Why Consent Matters When Requesting or Giving Employment References

When it comes to Safer Recruitment, obtaining employment references is a crucial part of the selection process.

However, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, both requesting and providing a reference involves processing personal data, and with that comes legal responsibilities.

In basic terms, employers who are requesting references must ensure they have a lawful basis for processing the personal data of the individual in question. This would in England be the EYFS.

Obtaining the individual’s consent to contact their referees and to receive information about them is also going to be important especially if challenged. For those who are asked to provide a reference, particularly if it was some time ago, ensuring you have consent may be additional to the lawful basis as compliance with the EYFS.

With consent, where it is used it should be clear, specific, and documented.

Ideally if applying for references it will be gathered during the application or onboarding process. It’s not enough to assume implied consent; candidates should know who will be contacted and why.

For employers or individuals providing references, the legal obligation differs slightly as it will be lawful basis of complying with the EYFS.

While consent is a simple and often safest route, reference providers can, in some cases, rely on legitimate interests as their lawful basis. That said, the information shared must still be relevant, accurate, and necessary. It should never include sensitive or special category data, such as health-related issues or details of disciplinary action, unless explicit consent has been obtained from the individual.

Data protection law encourages transparency and fairness. A good rule of thumb is: if you wouldn’t feel comfortable disclosing the information directly to the individual concerned, it probably shouldn’t be in a reference. Additionally, retaining a copy of the reference and a note of the consent provided is considered good practice.

In the early years and childcare sector, where safeguarding is paramount and references are a regulatory requirement under the EYFS framework, the need to manage data correctly is especially important. Candidates should be informed as early as possible that references will be taken up, and reference providers should feel confident that their responses are being requested and used lawfully.

By embedding consent into your recruitment process and handling references with care, you not only protect your organisation from legal risk, you also show respect for the privacy and dignity of every candidate.

If we can assist with any aspect of HR Admin or Employment Referencing please call us on 01527 306095 and ask about Vryfi.