📜 Do I Need to Give References in a Subject Access Request?

When it comes to subject access requests and exemptions, it’s important to understand the various exceptions that apply to certain types of personal data. One specific exemption relates to confidential references. According to the Information Commissioner’s Office (ICO) and the Data Protection Act 2018, personal data included in a confidential reference is exempt from the right of access in specific circumstances.

The exemption applies to references given or received for the purpose of prospective or actual education, training, employment, volunteer placement, appointment to office, or provision of services by an individual. It is important to note that this exemption only applies to references that are provided in confidence.

To ensure clarity in your documentation, especially for educational references, it is advisable to explicitly state that all references will be treated as confidential. This should be communicated to both the individuals providing the referees and those providing the reference itself.

For example, instead of a simple instruction like “Please provide details of two referees,” you can modify it to convey that all references will be treated as confidential. A revised statement could be: “Please provide details of two referees. All references will be treated as confidential.”

If your references are considered confidential, you will need to ensure staff dealing with subject access requests are aware of, and have adequate guidance to follow, to prevent accidental release of your confidential references.

Understanding these exemptions and clearly communicating the confidentiality of references will help ensure compliance with data protection regulations and maintain the privacy and trust of individuals involved in the process.

For more detailed information on other exemptions that apply to subject access requests, check out our SAR Guidance: