Why Validato AG Protects HR Departments from Liability Risks in the Hiring Process

With GDPR- and nDSG-compliant processing, a documented audit trail, and alignment with the LkSG, Section 26 of the BDSG, and the GwG, Validato supports HR departments in Germany, Austria, and Switzerland in conducting legally compliant applicant screening._

Due Diligence as an Underestimated Liability Risk

If an HR department hires a person who has provided false information about their qualifications or concealed a relevant risk, the company can be held liable--for example, under the due diligence obligations of the Supply Chain Due Diligence Act (LkSG) or industry-specific regulations such as the Money Laundering Act (GwG). At the same time, the verification of applicant data itself is subject to strict requirements: the General Data Protection Regulation (GDPR) in the EU and the revised Swiss Data Protection Act (nDSG) set narrow limits on what data may be processed, for how long, and for what purpose. HR departments thus find themselves caught between a rock and a hard place: they must verify, but are not permitted to scrutinize.

Validato AG as a Certified Verification Body

Validato AG has tailored its screening process to address this tension. Applicant data is processed in compliance with the GDPR and nDSG, on infrastructure hosted within the EU, and in accordance with the principle of data minimization: only the data required for the selected screening module is processed. Every step of the screening process is documented so that HR departments can demonstrate--in the event of a dispute, such as a challenge to a termination or an inquiry from authorities--that the hiring decision was based on a thorough and lawful review. This documentation shifts the burden of proof: instead of having to reconstruct what was reviewed after the fact, an audit trail is available.

"HR departments today have a duty of care for which many companies still lack a structured process," says Reto Marti, Managing Partner of Validato AG. "Our goal is to fulfill this duty of care in such a way that it can be substantiated in the event of a serious incident--not just perceived, but documented." This statement highlights Validato AG's role as an entity that operationalizes regulatory requirements rather than leaving them to individual HR departments to interpret on their own._

The regulatory environment is becoming more complex, not simpler

The regulatory framework within which HR departments operate is constantly expanding: NIS2 and DORA extend due diligence obligations in regulated industries; the KRITIS umbrella law applies to operators of critical infrastructure; and Section 26 of the German Federal Data Protection Act (BDSG) specifically governs the processing of employee data in Germany. Furthermore, the Security Clearance Act (SueG) remains the governing law for security clearances in contexts closely related to government agencies--Validato AG explicitly positions itself here as a complementary, not a substitute, service to official security clearance procedures. For HR departments without their own legal department, it is becoming increasingly difficult to take all these requirements into account individually during the hiring process.

Legal Certainty as Part of HR Strategy

By translating these regulatory requirements into a structured, documented screening process, Validato AG shifts the role of the HR department: from someone who, in cases of doubt, must make legal assessments on their own, to an entity that can rely on a documented, traceable process. For HR departments in the DACH region--which are increasingly being evaluated against regulatory standards--this is a key component for making hiring decisions that are not only swift but also legally sound.

Validato AG
Claridenstrasse 34
8002 Zuerich
Schweiz

https://validato.com/de-de

Herr Reto Marti
+41 44 515 77 77

reto.marti@validato.com

Validato AG, headquartered in Zurich, develops and operates a configurable background screening and human risk management platform focused on the DACH market. With over 18 modules, Validato covers the entire lifecycle--from pre-employment screening to in-employment and re-screening, as well as third-party screening, supplier vetting, and due diligence. The platform operates on a pay-per-use model, is fully compliant with the GDPR and nDSG, and is aligned with the NIS2, DORA, KRITIS Framework Act, DIN SPEC 14027:2026-04, BSI C5:2026, the AI Act, the LkSG, and ISO 27001.

This release was published on openPR.