References and data protection

Providing information about an employee in a reference counts as “processing personal data” under the GDPR. Therefore, employers need to make sure that they have a lawful basis for processing such data.

It is useful to include a clear policy on the giving of references in staff handbooks, setting out how such requests will be handled, including the circumstances in which references are given and the sort of content that will be offered.

Unless there is a regulatory requirement to provide a reference within the industry concerned, such as is the case within the financial services sector, for example, employers should not provide references unless the employee or ex-employee has given consent.

In all cases, therefore, employers should have clear evidence of a lawful basis for responding to a reference request especially since an employment relationship may have come to an end at the time of processing. Evidence of consent given by the employee previously, for example during an exit interview, could be relied upon.

If there is any doubt, it is best to get the employee’s explicit consent.