Yes, you can give reference information, but it’s important to ensure that any sharing of personal data in a reference complies with data protection and fairness principles. When giving a reference, you should take the following into account:
1.) Establish a lawful basis for sharing
Before providing a reference, identify a lawful basis for processing the individual’s personal data — typically this will be under legitimate interests. You must be able to demonstrate that sharing the information is necessary and proportionate for the purpose of assessing the individual’s suitability for a role.
2.) Necessity and adequacy
Only share information that is relevant, adequate, and limited to what is necessary for the purpose of the reference. Avoid including excessive or unrelated personal details.
3.) Special category considerations
Do not include special category data (such as information about health, race, religion, or trade union membership) unless there is a clear lawful basis and the individual has explicitly consented. These categories require additional protection.
4.) Consent and imbalance of power
Avoid relying on consent as your legal basis where there is an imbalance of power, such as between an employer and employee. In such cases, consent may not be freely given and therefore may not be valid.
5.) Sector specific requirements
Check whether your sector has any particular rules or codes of practice governing references (for example, in financial services, education, or healthcare). You must comply with any such obligations in addition to general data protection law.
6.) Making references more useful
Keep your reference factual, accurate, and job-related. Provide clear, evidence-based information about the individual’s performance or conduct, and avoid vague or subjective comments that could mislead the recipient.
7.) Avoiding discrimination
Only comment on matters relevant to the individual’s ability to perform the job. Do not include any information that could be seen as discriminatory on the grounds of age, sex, race, disability, religion, or any other protected characteristic.
8.) Disclosure to the individual
References are generally exempt from subject access requests under data protection law. If you do not wish your reference to be shared with the individual, make this clear in the document — for example:
“This reference is provided in confidence and should not be disclosed to the individual to whom it relates.”
