References and What You May Say
Giving a reference is processing personal data about somebody who will probably never see it, which is exactly why the constraints exist.
REFERENCE RECORD
Kept for every reference given
- Requested byOrganisation and personVerify it is genuine before responding
- AboutFormer employee, and dates confirmedFactual content first
- What was saidA copy of what was sentThe reason to use a standard form
- Who gave itNamed, with authority to do soIndividual managers giving personal references is the risk
- ContentFactual, accurate, and fairThe three tests that apply
- OpinionsDefensible and capable of substantiationAn unsupported opinion is the exposure
- OmissionsWhat was deliberately left outMisleading by omission is still misleading
- Copy to subjectOn request, usuallyExemptions differ for giver and recipient
A reference is written about somebody, sent to a third party, and usually never seen by the subject. Each of those facts is a reason for care.
The practical lesson in “References and What You May Say” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching gdpr employee monitoring, this practical implementation page can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
The three tests
A reference should be factual where it states facts, accurate, and fair — meaning it does not give a misleading impression overall.
For a separate benchmark relevant to “References and What You May Say”, consult the ICO employment-practices guidance. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
The third does most of the work. A reference containing only true statements can still be misleading if it omits something material or emphasises selectively, and the duty is about the impression created.
Why standard forms are safer
Dates of employment, job title, reason for leaving if asked.
A standard form limits what is said, ensures consistency between references, and removes the individual manager's judgement from a document that may be litigated.
Organisations that give substantive references should do so through a single route with a template, not by letting managers write what they like.
The personal reference problem
A manager writing on their own behalf about a former colleague.
They frequently use the work relationship as the basis, which makes it look organisational, and they are outside whatever controls the organisation applies. If it goes wrong, the distinction between personal and organisational will not be as clear as the manager assumed.
A policy saying references come from one route, and personal recommendations must not reference the employment relationship in a way that implies the organisation's view, is worth having.
Can the subject see it?
Different answers for the two organisations.
The giver may have an exemption for confidential references in some regimes. The recipient frequently does not, which means the person can obtain from the new employer what the old one would have withheld.
Which has a practical consequence: write every reference on the assumption the subject will read it, because the route exists.
Refusing to give one
Generally permitted, and it must be applied consistently.
An employer that gives references to everybody except one person has communicated something about that person, and the inconsistency is the exposure rather than the refusal.
Keeping a copy
Of every reference given, with the date and who gave it.
Where a former employee challenges what was said, the copy is the only defence — and where there is no copy, the organisation is arguing from memory against somebody who has the document.
The three tests for a reference
Factual where it states facts, accurate, and fair — meaning not misleading overall. The third does most of the work, because a reference of true statements can still mislead by omission.
Refusing consistently
Refusing to give references is permitted and must be applied to everybody. An employer that gives them to all but one person has communicated something, and the inconsistency is the exposure rather than the refusal.
Keeping a copy of what was said
Where a former employee challenges a reference, the copy is the only defence. Without it the organisation argues from memory against somebody holding the document.
Standard forms are safer
Dates, title, reason for leaving if asked. A template limits what is said, ensures consistency, and removes individual judgement from a document that may be litigated.
Why the subject may see it anyway
The giver may have an exemption and the recipient frequently does not. Which has a practical consequence: write every reference assuming the subject will read it, because the route exists.