You may check a candidate's references, qualifications and identity before you hire, but under the Nigeria Data Protection Act 2023 (NDPA) you should only collect what you need for that purpose, tell the candidate what you are doing and why, and keep the results no longer than you need them. The safest working rule for a small employer: ask the candidate first, check only what bears on the job, and write down what you found and what you decided.
The NDPA's wording and the regulator's guidance on employment screening are the parts we cannot settle for you. Where this guide says "principle", the point is the general direction of the law, and the Nigeria Data Protection Commission (NDPC) or a lawyer is the place to confirm a specific case.
Which checks are normal, and which are worth the cost
Not every role needs every check. Match the check to the risk the role carries.
| Check | Worth doing when | What to watch |
|---|---|---|
| Previous employer reference | Almost every hire above entry level | Ask about dates, role and conduct. Many employers will confirm only dates and job title. |
| Identity (NIN, valid ID) | Every hire, you need it for payroll anyway | Collect a copy once, store it securely, do not circulate it on WhatsApp. |
| Academic or professional certificate | The job requires the qualification (accountant, nurse, engineer) | Verify with the issuing institution or professional body, with the candidate's knowledge. |
| Guarantor | Staff who handle cash, stock, keys or customer property | A guarantor is a person who vouches for the candidate, not a substitute for a reference. |
| Address visit or verification | Roles with access to client homes or high-value goods | The most intrusive check. Use sparingly and say so in advance. |
| Police or criminal record | Security, finance and roles working with children | Treat as sensitive. Get legal advice on how to request and use it. |
A cashier in a supermarket in Ikeja and a graphic designer working from home do not need the same file. If you cannot say what a check protects you from, skip it.
Do you need the candidate's consent?
As a matter of good practice, yes, get it in writing and before you contact anyone. As a matter of law, the NDPA lets you process personal data on more than one lawful basis (consent is one; steps taken before entering a contract and a legitimate interest are others), and which one fits depends on the check. The reliable position is the same either way: tell the candidate what you will check, with whom, and for what purpose, and get a signed acknowledgement.
There is a second reason for asking. A previous employer is more likely to answer if they can see the candidate agreed. A short paragraph on your application form or offer pack does the job:
I, [full name], agree that [Company name] may contact the referees and previous employers I have listed, and may verify my identity and the qualifications I have stated, for the sole purpose of deciding whether to employ me. I understand that information collected will be kept securely, seen only by those who need it for this decision, and deleted or kept as set out in the company's privacy notice. Signed: ____ Date: ____
If you check things beyond that paragraph (a social media search, a visit to the candidate's address), say so in it. Do not rely on a blanket "we may verify anything" line.
What to ask a previous employer
Keep the call or email short and the same for every candidate. A consistent set of questions protects you if a rejected candidate later claims you treated them differently.
- Did this person work for you, and between which dates, in what role?
- Why did they leave?
- How was their attendance, honesty and conduct with money or stock?
- Would you re-employ them?
Do not ask about health, pregnancy, marital status, religion or ethnic origin, and do not accept those details if the referee offers them. They have no place in a hiring decision, and under the NDPA several of them are sensitive categories needing extra care. If a referee volunteers a damaging opinion, ask for the facts behind it (a date, a document, an outcome) and weigh it accordingly. One bitter referee is not a finding.
Guarantor forms
A guarantor form is a common Nigerian practice rather than a legal requirement. Keep it to what you need:
- The guarantor's name, address, phone number and occupation.
- Their relationship to the candidate and how long they have known them.
- What they are promising. Be careful here. Whether a guarantor can be made to pay for an employee's loss depends on the wording and on a court's view of it, so do not tell staff the guarantor "will pay" unless a lawyer has drafted it.
- A copy of the guarantor's ID, collected with their knowledge, and kept in the same secure file as the rest.
The guarantor is also a person whose data you now hold. Treat their details with the same care.
What do you do with a red flag?
Take the decision in steps rather than reacting to the first alarming detail.
- Check you have the right person and the right record. Common Nigerian names produce mix-ups.
- Put it to the candidate. A gap in dates, a different job title or a certificate that will not verify may have a plain explanation. Ask, and note the answer.
- Decide whether it matters for this job. A dispute with a former landlord is irrelevant to a copywriter. A finding of cash theft matters for a cashier.
- Record the decision and the reason, using only facts, not rumour.
- Tell the candidate if you withdraw an offer because of a check, so they can correct a mistake.
How long to keep the results
Neither this guide nor our sources give a fixed number of years as the legal retention period for recruitment records, so we will not invent one. The principle in the NDPA is storage limitation: keep personal data no longer than the purpose needs. In practice:
- For people you hire, move the useful items (ID copy, confirmed qualifications, signed consent, guarantor form) into the personnel file and keep them under the same rules as other employee data. See employee data protection and payroll.
- For people you do not hire, delete their application and check results after a short, stated period, and put that period in your privacy notice.
- Keep the files in a locked cabinet or a password-protected folder with a named owner, not in a shared chat group.
Ask the NDPC or a data protection lawyer about any specific retention period before you publish one.
Special cases
Corps members. A graduate on NYSC posting arrives through a placement process and comes through the scheme's own posting process. What you should still check, and how corps members differ from other hires, is covered in the NYSC corps member guide.
Remote hires. Verification is harder when you never meet the person. Video interview, ID shown on camera, and a verified bank account in the person's own name are reasonable minimums. See the remote and hybrid work policy for the wider arrangements.
Probation. Checks do not replace a probation period. If something cannot be verified before the start date, say in the offer how it will be completed and when, then review it at confirmation (probation rules and confirmation).
For the front end of recruitment, job adverts and interview questions, read hiring your first employees, and put the completed checks into the new hire onboarding checklist.
