Who is accountable when background checks are required but local law limits what can be collected?

Why This Matters for Security Teams

When background checks are required, the real question is not whether the control is desirable, but who owns the risk decision when local law restricts collection. Security cannot treat this as a simple checkbox if privacy, labour, or data minimisation rules prevent the usual evidence. Governance has to reconcile legal limits with the organisation’s access risk, especially for privileged humans and administrators who can affect systems that include NHIs. NHI Mgmt Group notes in the Ultimate Guide to NHIs that 97% of NHIs carry excessive privileges, which is a reminder that identity risk often spans both human and non-human access paths.

In practice, teams get into trouble when they assume policy language alone can override local law, then discover the problem only during audit, onboarding, or an incident review.

How It Works in Practice

Accountability is shared, but decision authority should be explicit. Security defines the access risk, HR verifies what can be collected, legal interprets the jurisdictional limits, and compliance confirms the evidence standard the organisation will accept. The control objective is usually not “collect everything,” but “make a defensible hiring or access decision with lawful evidence.” That may mean using alternative due diligence, such as identity verification, reference checks, sanction screening where lawful, employment history confirmation, role-based access delay, or enhanced supervision until the person is approved.

Good practice is to document three things: the legal constraint, the alternative control, and the residual risk accepted by the business owner. For regulated environments, map the decision to internal control requirements and to security frameworks such as NIST SP 800-53 Rev 5 Security and Privacy Controls, which expects organisations to manage personnel security and access authorisation through defined, reviewable processes. For NHI-heavy environments, the same logic extends to vendors, service accounts, and operator roles that can create or alter credentials covered in the Ultimate Guide to NHIs.

• Define which roles truly require background screening before access is granted.
• List the evidence the organisation can lawfully collect in each jurisdiction.
• Use compensating controls when screening is limited by law.
• Record the approval path and the person accountable for the exception.
• Review whether the role can start with reduced privileges until checks are complete.

These controls tend to break down when multinational onboarding uses one global policy for jurisdictions with materially different lawful-basis requirements.

Common Variations and Edge Cases

Tighter screening often increases onboarding friction, requiring organisations to balance risk reduction against hiring speed and privacy obligations. There is no universal standard for this yet, so best practice is evolving around proportionality rather than blanket collection. Some jurisdictions allow only limited checks for certain roles, while others restrict criminal history questions until later in the process. In those cases, accountability still sits with the organisation, but the control set must shift from collection-heavy screening to access staging and documented exceptions.

A common edge case is a contractor or third-party operator who needs privileged access before full screening can be completed. The safer pattern is temporary, minimal access with enhanced monitoring and explicit expiry, not informal approval by a manager. Another edge case is when internal policy demands a check that local law prohibits. In that situation, policy should be revised or a jurisdiction-specific annex created, rather than forcing legal noncompliance. Current guidance suggests that the decision owner should be identifiable in writing, with HR and legal supporting the record, so auditors can see why an alternative due diligence path was chosen.

Related resources from NHI Mgmt Group

• Who is accountable when a misconfiguration reaches production despite CI/CD security checks?
• Who is accountable when a regulated business fails to apply the required identification and due diligence checks?
• Who is accountable when a business continues dealing with an ASF-linked counterparty after red flags appear?
• Why do funds care so much about investor qualification beyond simple suitability checks?