APAC: Background Checks

This month, we consider whether employers can conduct background checks by way of social media/internet searches on prospective employees, focussing on the position in Singapore, Hong Kong, Japan and South Korea.

CountryIs it legally permissible to run background checks by way of social media/internet searches on prospective employees?Is consent required before such background checks can be conducted?Can the information obtained from social media and internet searches be shared with the employer’s group of companies across jurisdictions?
SingaporeYes.No consent is required if the checks involve obtaining information that is publicly available. However, under the Personal Data Protection Act 2012 (“PDPA”), employers may only collect and use personal data for purposes that a reasonable person would consider appropriate in the circumstances (the “Purpose Limitation Obligation”).Yes. There are no legal restrictions in relation to the international transfer of publicly available data.
Hong KongYes.Yes. Unless the original purpose for which any information is in the public domain is the same as the purpose for which it will be used (i.e. if the data was made public for the purpose of an employer/ potential employer running background checks), the applicant/employee should be informed of the purpose of the collection of such data.Yes. However, Section 33 of the PDPO states that a “data user” may not transfer personal data outside Hong Kong, except (and only) if one or more conditions are satisfied. Those conditions include, for example, where:

  • personal data is transferred to a location acceptable to the Privacy Commissioner for Personal Data, Hong Kong (“PDPC”);
  • equivalent privacy laws exist in the destination; or
  • the data subject has consented in writing to the transfer.

Although section 33 has not yet come into force and no date for it to be brought into force has been fixed, the PDPC has published guidance which encourages all data users to comply with section 33.

JapanYes.Generally, no consent is required for such checks.

However, the Employment Stabilisation Law prohibits an employer from acquiring certain types of sensitive personal information for the purpose of recruitment. Such information includes information relating to an applicant’s/employee’s union membership, place of birth/familial home/registered permanent residence (i.e. domicile of origin or honseki in Japanese), use of alcohol/drugs, family (e.g. whether a female job candidate/employee intends to have kids), politics and sexuality.

Yes. However, under the amended Personal Information Protection Act, which came into effect in May 2017, the consent of the applicant/employee is required before an employer can transfer personal data to an overseas entity (including to a parent/group company), whether or not the information is publicly available.
South KoreaYes.No consent is required if the checks involve obtaining information that is publicly available. However, notice that such checks will be conducted should be provided to the individual.Yes. However, the data subject shall have the right to be informed of the identity of the third-party disclosee and its jurisdiction.



Herbert Smith Freehills LLP is licensed to operate as a foreign law practice in Singapore. Where advice on Singapore law is required, we will refer the matter to and work with licensed Singapore law practices where necessary.

Leave a Comment

Filed under Data protection and privacy, Jurisdiction: Asia

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.