Police checks and pre-employment medicals: handling sensitive candidate information
A criminal-history (police) check and a pre-employment medical are not ordinary personal information. Both are sensitive information under the Privacy Act, and sensitive information carries a higher bar: you generally need the candidate's consent to collect it, and you can only collect it where it is reasonably necessary for your work. That means you do not run these checks on everyone by default, you collect the result only where the role genuinely calls for it, and you protect and dispose of it carefully.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice, and this page does not tell you whether a particular check is lawful for a particular role.
Why these are treated differently
The Privacy Act defines a category of sensitive information that gets extra protection. It includes a person's criminal record and their health information. So:
- A police or criminal-history check result is sensitive information (criminal record).
- A pre-employment medical, functional assessment or any health-related screening result is sensitive information (health information).
Ordinary candidate data (contact details, work history) is personal information; these two are a rung above it.
The higher standard, in practice
For sensitive information, the general rule is that you collect it only if both of these hold (subject to limited exceptions):
- the candidate has consented to the collection, and
- the collection is reasonably necessary for your functions or activities.
For a recruiter, that translates into a disciplined approach:
- Collect only where the role calls for it. Do not run a blanket police check or medical on every candidate. Tie the check to the actual requirements of the specific role, and collect the result only for candidates where it is genuinely necessary (typically the preferred candidate, not the whole field).
- Get clear, specific consent before you collect, and make the purpose plain in your collection notice. Read: the candidate collection notice
- Collect the outcome, not everything. Often you need the check's result or clearance status, not a full copy of a candidate's medical file or complete criminal history.
- Secure it and dispose of it. Store screening results with tighter access than ordinary candidate data, and destroy or de-identify them when they are no longer needed. Read: how long to keep candidate records
Where privacy stops and legal advice starts
This is the important boundary, and we hold it firmly. Privacy law governs how you collect, use, secure and dispose of the screening data. It does not tell you whether you are allowed to require the check in the first place. Whether a role may lawfully require a police check or a medical, how spent-convictions rules apply, and how anti-discrimination law (including disability and criminal-record discrimination) constrains what you can ask and how you can use a result, are separate legal questions with real consequences. We do not answer them, and neither does a template. If a role involves a check that could screen a candidate out, get advice on the lawfulness of the check itself, then handle the resulting data on the privacy standard above.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Can we just run a police check on everyone who applies?
Treat that as no. Sensitive information generally needs consent and must be reasonably necessary, so a blanket check across every applicant is hard to justify on the privacy standard, and it may raise separate discrimination issues that are outside privacy law. Tie the check to the role and collect it only where needed.
The client employer asks us to hold the medical and police results. Can we?
You can only handle sensitive information on the consent-and-necessity standard, and you should be clear in your collection notice about disclosing results to the client employer. How long you hold it, and whether you should hold it at all versus the employer holding it, is a retention and minimisation question, keep as little as you need for as short as you need.
Is a working-with-children check different?
It is still sensitive information for privacy purposes and handled on the same standard. Whether a role legally requires one, and the specific scheme rules, are legal and regulatory questions to confirm for your jurisdiction and role, separate from the privacy handling.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not advise whether any particular screening check is lawful or appropriate for a particular role. Anti-discrimination, spent-convictions and inherent-requirements questions are legal questions to take to a qualified practitioner. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.