Digital certificate of conduct makes hiring faster

Since 1 October 2026, applicants have been able to access the digital certificate of conduct as a PDF in their personal BundID account, as explained by the Bundesregierung (the Federal Government) in its information on the new rules for October 2026. According to the Bundesamt für Justiz (the Federal Office of Justice), it is generally available within a few hours and has the same legal validity and evidential value as the certificate of conduct printed on green paper. Employers should define how they will receive the original file, verify the electronic seal or QR code and then protect the data it contains.

Who can use the digital certificate of conduct?

The digital version is available for standard and extended certificates of conduct for private purposes. Where the statutory requirements are met, a European certificate of conduct can also be issued digitally.

Certificates of conduct sent directly to a public authority are excluded. For employers, the digital version is therefore primarily relevant when applicants request the document themselves and then submit it during the recruitment process.

According to the Bundesamt für Justiz information on certificates of conduct, the following are required for an online application:

• an identity card with the online identification function activated, an electronic residence permit or an eID card,
• an NFC enabled smartphone to read the identity document,
• a personal BundID account,
• a credit card for the online payment option currently available.

According to the Bundesamt für Justiz, the fee remains 13 euros. Anyone without a credit card or suitable electronic identification cannot currently complete the digital application process.

Under the standard procedure, the PDF should be available within a few hours. For a European certificate of conduct, however, information from the register in the other country may take up to 20 working days, according to the Bundesamt für Justiz. HR managers should take this difference into account when planning a start date.

How should employers check the digital certificate of conduct?

Employers should ask for the original PDF file and not accept only a printout or screenshot. Authenticity can be checked using the file’s qualified electronic seal or the QR code printed on the document.

A qualified electronic seal is technical proof of origin for electronic documents. It shows which body issued the file and whether it has been altered since issue. The legal basis for electronic issuance is set out in Section 30d of the Bundeszentralregistergesetz (Federal Central Criminal Register Act).

A fixed sequence of checks is advisable for internal procedures:

1. The HR department requests the complete PDF file.
2. A designated person opens the file in a programme that can display and verify electronic seals.
3. Alternatively, or as an additional measure, the QR code is checked.
4. The date of issue, name and details required for the role are compared with the other information provided.
5. The check is documented with the date and the name of the person who carried it out.

A forwarded file may be technically unchanged. Nevertheless, the name on the certificate of conduct should be compared with the application documents and suitable proof of identity. A screenshot alone does not allow the electronic seal to be checked reliably.

The date of issue requires an internal policy

There is no statutory period of validity for certificates of conduct. The employer decides how recent the document must be for the particular role, although it is customary to require a document issued no more than three months earlier.

This requirement should be stated in the job description, or no later than when the document is requested. Clear wording would be: “Please submit a certificate of conduct that is no more than three months old on the date of submission.” This avoids applicants having to request a second document at their own expense.

The policy should reflect the work involved. A role involving contact with children, young people or particularly vulnerable people may require different evidence from a purely office based role. Before recruitment begins, the company should obtain legal clarification as to whether it may or must request a standard or extended certificate of conduct.

Timing is also important. If the document is requested too early, the company processes sensitive data belonging to people who may already have been eliminated for other reasons. If it is requested only shortly before the contract starts, a European certificate of conduct in particular could delay the start date by up to 20 working days.

How should the PDF be processed in compliance with data protection law?

Access to the digital certificate of conduct should be restricted to employees who genuinely need to check it for the recruitment decision. There should therefore be a documented procedure covering receipt, review, documentation and deletion.

A certificate of conduct may contain particularly sensitive information. Before requesting one, the company must therefore establish the legal basis on which it requires the document and which information is necessary for its decision. Relevant legislation includes the Datenschutz Grundverordnung (General Data Protection Regulation) and the employee data protection provisions of the Bundesdatenschutzgesetz (Federal Data Protection Act).

As a minimum, companies should define the following points:

• Method of submission: Wherever possible, use a secure upload facility or protected recruitment portal instead of a general shared inbox.
• Access rights: Limit access to a small number of named individuals in HR or management.
• Documentation: Check whether a record of the review date, date of issue and outcome is sufficient, rather than storing the entire PDF permanently.
• Retention: Set a justified retention period. The document should not simply be kept indefinitely in the personnel file.
• Deletion: Delete files that are no longer needed from download folders, email inboxes and temporary storage as well.

The appropriate retention period depends on the purpose, the role and any applicable statutory requirements. Companies should therefore agree it with their data protection officer or legal adviser and document it in their deletion policy.

A clear process prevents additional manual work

Time is saved only if the PDF does not become stuck between the email inbox, personnel folder and management. A simple digital process should link responsibilities, checks, approval and deletion.

Start with a single standard case, such as recruiting a care worker. Map every step from receipt of the PDF through to documented approval. This will show where information is entered twice or files are forwarded unnecessarily.

When digitalising processes and replacing paper and Excel, this procedure can be integrated with the rest of the recruitment process. If existing HR programmes do not provide suitable options for checking or documentation, custom software for the company’s own processes may be appropriate.

ibx company advises small and medium sized businesses in Hannover and the surrounding region on planning and implementing digital processes. The aim is not to introduce a new tool at any cost, but to create a transparent process that complies with data protection law.

If you would like to prepare your business for handling digital certificates of conduct, we can review your existing recruitment process together in a no obligation initial consultation.