Pre-Employment Reference Checks: A UK Employer's Guide

Reference checks feel like a routine part of hiring, but getting them wrong exposes an employer to real legal and data protection risk — and getting them right requires understanding where reference checks sit relative to the checks that genuinely are mandatory, like right-to-work verification. Understanding the distinction matters for HR, finance, and compliance teams involved in recruitment governance.

Reference checks aren't legally mandatory — but that doesn't mean low-risk

Unlike right-to-work checks, which UK employers are legally required to carry out on every employee, reference checks fall into the category of checks an employer "may want to — or need to" carry out depending on the role and sector, per CIPD guidance. There's no single statutory requirement to take up references before hiring someone into most roles. That said, "not mandatory" doesn't mean risk-free or optional in practice: for many roles, skipping reference checks entirely is a real recruitment governance gap, particularly in regulated sectors or safeguarding-sensitive roles where sector-specific rules may impose their own reference-checking requirements.

Data protection runs through the whole process

Whatever an employer's reference-checking policy, UK data protection law applies throughout — from the point a candidate's personal data is requested from a former employer, through to how that reference is stored, used, and eventually disposed of. Good practice means being able to demonstrate the process was both legal and ethical: candidates should generally know references will be sought, what will be asked, and how the resulting information will be used and retained, rather than references being taken and used in ways the candidate wasn't told about upfront.

What employers should actually check

A well-structured reference-checking process generally verifies: employment dates and job title (confirming the candidate's account of their own work history is accurate), and, where relevant and permitted, factual matters like reasons for leaving that a reasonable business would expect to be true, given the trust placed in the role. Employers should be cautious about references that stray into subjective character assessment without a clear, job-relevant basis, since this is where reference checks are most likely to raise discrimination risk if not handled consistently and fairly across all candidates and this variation itself is legitimate, provided it's applied consistently within a given role category rather than fluctuating candidate-by-candidate based on informal judgement.

An evolving legal landscape

Employment law in this area continues to develop — CIPD guidance itself flags that employers should keep a close eye on regulatory change, particularly around blacklisting practices, where informal reference-sharing networks that unfairly exclude candidates from employment (rather than genuine, individualised reference checks) can create significant legal exposure. This is a useful reminder that "we've always done references this way" is not, on its own, a defensible compliance position if informal practices haven't kept pace with how the law has developed.

Why finance and compliance roles are often stricter

Reference checking practice varies significantly by sector and role sensitivity, and finance, accounting, and other regulated professional roles frequently sit at the stricter end of that spectrum — reflecting both the fiduciary trust involved and, in regulated financial services specifically, the additional regulatory expectations around fitness and propriety checks for certain roles. Employers hiring into finance functions should treat reference checking as part of a broader due diligence process rather than a final formality, particularly for roles with financial control responsibilities, since a gap here is one that both internal audit and external regulators are increasingly likely to ask about.

Building a defensible process

A genuinely defensible reference-checking process typically includes: a clear, written policy on when references are sought and what's asked; candidate awareness and, where appropriate, explicit consent before references are requested; consistent application across all candidates for a given role, to avoid any appearance of selective or discriminatory checking; secure handling and time-limited retention of reference data in line with data protection principles; and a clear separation between fact-checking (dates, job titles) and any more subjective assessment, with the latter used cautiously and only where genuinely job-relevant.

Frequently asked questions

Are employment reference checks a legal requirement in the UK?
Not generally — unlike right-to-work checks, there's no blanket statutory requirement to take up references before hiring, though specific sectors and safeguarding-sensitive roles may have their own rules.

What data protection considerations apply to reference checks?
Candidates' personal data is involved throughout the process, so UK data protection principles apply — from how references are requested and used, through to secure storage and appropriate retention and disposal.

What is "blacklisting" in a reference-checking context?
Informal reference-sharing arrangements that unfairly exclude candidates from employment opportunities, rather than genuine, individualised, job-relevant reference checks — this is an area of increasing regulatory attention.

Understanding good-practice recruitment compliance like this is core to Learnsignal's CPD courses, and our Employment Rights Act 2025 guide is a useful companion read on the wider landscape of evolving UK employment law.