National Bureau of Investigation, Citizen’s Charter, NBI Clearance Application: https://nbi.gov.ph/citizens-charter/nbi-clearance-application/
Mexico, Constancia de Antecedentes Penales Federales, OADPRS: https://constancias.oadprs.gob.mx/; process page: https://www.gob.mx/prevencionyreinsercion/articulos/tramita-tu-constancia-de-antecedentes-penales
South African Police Service, Applying for a Police Clearance Certificate: https://www.saps.gov.za/services/applying_clearence_certificate.php
Australian Federal Police, National Police Checks: https://www.afp.gov.au/our-services/national-police-checks
GOV.UK, Request a basic DBS check: https://www.gov.uk/request-copy-criminal-record
Commission on Higher Education (Philippines), eCAV: https://ecav.ched.gov.ph/; requirements: https://ecav.ched.gov.ph/requirements
University Grants Commission (India), National Academic Depository: https://nad.gov.in/about.html; https://nad.gov.in/benefits.html
RemoteStaffingWiki (internal): Remote hiring compliance, Data security when outsourcing, Paying international contractors
References checked on 31 October 2026.