New data protection complaint rules are live. Your reference process is caught by them.
- HRNews
- 2 hours ago
- 2 min read
What is it?
From 19 June 2026 the Data (Use and Access) Act 2025 brought a new complaints framework into the Data Protection Act 2018. Every controller, which means every employer, must now offer a clear route for individuals to complain directly about how their personal data has been handled. Complaints must be acknowledged within 30 days of receipt, investigated without undue delay, and the outcome communicated. You also need to keep records, and the ICO can ask to see them.
The ICO expects people to use your internal process first before escalating to the regulator, other than in exceptional cases.
References sit right inside this. Giving a reference means processing someone's personal data, so a complaint about a reference is now a data protection complaint you are obliged to handle properly.
What does it mean for you?
Three practical points.
Your privacy notice needs to explain how to complain, and your people need to recognise a complaint when one arrives. It counts however it is submitted, including by email or social media, so a complaint can land with anyone.
References are not automatically off limits to a subject access request. The confidential reference exemption applies whether you gave the reference or received it, but only where references are genuinely treated as confidential and you have said so somewhere sensible, such as your privacy notice, handbook or policy. Where that is unclear, the ICO expects a case by case decision. Exemptions are available to use, not automatic.
Accuracy still matters. A reference must be true, fair and not misleading, and a poorly worded one can cause problems that go well beyond data protection. Short, factual references remain the safest default for most employers.
How Lansbury HR can help.
We can review your privacy notice and reference practice against the new rules, put a workable complaints procedure in place, and give your managers a simple steer on what to do when a reference request lands.
Get in touch with the team at Lansbury HR.
Comments