Yes, the entire process complies with GDPR regulations. The individual for whom the check is required must consent to the check being conducted. Without this consent, the check cannot be undertaken.