by Kate Russell


If you are recruiting, always take up references. They’re a useful way of checking information given in an applicant’s CV or application form and can give you advance warning of potential problems. For these reasons, it is always worth taking up references:

Example of a reference request.

Your offer letter should stipulate that the offer is conditional upon the receipt of references that are satisfactory to the company.

Example of an offer letter.

Giving references

With a few exceptions in regulated industries such as financial services, there is no legal duty for an employer to provide a reference. If it is your normal practice to do so, however, you should provide a reference. Stick to the facts and don’t be tempted into giving opinions that cannot be substantiated. If all else fails, you can confirm basic factual details:

  • Start and end dates
  • Capacity in which employed
  • Number of days of sickness absence – however this is sensitive data so see comments about personal data restrictions
  • Whether there were any disciplinary warnings live on the file at the time of termination
  • Whether the employee resigned or was dismissed.

It’s always a good idea to add a disclaimer, for example:

‘The facts provided in this reference are accurate and true to the best of my knowledge and are based upon information available to me at the time of completion. The company accepts no responsibility for any damage or loss incurred as a result of acting upon this reference.’

If you do not want the contents to be disclosed, you should expressly state that the reference is confidential and not to be disclosed to the subject without your written permission.

Make sure that you make your offer conditional upon the receipt of references which are satisfactory to the company. A conditional job offer can be withdrawn if the applicant doesn’t meet the employer’s condition for example, satisfactory references. If an unconditional offer is made this cannot be withdrawn and if accepted a contract is formed.

Once you have received satisfactory references and informed the job applicant an unconditional job offer can be made.

In 2018 ACAS brought out its latest guidance on references. ACAS Guidance on references

Data Protection Act – implications for references

Providing a reference about an employee to a prospective employer, will generally involve the disclosure and therefore the processing of personal data so in asking for or responding to a request there has to be a lawful basis for it.

You should be consistent in your approach or else the possibility of discrimination or victimisation claims may arise.

When responding to a reference request, you will need to consider and document the lawful basis for processing the personal data of the employee.

In most cases in employment relationships consent given by employees will not be valid because of the imbalance in the power relationship. However the situation is probably different in the case of references where it is the employee who wishes the reference to be given and they are not in any way under pressure from the current employer such as might invalidate any consent given.

When an employee leaves the organisation, you should keep a record on file of whether or not the employee wishes the employer to provide references on him or her. For example, you could ask the employee this question at an exit interview, or it could be included on an exit questionnaire.

The prospective employer will often enclose a photocopy of the individual’s signed consent to its seeking the reference in the reference request. This will normally be sufficient for you to process the personal data.

If you have any doubts about whether or not the individual has given consent, you should contact him or her to check that he or she wishes the reference to be provided. Obtain the consent in writing if possible, or should at least make a note of the individual’s verbal consent.

A current employer could put the onus on the prospective employer and make sure that it documents and produces the employee’s consent to the current employer providing a reference.

Keep a copy of the evidence of consent in order to be able to demonstrate the lawful basis for processing. Any consent form used should document precisely what the data subject has consented to their former employee disclosing. In addition to this, if the prospective employer is located outside the EEA the data subject will have to consent to their data being transferred in that way.

Special categories of Information

Prospective employers may want to know about an employee’s sickness or reasons for periods of absence. Under the GDPR health data falls under a special category of data and requires different grounds for processing but this does not apply where there has been ‘explicit, unambiguous consent’ from the data subject. This is an even higher bar than standard consent. Any reference requests relating to an employee’s health should be treated with extreme caution and that very specific consent is in place before any such disclosure is made.

Disclosure of references

Under the 1998 Data Protection Act (DPA) employees had rights of subject access to personal information held by their current or former employer and this could, in principle, include references given by current or former employers. However, there was an exemption whereby an employer who provided a confidential reference was permitted to decline to disclose this to the employee. This protection was undermined by the fact that the employees could then apply to the recipient employer for a copy of that reference which was not able to rely upon the same exemption.

Under the GDPR and DPA 2018, employees still have the right to make subject access requests. However, the loophole in the previous legislation has been closed and personal data held by either the giver or the recipient of a reference may be withheld where it consists of a reference given or to be given in confidence for the purposes of the:

  • Education, training or employment, or prospective education, training or employment, of the data subject.
  • Placement, or prospective placement, of the data subject as a volunteer.
  • Appointment, or prospective appointment, of the data subject to any office.
  • Provision, or prospective provision, by the data subject of any service.

Increased rights of employees

Even though access to a confidential reference may have been made more difficult, an employee who is unhappy with the content of a reference it suspects is being given by a current or former employer may be able to rely upon exercising their enhanced data subject rights including the right to restrict processing, erasure, object and rectification.

The GDPR requires that any consent given to processing must be as easy to withdraw as it was to provide so employers will need to be alive to notification of withdrawal of consent and alter their practice accordingly in respect of any particular employee. Employees retain the right to complain to the Information Commissioner if they think their rights under the legislation have been infringed and they also now have enhanced rights to seek compensation from the employer giving a reference if they suffer material or non-material damage as a result of infringement of their data protection rights.

As a result of these developments and the additional risks arising you may wish to adopt a policy of providing purely factual references or at least strict restrictions on the nature of the information which may be disclosed.