New data protection complaint rules have now come into force. This has put the spotlight on what employers must do to remain compliant with the UK General Data Protection Regulation (GDPR) when handling data for employees and prospective employees.

The provision of a reference, particularly a detailed one, usually involves the disclosure and processing of personal data under GDPR. It’s therefore important to have a good understanding of data protection principles when handling references.

By taking responsibility for processing personal data, the employer is acting as a data controller. Part of that role is to identify a lawful basis for data processing activities.