Do you need consent to check references under UK GDPR?
Consent is not always your lawful basis, but asking the candidate first is still the fair, transparent way to run reference checks.
Do you need a reference consent form?
Under UK GDPR you need a lawful basis to collect references, and consent is one of several. Many employers and agencies rely on legitimate interests instead. A reference consent form is still good practice: it tells the candidate who you will contact and why, confirms they agree, and gives you a dated record. RefAssure collects signed online consent before any referee is contacted.
References and GDPR: what actually applies
A reference involves personal data about two people: the candidate, and the referee who writes it. UK GDPR and the Data Protection Act 2018 apply to both. The Information Commissioner's Office (ICO) publishes guidance for employers, and it is the place to check if you are unsure.
Lawful basis is not the same as asking permission
Every use of personal data needs a lawful basis. Consent under UK GDPR has to be freely given and can be withdrawn at any time, which is hard to rely on when someone wants a job from you. For that reason many organisations use legitimate interests as the lawful basis for reference checks, sometimes alongside legal obligations in regulated sectors. Decide your basis, write it down and put it in your privacy notice.
Why you still ask the candidate first
Whatever the lawful basis, you must be transparent. Asking the candidate to confirm their referees, and to agree that you may contact them, covers that neatly. It also avoids the awkward call where a current employer learns of a job search before the candidate was ready. In some cases agreement is part of the rule itself: the Conduct Regulations 2003 expect referees for roles with vulnerable people to agree that their reference can be passed to the hirer.
Can candidates see their references?
The Data Protection Act 2018 includes an exemption from subject access for references given in confidence for employment purposes. It applies to references you give and receive, but it is not automatic: the content must genuinely be confidential, and factual details such as dates are usually known to the candidate anyway. Treat every reference as something that could one day be read.
How long to keep references
UK GDPR says not to keep personal data for longer than you need it. Agencies must keep records for at least a year under the Conduct Regulations, and regulated sectors often expect references to stay on the personnel file for the length of employment. Set a retention period, write it down, and delete on schedule.
What a reference consent form should include.
Keep it short and specific to this application, not buried in your registration terms.
Who is checking
Your organisation's name and, for agencies, that references may be shared with the client.
Who you will contact
The named referees, their roles and contact details, confirmed by the candidate.
What you will ask
Dates, role and conduct questions, in plain words, so nothing is a surprise.
How data is handled
A link to your privacy notice, where it is stored and how long you keep it.
A signature and date
A clear record of agreement for this application, made before any contact.
Timing
Whether the candidate is happy for a current employer to be contacted now or after an offer.
Consent first, then the referees.
RefAssure emails the candidate a consent request. Referees are contacted after the candidate signs, and the signed record goes into the PDF.
- Signed online consent, on any device
- Consent email bounces are flagged so you can correct the address
- Referees sign their reference through a unique secure link
- Timestamps for consent, requests, reminders and completion
A fair reference process in four steps.
Tell them early
Say in the job advert or registration that you check references, and link your privacy notice.
Ask for agreement
Send a short consent request naming the referees before you contact anyone.
Ask relevant questions
Collect what you need for the role and nothing more. Avoid health questions in a reference.
Keep it tidy
File the reference with its consent record and delete it when your retention period ends.
GDPR and reference questions
More in the full FAQs.
Do I need consent to give a reference under GDPR?
Not necessarily. Many employers give references on the basis of legitimate interests, and the employee usually asked for it by naming you. Be accurate and fair, and stick to what you can stand behind.
Is a reference request a GDPR breach without a consent form?
Not automatically, if you have a lawful basis and have told the candidate. Contacting referees the candidate did not know about, or using details for other purposes, is where problems start. A signed consent record removes the doubt.
Can a candidate make a subject access request for their reference?
They can ask, but confidential employment references are exempt from subject access under the Data Protection Act 2018. The exemption needs the reference to be genuinely confidential, and the ICO guidance explains how to weigh it.
What should a reference request email say?
Who you are, who the candidate is, what you are asking and how the answers will be used. See our reference request email guide for wording.
Does the consent form replace a privacy notice?
No. The consent request covers this application. Your privacy notice explains your lawful basis, retention and rights in full, and the consent request should link to it.
Where is RefAssure data stored?
RefAssure hosts data in the UK. Team members are unlimited, so you can control access through your own processes rather than shared logins. See how it works.
Related guides
Consent captured before every check.
Your first reference is free. Signed consent, chasing and a PDF audit trail included.