Background Check Malaysia: What Employers Can Verify and How to Do It Legally

Hiring the wrong person is one of the most costly mistakes a business can make. Beyond the financial impact of a bad hire, there are real risks to workplace safety, company reputation, and data security when candidate information goes unverified.

That is why background checks have become a standard part of the hiring process for Malaysian employers across industries. But conducting a background check in Malaysia is not as simple as running a quick internet search. There are legal requirements, consent obligations, and data protection rules that every employer must understand before screening a candidate.

For companies hiring employees in Malaysia without establishing a local entity, an employer of record can provide another layer of employment support by managing employment administration, payroll, and statutory compliance on the company’s behalf. However, employers should still ensure that appropriate candidate screening and hiring procedures are followed before employment begins.

This guide covers everything Malaysian employers need to know about background checks, including what you can verify, how to do it legally, PDPA compliance requirements, and best practices for building a safe and defensible screening process.

What Is a Background Check in Malaysia?

A background check also known as pre-employment screening, is a process employers use to verify the information a candidate provides during the hiring process. This includes checking their identity, employment history, academic qualifications, criminal record, and other relevant background information depending on the role.

A resume or CV only shows what a candidate chooses to share. Background checks give employers an independent means of verifying that the information presented is accurate, complete, and truthful. In today’s competitive hiring market, where candidates may exaggerate qualifications or omit relevant history, background screening is a critical risk management tool for employers.

Is Background Screening Legal in Malaysia?

Yes, background screening is legal in Malaysia. However, it must be conducted in compliance with the Personal Data Protection Act 2010 (PDPA 2010), which governs how personal data is collected, processed, stored, and used.

The key requirement under PDPA 2010 is consent. Employers generally cannot conduct a background check without the candidate’s knowledge and written consent. Doing so is a violation of the PDPA and can expose the employer to legal liability.

Two principles under PDPA 2010 are especially relevant to background screening:

• Notice and Consent Principle Employers must inform candidates that a background check will be conducted and obtain explicit consent before collecting or processing any personal data for screening purposes.
• Purpose Limitation Principle The data collected during a background check can only be used for the stated purpose, which is employment screening. Using candidate data for any other purpose without consent is a violation of PDPA 2010.

What Can Employers Check During a Background Screen in Malaysia?

Malaysian employers can conduct a range of checks depending on the role, industry, and level of seniority. Here is a breakdown of the most common types of background screening:

• Identity Verification Confirming the candidate is who they claim to be using their MyKad, passport, or other government-issued identification. This is the most fundamental check and should be conducted for all hires.
• Employment History Verification Confirming previous employers, job titles, dates of employment, and where disclosed, reasons for leaving. This helps identify gaps in employment history or misrepresented roles that could be a red flag for certain positions.
• Academic Qualification Verification Verifying that the candidate genuinely holds the degrees, diplomas, or professional certifications they have claimed. Academic fraud is more common than many employers realise and can have serious consequences for regulated industries such as engineering, healthcare, finance, and law.
• Criminal Record Check A criminal record check, also known as a Certificate of Good Conduct (CGC), is obtained through the Royal Malaysia Police (PDRM) or the MyEG portal. It is particularly important for roles involving financial responsibility, access to sensitive data, work with vulnerable populations, or positions of trust within an organisation.
  From March 2025, digital download options for the CGC have been made available, streamlining the process for employers and candidates. Processing time ranges from 10 to 60 days depending on case volume, with private screening companies offering faster turnaround of approximately 9 working days for overseas checks.
• Credit History Check Relevant for roles involving financial management, accounting, treasury, or access to company funds. Employers in the banking and financial services sector commonly conduct credit checks as part of their screening process.
• Professional Licence and Certification Verification For regulated roles such as engineers, doctors, lawyers, accountants, and licensed practitioners, employers should verify that the candidate holds the required professional licences and that these are current and in good standing.
• Reference Checks Contacting previous employers or professional references to gather feedback on the candidate’s performance, work ethic, and conduct. Reference checks provide qualitative insight that documents alone cannot reveal.
• Social Media Screening Reviewing publicly available social media profiles to identify any content that may indicate conduct inconsistent with the role or company values. This should be conducted with caution and within PDPA guidelines, limited to publicly available information only.

Background Checks for Expatriate Employees in Malaysia

Background checks for expatriate candidates differ from those for local hires. Additional verifications are typically required, including:

• Visa and work pass status verification
• International criminal history check via the Ministry of Foreign Affairs (MOFA) Certificate of Good Conduct
• International employment and qualification verification

The MOFA Certificate of Good Conduct is recognised for both employment and immigration purposes in Malaysia and is the standard document used for overseas background screening. Processing through the e-Konsular portal typically takes 10 to 60 days.

PDPA Compliance: What Employers Must Do

Conducting a background check in Malaysia without following PDPA 2010 requirements is not just a procedural lapse, it is a legal offence. Here is what employers must do to remain compliant:

• Obtain Written Consent Before conducting any background check, obtain written consent from the candidate. This is typically done through a consent form included in the job application or offer letter process. The consent should clearly state what checks will be conducted and how the information will be used.
• Be Transparent About the Process Inform candidates what types of screening will be carried out, who will conduct them, and how long the data will be retained. Transparency builds candidate trust and protects the employer in the event of a dispute.
• Use Data Only for the Stated Purpose Information gathered during background screening must only be used to make hiring decisions. It cannot be shared with third parties, used for marketing, or retained indefinitely without a legitimate purpose.
• Secure Storage of Screening Data All personal data collected during background checks must be stored securely and protected against unauthorised access. Employers should have a data retention policy that specifies how long screening records are kept and when they are destroyed.
• Inform Candidates of Adverse Findings If a background check reveals information that may affect the hiring decision, best practice is to inform the candidate and give them an opportunity to clarify or respond before a final decision is made. This is especially important for criminal record findings, which may have context that changes their relevance to the role.

What Employers Cannot Do During Background Checks in Malaysia

Understanding the boundaries of background screening is just as important as knowing what you can check. Here is what Malaysian employers must avoid:

• Conducting checks without consent Any background check conducted without the candidate’s written consent is a violation of PDPA 2010 and may expose the employer to legal action.
• Automatically rejecting candidates based on criminal records A criminal record alone does not disqualify a candidate. Employers must assess the relevance of the offence to the specific job role. Automatic rejection based on any criminal history without job-relevant justification may expose the employer to discrimination claims.
• Accessing data from unofficial or unlicensed sources Employers should only use licensed and reputable screening providers. Using unofficial channels to obtain personal data is both unreliable and potentially illegal.
• Retaining screening data longer than necessary PDPA 2010 requires that personal data is not kept longer than necessary for the purpose it was collected. Employers should set clear retention periods for screening data and ensure records are properly disposed of when no longer needed.

How Long Does a Background Check Take in Malaysia?

The timeline for background checks in Malaysia varies depending on the type of check and the method used:

Type of Check	Estimated Timeline
Identity Verification	Same day to 1 to 2 business days
Employment History Verification	3 to 7 business days
Academic Qualification Verification	3 to 10 business days
Criminal Record Check via PDRM or MyEG	10 to 60 days
Credit History Check	1 to 3 business days
International Background Check (Expatriates)	Approximately 9 working days via private providers

Employers who require faster turnaround may engage licensed private background screening companies in Malaysia, which typically offer streamlined processes and consolidated reporting across multiple check types.

Best Practices for Background Checks in Malaysia

Screen consistently across all hires for the same role Apply the same background check process to all candidates for a given role. Inconsistent screening practices can expose the employer to discrimination claims.

Tailor the depth of screening to the role. Not every position requires the same level of screening. A factory floor operator and a Chief Financial Officer carry very different levels of risk. Employers should also consider the different types of employment contracts in Malaysia when structuring the hiring arrangement, as the nature and duration of employment can affect the appropriate contract and onboarding requirements.

Use licensed and reputable screening providers For comprehensive or multi-check screening, engage a licensed background screening company. They have established processes, legal frameworks, and technology to conduct checks efficiently and compliantly.

Build screening consent into your hiring process Include background check consent as a standard step in your offer letter or onboarding documentation. Making it part of the standard hiring workflow ensures consistency and reduces the risk of forgetting to obtain consent.

Document your screening process Keep records of what checks were conducted, when consent was obtained, and what the results showed. This documentation protects the employer if a hiring decision is ever challenged. Employers should also ensure that post-selection employment documentation is properly prepared and compliant, including stamping employment contract requirements where applicable.

Conclusion

Background checks are a responsible and necessary part of hiring in Malaysia. They protect your business from fraudulent candidates, reduce the risk of a costly mis-hire, and help you build a workplace that is safe, trustworthy, and compliant with Malaysian law.

The key is to conduct screening correctly, with proper consent, within the bounds of PDPA 2010, and in a way that is proportionate to the role being filled.

Finding the right candidate starts with a thorough process, and that process begins long before a background check. At Trust Recruit Malaysia, our consultants conduct rigorous candidate screening as part of our end-to-end recruitment service, verifying qualifications, assessing experience, and presenting only candidates who genuinely match your requirements.

Save time, reduce hiring risk, and build a stronger team. Contact Trust Recruit Malaysia today to discuss your hiring needs.

Frequently Asked Questions