Social media checks on job candidates
No UK law bans employers from looking at a candidate's public social media, and no law makes it routine, but data protection and equality law control when and how it can be done. The Information Commission (ICO) says that if you want to check public profiles as part of pre-employment vetting, you must be able to justify why it is necessary, which means identifying and documenting a specific risk, and you must tell candidates. Acas advises against using information on someone's personal social media to decide whether to interview or hire them. It warns you might be breaking the law if the person did not agree to that use, or if you looked at some applicants' profiles but not others.
Our view: for most jobs the right answer is not to look. Where a role carries a specific risk you can name, such as caring for people who need support, a targeted review of public profiles can be justified. Use a reviewer who is not making the hiring decision, set criteria in advance and let the candidate explain. Schools and colleges in England are a separate case: Keeping children safe in education 2026 says they should consider an online search engine search of shortlisted candidates, which is not the same as a social media review.
What the ICO and Acas say
The ICO's draft guidance on pre-employment vetting is the main reference. The ICO says it is under review following the Data (Use and Access) Act 2025.
The ICO describes pre-employment vetting as particularly intrusive and says it is not usually a requirement of the recruitment process. You should only do it where you are under a legal obligation or can identify significant and particular risks to the employer, clients, customers or others.
Deciding whether a role justifies a check
The ICO's examples of risks that can justify vetting include employing unsuitable people to work with children or adults at risk of harm, danger to others, theft, and disclosure of trade secrets. The check must be proportionate to the identified risk, and there must be no less intrusive alternative.
Before anyone opens a browser, write the decision down for each role:
- the role and the specific risk the check is meant to address
- why a less intrusive step, such as a reference or an interview question, would not be enough
- which sources will be checked, limited to public profiles
- who will carry out the review, and confirmation that they will not make the hiring decision
- the criteria for deciding what is relevant to the role
- when candidates will be told, and how they can respond to anything found
- the date by which the raw results will be destroyed
Public profiles only
The ICO's guidance is written about candidates' public social media profiles. It says it is unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online, giving the example of specialist software used to check information that is not publicly available.
A public post is still personal data. You need a lawful basis and must tell candidates what you are doing. If you rely on legitimate interests, the ICO says your privacy information must contain more detail.
Separate the researcher from the decision maker
The ICO says the staff who research a candidate's social media profiles should not also make the recruitment decisions about them. In its care home example, one member of staff carries out the checks, screens the information for relevance against the specified interview criteria and passes only the relevant information to the recruitment panel.
Profiles reveal far more than you need. Much of it can be special category data, which the ICO says includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health and sex life. In Great Britain, section 39 of the Equality Act 2010 says an employer must not discriminate in the arrangements it makes for deciding to whom to offer employment.
The ICO says criminal offence data can cover suspicion or allegations of criminal activity as well as convictions. Our adverse media page covers how to handle that.
When you find something
The ICO warns that information found online may not be accurate or properly reflect whether the candidate is suitable, and that it is unlikely to be fair and lawful to make a decision based on that information alone. You should give the candidate an opportunity to provide further information or comment on its accuracy.
Where your findings do not match what the candidate told you, the ICO says you should follow a transparent written process, give the candidate a chance to explain, consider that explanation and keep records of your decisions. You cannot assume the candidate is being untruthful.
Keeping and deleting the results
The ICO says you must securely and permanently destroy vetting information as soon as it is reasonably practicable to do so, naming manual checks of a candidate's public social media profiles as an example. You can keep a record of the outcome and your decision. Build the disposal step into your retention and disposal policy.
FCA-regulated firms and existing staff
FCA guidance in FIT 1.3.21G says a firm generally need not monitor the social media activity in the private lives of staff assessed under FIT. Activity is relevant to fitness and propriety where it indicates a material risk that the person will breach regulatory requirements, for example threats of violence, clear involvement in criminal activities or conduct showing a material risk of harassment. Subject to the rest of FIT 1.3, a person can lawfully express controversial views on social media without calling their fitness into question. Our financial services page sets out the wider FCA position.
Checking the social media of people who already work for you is monitoring, which the ICO covers in separate guidance; see our answer on employee monitoring. If you want a second view on whether a role justifies a social media check at all, ask HRjoy.
What to tell the candidate
- That you will look at their public social media for this role, and at what stage, before you do it.
- Why the check is needed, the information you need, who will see it and how long you will keep it.
- That they will have a chance to comment on or explain anything you plan to rely on.
- That they can ask for a copy of their personal information; the ICO says organisations usually have one month to respond.
- That they can ask you to correct inaccurate personal data about them.
Sources
- Pre-employment vetting of candidates · ICO
- Choosing who to interview · Acas
- What is special category data? · ICO
- What is criminal offence data? · ICO
- A guide to lawful basis · ICO
- Equality Act 2010, section 39 · legislation.gov.uk
- Keeping children safe in education 2026 · GOV.UK (Department for Education)
- FIT 1 General · FCA Handbook
- Employment practices and data protection: monitoring workers · ICO
- Getting copies of your information (SAR) · ICO
- Right to rectification · ICO
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
When it’s justified
Usually justified
- No role by default. Even where a specific risk exists, look only at public information relevant to that risk.
Only if the role justifies it
- Shortlisted candidates at schools and colleges in England. Keeping children safe in education 2026 says they should consider an online search engine search as part of due diligence and tell candidates it may be done. It does not mention social media reviews, and anything found is for exploring at interview.
- Care and support roles where you have documented a specific risk to the people receiving care, as in the ICO's care home example.
- Senior or public-facing roles where you can name a specific harm that public posts could cause and have written down the risk before anyone looks.
- Checking a business networking profile such as LinkedIn against the work history a candidate has given you, which Acas says you can use, provided you do not discriminate.
Rarely or never justified
- Checking every applicant as a matter of routine. The ICO says you should not routinely vet all candidates unless you are legally required to.
- Using specialist software or other means to reach information that is not publicly available, which the ICO says is unlikely to be lawful, appropriate or necessary.
- Looking at some applicants' personal profiles but not others, which Acas warns might break the law.
Questions
Something else? Ask us.
Can an employer look at a candidate's Facebook or Instagram?
Only where the role justifies it. Acas advises against using personal social media to decide who to interview or hire. The ICO says that if you do check public profiles, you must document a specific risk, tell the candidate and keep the researcher away from the hiring decision.
Is checking LinkedIn different?
Acas says you can use information from business and employment networking sites such as LinkedIn, because people use them to show their work experience. You must still use it in a way that does not discriminate. In practice, use it to check the work history the candidate has given you.
If a profile is public, can we use whatever we find?
No. Public posts are still personal data. You need a lawful basis, you must tell candidates, and the ICO says only relevant information should reach the decision makers. The candidate should be able to comment before you rely on anything, and the raw results should be securely destroyed as soon as reasonably practicable, which the ICO says will often mean once recruitment is over.
Can we use software or an outside provider to do the checks?
The ICO says intrusive or targeted checks, such as specialist software reaching information that is not publicly available, are unlikely to be lawful. If you use a provider, ask which sources it searches, who filters out irrelevant material and how candidates can challenge findings.
Should we check the social media of people already working for us?
That is monitoring, not recruitment vetting, and the ICO has separate guidance on monitoring workers. For FCA-regulated firms, FIT 1.3.21G says a firm generally need not monitor the private social media activity of staff assessed under FIT.
Related checks
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
Sector guides
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
Also covered in our guides for Education and Technology.
Related answers
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.