A pre-employment check can reveal information an applicant would not share widely: past addresses, qualifications, employment history, referees, criminal history where lawfully obtained, or financial information for a role that justifies it. So, are employee checks confidential? In New Zealand, they should be handled confidentially, but confidentiality is not absolute. The answer depends on the type of check, the individual’s authority, the purpose of the role, and who has a legitimate need to review the result.
For employers, agencies and applicants alike, the practical standard is clear: collect only what is relevant, be open about the process, protect the information, and restrict access to people making a genuine employment or risk decision.
Are employee checks confidential under New Zealand law?
Employee screening information is generally personal information. That means an employer, recruitment provider or investigator handling it must comply with the Privacy Act 2020 and its Information Privacy Principles. The information cannot simply be circulated internally because it may be useful or interesting.
In practical terms, a candidate should be told what information is being collected, why it is needed, who will carry out the check, and who may receive the result. Consent is commonly sought before reference checks, verification work, credit-related enquiries, Police vetting, or other more sensitive screening. The wording and scope of that consent matters. A broad form signed months earlier may not justify every later enquiry.
Confidentiality also does not mean the applicant alone can see the material. A hiring manager, HR professional, security lead, compliance officer or authorised client representative may need access where their role requires it. Access should be limited to that group, rather than extended across a wider management team.
Confidential does not mean invisible
The most useful way to view confidentiality is on a need-to-know basis. A properly managed check may involve several parties: the candidate, the employer, an external screening provider, a referee, and sometimes an agency administering a formal vetting process. Each party should have a defined purpose and appropriate controls.
For example, a referee may be asked to confirm dates of employment, duties, reliability and suitability. The referee’s comments should not become office gossip or be forwarded without control. Likewise, a report prepared for a regulated, safety-sensitive or financially trusted role should be delivered only to authorised decision-makers and stored in a secure system.
There are exceptions. Information may need to be disclosed where required or permitted by law, in response to a lawful request, to prevent or lessen a serious threat, or where a person has clearly authorised disclosure. These exceptions are fact-specific. They are not a licence to share an applicant’s personal history casually.
The type of check changes the privacy risk
Not all employee checks involve the same level of sensitivity. Confirming a professional qualification is different from examining a person’s credit history, investigating alleged misconduct, or undertaking a Police vetting process for work involving children or vulnerable people.
A proportionate approach is essential. The more intrusive the check, the stronger the connection should be between the information sought and the responsibilities of the position. A finance role with authority over payments may justify different enquiries from an entry-level role with no access to money, sensitive systems or vulnerable clients.
Criminal record information requires particular care. Employers should avoid assumptions and assess relevance, time elapsed, the nature of the role, and any applicable legal protections. A historic matter does not automatically determine a person’s current suitability. Decisions should be fair, evidence-based and capable of explanation.
Credit checks also require restraint. Financial information can be highly personal and is not appropriate as a routine screening tool for every role. Where it is relevant, the candidate should understand why it is being requested and how the result may affect the process.
What employers should tell candidates before checking
A transparent process protects the candidate and the organisation. Before any substantive screening begins, an employer should explain the checks proposed and obtain authority where required. Good practice is to set this out in a clear privacy collection statement or screening consent document, not bury it in vague recruitment paperwork.
Candidates should be able to understand the purpose of the check, the likely sources of information, whether an external provider is involved, how long results will be retained, and how to request access or correction. Where screening is undertaken after a conditional offer, that should also be made clear.
If information may lead to an adverse decision, fairness usually calls for giving the candidate an opportunity to respond. Records can be wrong, incomplete or lacking context. A discrepancy in dates may have a simple explanation; an allegation may never have been substantiated; a referee may have confused one employee with another. Acting on untested information creates unnecessary legal, reputational and human risk.
How confidential employee checks should be managed
Privacy obligations are only effective when backed by operational discipline. Reports should not be sent to personal email addresses, left on shared drives with unrestricted access, or retained indefinitely just because storage is easy.
Organisations conducting regular recruitment should have a documented screening procedure that addresses collection, authority, verification, reporting, access, retention and secure disposal. There should also be a clear escalation path for adverse findings, identity concerns, suspected fraud, or information that indicates an immediate safety issue.
A sound process commonly includes the following controls:
- collecting only information connected to the role and stated purpose;
- confirming the applicant’s informed authority before checks begin;
- restricting reports to authorised decision-makers;
- recording decisions and the basis for any adverse outcome;
- securing digital and paper records against unauthorised access; and
- deleting or securely disposing of material when retention is no longer justified.
For organisations with operations across New Zealand, consistency matters. A process applied in Auckland should be governed by the same privacy standards as one carried out in Wellington, Christchurch or a remote location. Local field capability may be necessary to verify facts quickly, but it does not reduce the obligation to handle personal information carefully.
Can an employee or applicant ask to see the results?
In many cases, yes. Individuals generally have rights to request access to personal information held about them and to seek correction where it is inaccurate. There can be lawful reasons to withhold some material, such as information that would unreasonably disclose another person’s private affairs, confidential evaluative material in certain circumstances, or information subject to another legal restriction.
Those limits should not be used as a default response. Employers should handle access requests promptly and carefully, identify the information held, and consider what can properly be released or explained. Where a report contains sensitive third-party material, redaction or a considered summary may sometimes be appropriate.
Applicants also have practical choices before providing consent. They can ask what checks are proposed, whether a check is mandatory, whether the role can proceed without it, and who will receive the information. A professional employer should be able to answer those questions directly.
When external screening is involved
Outsourcing a check does not outsource responsibility. The employer still needs confidence that its provider is acting lawfully, discreetly and within the agreed scope. That includes secure handling of documents, reliable identity verification, accurate reporting, controlled communication and clear records of authority.
For sensitive assignments, the provider’s experience is more than a commercial consideration. Investigative work can involve complex sources, urgent timeframes and difficult personal circumstances. It must be conducted by properly licensed professionals who understand both evidential standards and privacy boundaries. The Neill Group applies this disciplined approach to field-based enquiries and investigative assignments, with reporting directed only to authorised clients.
A confidential process is also a fair process
The question is not merely whether an employee check can be kept secret. It is whether the organisation can justify the enquiry, explain it openly, protect the result, and make a fair decision from reliable information. When those standards are met, screening supports safer hiring without treating personal information as an organisational asset to be freely shared.
For applicants, asking sensible questions before consenting is prudent. For employers, clear authority, proportionate checks and disciplined handling are the strongest protection for both the organisation and the people it seeks to employ.