Data Protection at Work UK: Your Rights Under UK GDPR
Your employer processes your personal data — but you have rights. This guide explains what data your employer can hold, how to access it, and when processing is unlawful.
Do employers have to provide a reference? Can they say anything negative? This guide explains the law on employment references in the UK — including the duty of care, confidentiality, and what to do if you receive a bad reference.
References are often crucial to securing a new job — but many employees are unclear about what their employer can say, whether they have to provide one at all, and what remedies exist if a bad or inaccurate reference costs them a job offer.
Generally, no — there is no legal obligation in the UK for an employer to provide a reference. Except in a few specific regulated sectors (such as financial services, where the FCA requires regulated firms to provide references for certain staff), employers can simply decline to provide one.
However, most employers will provide at least a basic factual reference confirming:
Once an employer chooses to give a reference, it must be:
An employer owes a duty of care to the recipient (the new employer) and potentially to you (the subject of the reference) to ensure the reference is accurate. A reference that is factually incorrect, misleading, or fails to give a fair overall picture may be actionable.
The leading case is Spring v Guardian Assurance [1995] — the House of Lords confirmed that an employer giving an inaccurate reference that prevents a former employee from getting a job can be liable for negligent misstatement.
A malicious or deliberately untrue reference is defamation (libel if written) — unless it is protected by qualified privilege, which most employer references are. Qualified privilege protects honest references even if defamatory, but the protection is lost if the reference is made maliciously.
Employment references contain personal data. Under the UK GDPR:
If you are leaving under a settlement agreement, it is standard practice to agree the reference wording as part of the deal. The agreed reference — usually a simple factual statement — is then given to future employers.
This protects both sides: you know exactly what will be said, and the employer avoids later liability for any contested description of your performance or reason for leaving.
Under UK GDPR, you have a right of access to personal data held about you. However:
In practice, if you suspect a bad reference has cost you a job, you can:
If an inaccurate or misleading reference has cost you a job offer:
Upload any UK legal document and get an instant AI breakdown — clause by clause, risk by risk, in plain English.
Free tools for this topic
Find your statutory minimum notice period under ERA 1996.
Calculate your statutory redundancy pay with a year-by-year breakdown.
Check if your pay meets the 2025/26 National Minimum or Living Wage.
Calculate your statutory annual leave for full-time or part-time work.
Upload any UK legal document and get an instant AI breakdown — clause by clause, risk by risk, in plain English.
Related Guides
Your employer processes your personal data — but you have rights. This guide explains what data your employer can hold, how to access it, and when processing is unlawful.
Your P45 and P60 are important tax documents. This guide explains the difference, when you should receive them, and what to do if your employer fails to provide them.
The Employment Rights Bill 2024-25 introduces major changes to UK employment law, including day one unfair dismissal rights, strengthened trade union rights, and new protections for workers. Here is what is expected and when.