Recruitment agency reference checking compliance — GDPR, audit trails, consent and liability

Recruitment agency reference checking compliance — the full picture

GDPR and candidate consent — the most overlooked compliance gap

GDPR requires a lawful basis for processing personal data about a third party. When an agency contacts a referee about a candidate, it is processing the referee's personal data — and doing so on the basis of the candidate's consent and legitimate interest. Best practice and the ICO's guidance on employment references require agencies to inform candidates that references will be sought, obtain their consent, and document that consent before approaching any referee. Most agencies do not do this systematically — they obtain verbal consent in passing or assume consent from the act of applying. RefAssure makes documented, written, timestamped consent automatic on every reference, satisfying GDPR documentation requirements without additional administration.

The consequences of inadequate GDPR compliance in reference checking are primarily reputational and regulatory rather than immediately financial — but an ICO complaint from a candidate who did not consent to their referee being contacted, or a client who discovers their agency's reference process is not GDPR-compliant, can damage client relationships and agency reputation significantly. RefAssure eliminates this risk by making consent documentation automatic and irreversible.

Agency liability and reference checking documentation

An agency that places a candidate without completing adequate pre-employment checks — including employment references — faces potential liability if the placed candidate causes harm in their role. In regulated sectors, this liability is more acute — an agency that places a care worker without CQC-compliant references may face regulatory and civil liability if the worker causes harm to a service user. Documented evidence of a proper reference process — written references obtained, consent documented, audit trail retained — is the agency's primary protection against this liability. RefAssure generates this documentation automatically for every reference, ensuring the agency has evidence of a proper process regardless of which consultant managed the placement.