As part of data protection laws, individuals are entitled to a copy of the personal data any organisation holds about them. Requesting that information is called a subject access request.

Under the new Data Protection Act 2018, which came into force on May 25, any reference provided in confidence is exempt from disclosure under a subject access request.

This means that if an organisation receives a subject access request, confidential employment references about the individual making the request - whether created by that organisation or received from a third party - can lawfully be withheld.

Best practice for Watford employers

Care must always be taken when providing references about employees to prospective employers or recruitment agencies. When giving references, you should always remember that:

• There is no legal obligation to provide a reference but any reference provided must be true, accurate and not misleading.

• The content of a reference may need to be disclosed as part of any litigation involving the employee.

• Employment references should be marked as "Strictly confidential - employment reference" in order to ensure that the exemption can be applied by sender and recipient.

• Once given, a reference is out of your control. There is no certainty therefore that an employer who receives a reference might not share it with the employee in question, perhaps because it is unaware that it might be exempt, or that it intends to disclose the document in order to defend its own position.