Recruit
France sets a clear statutory boundary on recruitment: an employer may only seek information that has a direct and necessary link to the job or to assessing the candidate’s ability to do it. That single rule shapes everything else.
Criminal record checks
Only the individual can obtain bulletin number three of their casier judiciaire, which shows the most serious convictions. Employers cannot access the record themselves. Requesting the bulletin is lawful only where the role justifies it or a specific regulation requires it, which covers private security, financial services, transport, healthcare, and work with minors. Some regulated activities have their own mandatory vetting routes rather than relying on the bulletin.
What employers can check
Identity, right to work, employment history, and qualifications are all legitimate. Candidates must be told in advance about the methods used to assess them, and any technique must be relevant to the purpose. Information obtained must be kept confidential and cannot be gathered without the candidate’s knowledge.
Data protection
The GDPR applies alongside French law, supervised by the CNIL, which has published detailed guidance on recruitment. Conviction data attracts heightened protection and cannot generally be retained. The CNIL expects unsuccessful candidates’ data to be deleted within a defined period unless the candidate agrees to it being kept for future opportunities.
Checks to avoid
Health information, family circumstances, trade union membership, political and religious views, and origin are all off limits. Health assessment happens through occupational medicine, which reports fitness for the role rather than medical detail.
Practical guidance
Document the direct and necessary link for each check, inform candidates about your methods, and delete promptly. An employer of record can manage this if you have no French entity.
