What background and reference checks can a Malaysian employer legally run before hiring?

Not sure your current process would hold up? WhatsApp Steph and we will walk through what to check for your next hire.

Hiring in Malaysia comes down to a trade-off employers rarely think through in advance: check too little, and a false qualification or an unverified reference becomes your problem the day something goes wrong; check the wrong way, and you are the one exposed under the Personal Data Protection Act 2010. Both failure modes are avoidable, and both have already played out in real Malaysian cases — alongside the wider Employment Act obligations every employer already carries.

A Malaysian employer can legally run a background check covering a candidate's identity, employment history, qualifications and licensing, criminal record, credit standing, social media conduct, medical fitness and references before hiring, provided each specific check is genuinely relevant to the role being filled.

There is no statute that forces you to run any of them, and nothing stops you either, as long as you handle the candidate's data properly. The table below sets out the standard pre-employment screening set per AJobThing, with professional licensing and medical clearance added to complete it for regulated and site-based roles.

Two of these deserve a note of caution. Credit and social media checks are the easiest to over-reach on: run a credit check on a warehouse picker and you have collected data you cannot justify, and a social media review that strays into a candidate's religion, race or political views turns a legitimate check into a discrimination risk. A medical or health-clearance check belongs on this list only where the role itself has a genuine physical requirement (site-based logistics and manufacturing roles are the common case) — keep every check tied to a real requirement of the job.

How do you actually run a good reference check?

The shortest route to a reference check worth trusting is calling the referee directly rather than emailing, confirming you are speaking to the person the candidate actually named, and asking every candidate for the role the same standardised set of questions.

1. Call, don't just email. A phone conversation surfaces hesitation and tone a written reference letter never will.
2. Confirm you have the right person. Check you are speaking to the referee the candidate actually named, not a friend standing in for them.
3. Ask the same questions every time. Dates and title, strengths, one honest development area, and whether the referee would rehire the person — asked identically across every candidate for the role.
4. Note evasiveness as a signal. A referee who goes vague on dates or dodges direct questions is itself worth flagging, not just what they do answer.

Yes — the Personal Data Protection Act 2010 requires two separate things before you screen a candidate: their consent, under the Act's General Principle (section 6), and written notice of what is being collected, why, and who it may be shared with, under its separate Notice and Choice Principle (section 7).

Skip either step and the check is unlawful, whatever it turns up — and this is the step Malaysian employers skip most often, usually by assuming a verbal heads-up in an interview covers both duties. It does not. The Personal Data Protection Act 2010 (Act 709) treats a candidate's identity, employment and academic details as personal data, and per Malaysian law firm Sabrina Hashim & Co, consent and notice are two of the Act's seven numbered principles — distinct obligations that both have to be met, not one substituting for the other.

The cost of getting this wrong is not theoretical. According to Edwin Lee & Partners, processing a person's data without consent carries a fine of up to RM500,000 and/or imprisonment of up to three years, while general non-compliance with the Act's data protection principles — the wider category a sloppy background-check process can fall into — now carries a fine of up to RM1,000,000.

In practice, a compliant consent step is short: tell the candidate which checks you plan to run, why, and how long you will keep the results, then get their written agreement before you start. Verbal agreement in an interview is not enough on its own — keep the paper trail, the same way you would for any other Employment Act obligation.

Skipping verification does not just risk a bad hire — it can weaken your legal position when you later dismiss that hire over the lie: Malaysian Industrial Court rulings have gone both ways, upholding some dismissals over a false qualification while cutting one employer's compensation because it never checked the credential first.

In Azman Idrus v SGA Services (M) Sdn Bhd [2015] 2 MELR 722 — reported by both Malaysian employment law firm Donovan & Ho and legal-explainer site AskLegal.my — an employee had misrepresented having a legal qualification. The Industrial Court upheld the dismissal, noting that “the portfolio of a Legal Advisor would by implication require the employee to have a legal qualification.” Similarly, per Donovan & Ho's account of Royal Sungei Ujong Club v Vijaysankar Arumugam [2009] 3 MELR 65, a dismissal for falsely claiming an MBA was also upheld.

But the more instructive case for employers, per Donovan & Ho's account, is the one that went the other way. In Anthony Dass S Rajagopal v Strategic Research & Consultancy Sdn Bhd [2012] 2 MELR 47, an employee had claimed an unrecognised PhD. The Industrial Court still found the dismissal procedurally unfair and reduced the compensation payable — on the basis that the employer should have verified the credential before making the hire, not after. As Donovan & Ho puts it, pretending to have qualifications you do not have “is a fast way to dismissal” for the employee — but the Anthony Dass ruling is the reminder that the employer's own failure to check can blunt that protection. If a credential problem does surface once someone is already on the payroll, how you handle it during probation or termination matters just as much as catching it would have upfront.

The lesson is not that you can always dismiss your way out of a bad hire. It is that verifying a credential before you hire is cheaper, in money and in Industrial Court time, than discovering the gap after the fact and hoping a dismissal holds up.

Not automatically — Malaysian law does not impose a blanket ban on hiring someone with a criminal record, and disqualifying every candidate with any conviction, without weighing how relevant it is to the role, risks looking discriminatory rather than diligent under Malaysian employment practice.

The check that matters is relevance: a fraud conviction is a legitimate concern for a role handling cash or client funds, while an old, unrelated offence with no repeat pattern is a much weaker basis to reject someone outright.

The same relevance test should guide everything else you screen for. Steer clear of questions or checks built around a candidate's religion, gender identity, marital status, race or political views — none of these predict job performance, and asking about them turns a defensible screening process into a discrimination exposure you did not need to create.

Budget a day or two for quick checks like identity verification and a reference call, and up to a week or longer for the slower ones — academic, licence and criminal record checks — once a screening provider or the relevant institution is involved.

Run the checks before you extend a firm offer, not after — build screening into your hiring timeline from the shortlist stage rather than the final week. A background check that surfaces a problem once someone has already resigned from their previous job, or worse, already started with you, leaves you with a far worse set of options than a short delay at the offer stage.

Sources: Personal Data Protection Act 2010 (Act 709) penalties for processing without consent (up to RM500,000 and/or 3 years' imprisonment) and general non-compliance (up to RM1,000,000), per Edwin Lee & Partners; the Act's section 6 General Principle (consent) and section 7 Notice and Choice Principle (written disclosure) per Sabrina Hashim & Co; the standard check types, absence of a legal mandate to run them, and discriminatory-question guidance per AJobThing; the Board of Engineers Malaysia's registration role per Wikipedia; Industrial Court cases on resume misrepresentation (Azman Idrus v SGA Services (M) Sdn Bhd [2015] 2 MELR 722; Royal Sungei Ujong Club v Vijaysankar Arumugam [2009] 3 MELR 65; Anthony Dass S Rajagopal v Strategic Research & Consultancy Sdn Bhd [2012] 2 MELR 47), per the accounts given by Donovan & Ho and, for the Azman Idrus case, also AskLegal.my; criminal-record hiring guidance per Verity Intelligence. Verified 2 July 2026; always confirm current requirements against the official PDPA text and JTKSM guidance, as rules may be updated. This article is general information, not legal advice.