An employee background check verifies what a candidate claimed on the CV and in the interview: identity, degree, work history, references, and for some roles a police record. HR may run it as long as the candidate knows and agrees, the checks match the risk of the role, and the data is used only for the hiring decision. This article covers which items you can check in Indonesia and Malaysia, the order to do them in, and gives a consent template and reference questions you can use today.

Run the check after the interview. For the steps before it, see how to screen 1,000 resumes and interview questions by role.

What you can check and what you cannot

Item Allowed? Condition How
Identity (national ID) Yes Ask only for what you need Match name and birth date to the CV and degree
Degree and transcript Yes Candidate consent Official verification system or written confirmation from the institution
Work history Yes Candidate consent Contact the former employer's HR through an official channel
References Yes The candidate names them Phone call with the same questions for everyone
Police record Yes, for some roles Candidate obtains it and consents Accept the original, check date and issuing area
Medical examination Yes, for some roles Same rule for all candidates of that role, written consent Partner clinic, result sent directly
Drug test Limited Only roles with safety risk, with consent Clinic or laboratory
Public information online Yes Only what is publicly available Name search, work-related items only
Personal credit history Rare and hard Credit data is confidential Not recommended for ordinary roles
Locked private social media No Not public information Never ask for passwords or ask candidates to open accounts

The Indonesian items follow the SSEK law firm's review of background checks in Indonesia (1 February 2019). SSEK notes that Indonesian employment law does not expressly regulate background checks, so the limits come from candidate consent, reasonableness, and personal data rules.

The legal basis

Indonesia has no single law on background checks. The personal data rules apply:

  • Law No. 27 of 2022 on Personal Data Protection (PDP Law), Article 4, splits data into general and specific data. Specific data includes health data, biometric data, genetic data, and criminal records. A police certificate or medical result sits in the more sensitive group.
  • Article 20 requires a data controller to have a basis for processing, one of which is explicit valid consent. So get written consent before any check.

The full treatment of retention, candidate rights, and HR duties is in the Indonesia PDP Law guide for recruiting.

In Malaysia, the Personal Data Protection Act 2010 (PDPA) treats data such as physical or mental health and criminal offences as sensitive personal data, and processing it needs the person's explicit consent unless an exception applies (section 40). The Personal Data Protection Regulations 2013 require the data user to keep a record of consents. The 2024 amendment (Act A1727) renamed the data user a data controller and added duties such as a data protection officer and breach notification, brought into force in stages during 2025. Keep the signed consent forms.

In both countries, collect sensitive documents only from candidates who passed the interview.

The order of work

  1. Interviews end and a candidate is chosen.
  2. Send the consent form (template below) with a conditional offer.
  3. Verify identity and degree.
  4. Check work history and references.
  5. Request a police record or medical examination only for roles that need it.
  6. Decide, then send the final offer.

Employed candidates often do not want their manager called before there is an offer. The conditional offer in step 2 gives them a reason to agree, and you avoid checking too early.

How to verify each item

Degree and transcript

In Indonesia, university degrees can be checked on the Ministry of Education's degree verification page (ijazah.kemdikbud.go.id) and through graduate search on PDDikti. The system rests on the national degree numbering set by Directorate General of Higher Education Circular No. 7 of 2020. The most common obstacle in the sources we read is the university not having reported data to PDDikti. If a degree does not appear, ask for the originals and confirm with the university's academic office by official letter or email. Do not call it fake before the university replies.

In Malaysia and for school-level certificates, confirm directly with the institution, with the candidate's consent.

Work history

Call the former employer's HR on a number you find yourself, from the official website or head office, not the number printed on the reference letter. Ask what can be proven:

  • Job title and start and end dates
  • Whether the person is eligible for rehire
  • Whether a serious disciplinary record exists (only if the candidate agreed)

Do not ask a former employer for the candidate's old salary unless the candidate allows it.

References

A reference is someone the candidate named, so consent is already there. Use the same questions for every candidate for the role:

  1. How long and in what capacity did you know the candidate?
  2. What were the main tasks while working with you?
  3. What work from this candidate are you most proud of?
  4. Describe one thing the candidate should improve.
  5. How was attendance and punctuality?
  6. How did the candidate handle money, goods, or company data? (for roles that hold them)
  7. How did the candidate work with colleagues and managers when there was a problem?
  8. If a fitting role opened, would you hire the candidate again?

Write down answers in the referee's own words. "A nice person" is not information. Ask for an example, as you would with an interview follow-up.

Police record

In Indonesia the police certificate is the SKCK. According to SSEK, it only states that the person is not currently in criminal proceedings in the issuing district, and there is no centralized national criminal record. It does not prove someone has never had legal trouble. Use it as an administrative requirement for roles that hold money or goods, and never as the only basis for a decision. The candidate applies for it, so ask for the original.

In Malaysia, ask the candidate for a police clearance document only where the role justifies it, with written consent, and treat it as sensitive data from the moment you receive it.

Medical examination and drug test

SSEK notes that a physical examination may be required if it applies equally to all candidates for the role and the candidate gives written consent to the examination and release of results. Drug testing is limited to roles with safety risk, such as driving or operating machinery. Ask the clinic for a fit-for-work conclusion instead of the full medical details unless you truly need them.

Consent form template

Copy it, fill in the company name, and send it with the conditional offer:

I, [candidate name], consent to [company name] verifying the following for the hiring decision on the [position] role: identity, degree and transcript, work history, and the references I listed. [Add: police record / medical examination, only if the role requires it.] The checks are done by [HR team / third party name] and finish within [number] working days. My data is used only for this decision and kept for at most [number] months if I am not hired. I may ask questions or request corrections to the results through [HR email].

Name, date, signature

Fill in the retention field with your own company policy. Do not leave it blank.

Check levels by role

Role Checked Add when risk is higher
Call center agent, admin Identity, degree, work history References for senior roles
Cashier, store staff Identity, work history, references Police record, since they handle cash
Courier, driver Identity, original driving licence and expiry, work history Medical examination, police record
Security guard Identity, training certificate, work history Police record, medical examination
Factory and warehouse operator Identity, work history Medical examination based on job hazards
Finance staff Identity, degree, work history, references Police record

The more access a role has to money, goods, or people's safety, the deeper the check. Do not check police records for roles that hold nothing of value.

When results do not match

Gaps in the data often have ordinary causes: a start date differs by a month because of how it was counted, or a company changed its name. A fair procedure:

  1. Record the gap clearly: what the candidate wrote, what you found, and the source.
  2. Ask the candidate and give time to explain or show documents.
  3. Decide by relevance to the job. A small date gap is different from a proven fake degree.
  4. If you decline, keep a note of the reason and delete the data on your retention schedule.

Common mistakes

  • Checking every applicant. It is costly, and you collect sensitive data from hundreds of people you never hire.
  • Asking candidates to open personal social media accounts. It is unnecessary and invites trouble.
  • Using the phone number printed on a reference letter. It may belong to whoever wrote a forged letter.
  • Rejecting a candidate over a single reference comment without asking the candidate.
  • Keeping copies of IDs, police records, and medical results in chat groups or shared folders without access limits.

Where Inhire fits

Inhire (getinhire.com) is an AI screening and AI interview platform for high-volume hiring. Background checks are expensive when run on too many people, so Inhire's job is to narrow the list before this step. The Inhire AI interviewer runs the first-round voice interview for every applicant, and each answer has a transcript, audio, and a score with the quotes behind it. Your team then verifies identity, degree, and references only for the candidates you picked. Inhire does not perform background checks, and your team makes the final decision.

Start free on one open role, or read the interview scorecard template to build scores you can compare.