When your company commissions a background check, it is not buying "information": it is commissioning the processing of personal data. In Argentina, that processing is governed by Law 25,326 on Personal Data Protection, and the obligations it imposes reach both the party that collects the data and the company that requests it and uses it to make a hiring decision. That is why it pays to understand what the law requires — and, above all, what to require from the provider doing the work.
Candidate consent: free, express and informed
The baseline rule of Law 25,326 is that processing personal data requires the consent of the data subject — in this case, the candidate. And not just any consent: it must be free (given without coercion), express (a concrete statement, not silence or a pre-ticked box) and informed (the candidate knows which data will be processed, for what purpose, and by whom).
In practice, this means the verification starts only once the candidate has signed their consent and provided their documentation. A report prepared behind the person's back is not just bad practice: it is data processing without a legal basis, and every party involved assumes the risk.
Purpose and relevance: verify only what the role justifies
The law requires that data be collected for a specific purpose and that it be relevant and not excessive in relation to that purpose. Applied to recruitment: you verify what is relevant to the role, and nothing more. A serious process first defines what the company needs to know to decide on that hire, and limits the verification to that.
This principle also has a specific labour-law boundary: Section 73 of Argentina's Employment Contract Law prohibits inquiring into a worker's political, religious or union opinions, or their sexual orientation. No report should collect or contain that information.
Data quality and confidentiality
Law 25,326 also requires that the data processed be truthful, accurate and up to date. An erroneous or outdated item in a report can unfairly harm a person and compromise the decision of whoever reads it. Hence the importance of every fact being verified against its source, with that source identified in the report.
Added to this is the duty of confidentiality: everyone involved in the processing is bound by professional secrecy, and the information circulates only among those who need it for the stated purpose. A pre-employment report is not material to share or reuse in other processes.
The candidate's rights: access, rectification and deletion
The data subject retains rights over their data throughout the process. The law grants them, among others, the right of access (to know which of their data was processed), rectification (to correct inaccurate or outdated data) and deletion (to request erasure when the processing is no longer warranted). A serious provider offers a clear channel for candidates to exercise these rights, and responds within the timeframes the law sets.
The AAIP, the supervisory authority
The enforcement authority for Law 25,326 is the Agency for Access to Public Information (AAIP). It is the body where databases are registered, where data subjects file complaints, and where penalties for non-compliance are processed. The existence of an active authority matters to your company: mishandling data in a hiring process is not a theoretical risk.
What to require from your screening provider
Outsourcing the verification does not outsource the responsibility of choosing the provider well. Before engaging one, ask them to demonstrate four things:
- Documented consent. No verification starts without the candidate's free, express and informed consent, and that consent is kept on record.
- Sourced facts, no verdicts. The report contains verified facts with their origin identified — no scores, no "fit/unfit", no recommendations about the person. The decision belongs to the employer, and a report that substitutes for it is a red flag.
- Relevant scope. Only what is relevant to the role is verified, and nothing the law prohibits inquiring into.
- Retention policy. There is a defined data retention period and a deletion procedure for when that period ends or the data subject requests it.
A well-made report protects twice: it gives your company reliable information to decide with, and it gives the candidate the assurance that their data was handled according to the law.
At Socioambientales DM we work under Law 25,326 from the very design of the process: informed consent, a defined purpose, sourced facts and confidentiality. If you would like to discuss how to approach pre-employment checks at your company, get in touch and we will work through it together.
This article is for information purposes only and does not replace professional legal advice.