What it asks for. Processing of personal data relating to criminal convictions and offences or related security measures, based on Article 6(1), may only be carried out under the control of official authority or when authorised by Union or member state law providing appropriate safeguards. Any comprehensive register of criminal convictions may be kept only under official authority.
In practice. Organisations identify where they process such data, for example background checks, fraud investigations or security incident records naming suspects, and confirm the specific national law that authorises it. Access is restricted and retention kept short. Evidence includes the legal basis analysis by country, procedures for background screening and access and retention controls.
Common gaps. Background screening is often run uniformly across countries without checking national authorisation. Investigation records may hold such data longer than necessary.