Skip to content

Under the Data Protection Act, individuals have the right to request a copy of information held about them. This includes requests for access to ‘confidential references’ provided for employment, education or training purposes.

When it comes to references, different subject access rights apply depending on whether you are the author or the recipient of the reference: the Data Protection Act provides an exemption to the writer of a reference but not to the person or organisation that is in receipt of the reference.

References received by the university

References the university receives from another organisation will be subject to access requests and the Information Commissioner’s Office (ICO) recommends that “In most circumstances, you should provide the information in a reference, or at least a substantial part of it, to the person it is about if they ask for it.”

All requests for access to references must be considered and information can only be withheld where there is strong justification to do so.

Where references are marked ‘in confidence’, it is important to consider whether that information is actually confidential or not. Where it is unclear if information in a reference is known to the subject or not, or where there are concerns regarding aspects of the contents, it may be necessary to contact the referee prior to disclosing. However, it should be noted that the decision to release information in a reference is not dependent on having the consent of the referee.

References provided by the university

References given by, or on behalf of the university, or as part of any standard procedure, are exempt from subject access requests where those references relate to the:

  • education, training or employment of the data subject

  • appointment of the data subject to any office

  • provision by the data subject of any service.

This means that St George’s, University of London staff and students cannot request the university disclose the contents of a reference it has provided about them by citing the Data Protection Act.

Please note that while there is no obligation to so, there is nothing to prevent staff from providing individuals with a copy of a reference they have written about them. Where a reference is wholly or largely based on information the individual is already aware of, eg details of absence or of an appraisal of their work or ability, it would seem reasonable to provide them with a copy.

Staff should also bear in mind that any reference they write may still be subject to disclosure to the individual via the organisation it has been sent to. Marking the reference ‘confidential’ will not in itself prevent the subject from being able to access it.

Internal references

References internal to the university are treated the same as those received from an external source, and are therefore subject to a formal access request by a St George’s staff member or student.


Find a profileSearch by A-Z