Reference Check Laws by Country (2026)

Reference checks for senior hires sit between privacy rules, discrimination law and defamation risk. Employers in these six countries should give notice, ask job-related questions and treat references as part of the record.

Reference check rules at a glance

The comparison table covers the United States, Canada, the United Kingdom, Ireland, Australia and New Zealand. It shows where notice or consent is required before you collect a reference, and where a reference given in confidence may be withheld from the candidate.

Country Duty to give a reference? Candidate notice or consent Can the candidate see it?
United States No; some states require a service letter on request FCRA consent if a screening company runs the checks Only through FCRA rights or litigation
Canada No Consent in Quebec; notice in BC; consent for referees the candidate did not name Depends on the privacy law that applies
United Kingdom No, except FCA and PRA regulated roles Tell candidates (UK GDPR) Not if given in confidence
Ireland No, except Central Bank controlled functions Tell candidates (GDPR) Often yes; no confidential references exemption
Australia No Notice under APP 5 (Privacy Act, larger businesses) Usually yes, under APP 12 (larger businesses)
New Zealand No Notice under IPP 3A since 1 May 2026 Not if supplied in confidence (s50)

Last checked 5 November 2026. This is general information for employers, not legal advice. Check with employment counsel in each country before you rely on it.

United States

The United States has no federal duty to give a reference, so many employers confirm only dates and job title. More than 30 states give employers immunity for good-faith references. California protects non-malicious statements, including whether the employer would rehire, but a positive reference that hides known danger can create liability after Randi W. v. Muroc. Third-party reference interviews are investigative consumer reports under the FCRA. Obtain written consent before ordering them and tell the candidate within three days of the request. In-house checks fall outside the FCRA.

Step (FCRA, third-party reference checks) What the employer must do
Disclosure and authorization Give a standalone written disclosure and get written authorization before ordering
Investigative report notice Tell the candidate within 3 days of requesting a report based on interviews with referees
Nature and scope If the candidate asks, describe the nature and scope of the investigation within 5 days
Adverse action Send a pre-adverse action notice with the report and summary of rights, then a final notice

Canada

Canada has no statutory duty to give a reference. Federally regulated employers follow PIPEDA. Alberta and British Columbia private sector privacy laws permit collecting personal information about a prospective employee without consent where it is reasonable to set up the job, but British Columbia requires notice. Contacting a former employer the candidate did not name is risky in that province. Quebec's Law 25 requires free, informed and specific consent to collect information from third parties. Human rights codes bar questions on protected grounds, including through referees.

Jurisdiction Reference check rule
Federally regulated employers PIPEDA: personal information may be collected to set up the job, with notice
Alberta PIPA allows reasonable collection about a prospective employee without consent
British Columbia PIPA allows reasonable collection without consent, but the candidate must be told
Quebec Law 25: free, informed and specific consent to collect from referees
Ontario and other provinces No private-sector privacy law for most employers; get consent as good practice

United Kingdom

There is no general duty to give a reference, except in FCA and PRA regulated firms, which must request regulatory references covering the previous six years. A referee owes the subject a duty of care to give a true, accurate and fair reference that does not give a misleading overall impression. Refusing a reference or giving a worse one because someone brought a discrimination claim can be victimisation. UK GDPR requires candidates to be told references will be sought. Equality Act section 60 bars asking about health or sickness absence before a job offer.

  • Duty of care: a reference must be true, accurate and fair, and must not give a misleading overall impression.
  • Health questions: do not ask a referee about health or sickness absence before a job offer (Equality Act 2010 s60).
  • Confidential references: references given in confidence are exempt from the candidate's subject access request.
  • Regulated firms: FCA and PRA firms must request regulatory references covering the previous 6 years.

Ireland

Ireland has no statutory duty to give a reference. Referees owe a duty of care and have qualified privilege in defamation under section 18 of the Defamation Act 2009. GDPR requires a lawful basis and notice. There is no Irish equivalent of the UK confidential references exemption, so a reference may be disclosable to the candidate, subject to protecting the referee's rights. Central Bank fitness and probity rules require due diligence for controlled functions, and this usually includes references.

Australia

Australia has no general duty to give a reference. Under the Privacy Act 1988, APP 3 requires collecting personal information from the individual unless that is unreasonable, and APP 5 requires notice. A reference check is collection from a third party. The employee records exemption does not cover unsuccessful applicants. Businesses with turnover of A$3 million or less are generally exempt from the Privacy Act. The Financial Accountability Regime requires banks, insurers and super funds to assess the suitability of accountable persons, which usually includes references.

New Zealand

New Zealand has no general duty to give a reference. From 1 May 2026 Information Privacy Principle 3A requires employers to tell candidates when they collect information about them from someone else, such as a referee, unless the candidate already knows. A clear notice at application covers this. Candidates have a right to see information held about them, but an employer may withhold evaluative material supplied in confidence under Privacy Act 2020 section 50. The Privacy Commissioner advises asking each referee whether their comments are confidential and recording the answer.

Regulated financial roles

Country Regime Reference rule
United Kingdom FCA and PRA Senior Managers and Certification Regime (SYSC 22) Request regulatory references covering 6 years; replies expected within 4 weeks since April 2026
Ireland Central Bank fitness and probity Due diligence for controlled functions, usually including references
Australia Financial Accountability Regime (APRA and ASIC) Suitability checks for accountable persons, usually including references
United States FINRA Review the Form U5 termination notice when hiring registered representatives

Giving a reference for a former employee

When asked to give a reference, confirm only what you can support. No country in this guide imposes a general legal duty, except UK and Irish regulated financial firms. A good-faith reference usually has qualified privilege against defamation, but that protection is lost through malice. In the UK and Ireland you also owe a duty of care to be accurate. Stick to dates, role, duties and job-related performance. Avoid subjective or unproven claims. Refusing a reference or giving a worse one because someone brought a discrimination claim can be victimisation in the UK.

Checking references on a senior hire

1. Give notice and get consent

Tell candidates before you approach anyone. In Canada, Quebec's Law 25 requires free, informed and specific consent for third party collection. In New Zealand, a clear notice at application can satisfy IPP 3A from 1 May 2026. Under the US FCRA, third-party reference interviews need written disclosure and authorization before ordering.

2. Use nominated referees

Ask candidates to name former managers or supervisors. Contacting a former employer the candidate did not name is risky in British Columbia and may conflict with privacy expectations elsewhere. In Ireland, a reference may be disclosable to the candidate, subject to protecting the referee's rights. Keep questions tied to the role.

3. Ask the same job-related questions

Use a fixed set of questions for every referee. Avoid health, age, pregnancy, religion or other protected grounds, which human rights codes and discrimination laws bar across these countries. In the UK, Equality Act section 60 bars asking about health or sickness absence before a job offer. In Canada, human rights codes apply to questions put through referees.

4. Time the check after a conditional offer

Run reference checks after a conditional offer, and make the offer conditional on satisfactory references. Fewer people are checked, the candidate expects the calls, and in the UK it keeps health questions out of the process until after the offer. State the condition clearly in the offer letter.

5. Keep clear records

Record which referees were contacted, the questions asked and the answers given. In New Zealand, ask each referee whether their comments are confidential and record the answer under Privacy Act 2020 section 50. In the United States, in-house checks fall outside the FCRA, but written records still support a good-faith defence if a reference is challenged.

How Aristo Search checks references

Aristo Search runs structured reference checks with referees the candidate has nominated, after telling the candidate and getting their consent. We put the same job-related questions to every referee, never ask about health, age, pregnancy, religion or other protected traits, and give you a written record of each conversation. We usually time checks after a conditional offer and plan them around the privacy rules where the role sits.

More hiring guides and tools

Sources

Questions employers ask

Do we have to give a reference?

No general legal duty in these countries, except UK and Irish regulated financial firms. Many US employers confirm only dates and job title as a policy. If you do give one, keep it factual and job related. A good-faith reference usually has qualified privilege against defamation, but malice can remove that protection.

What can we ask a referee?

Ask about job duties, performance, skills and dates. Do not ask about health, age, pregnancy, religion or other protected traits; discrimination laws and human rights codes bar these questions through referees across the countries. In the UK, Equality Act section 60 specifically bars health and sickness absence before a job offer.

Do we need candidate consent before calling referees?

It depends. In Canada, Quebec's Law 25 requires free, informed and specific consent. Under the US FCRA, third-party reference interviews require written disclosure and authorization before ordering. In New Zealand, a clear notice at application can satisfy IPP 3A from 1 May 2026. UK GDPR requires candidates be told references will be sought.

Can a candidate see the reference we receive?

In the UK, references given in confidence are exempt from subject access requests under Schedule 2 paragraph 24 of the Data Protection Act 2018. Ireland has no equivalent exemption, so a reference may be disclosable to the candidate, subject to protecting the referee's rights. In New Zealand, evaluative material supplied in confidence may be withheld under Privacy Act 2020 section 50.

What if a screening company runs the reference check?

In the US, third-party reference interviews are investigative consumer reports. Obtain written disclosure and authorization before ordering, tell the candidate within three days of the request, and provide details of scope within five days if asked. In-house checks fall outside the FCRA.

Is it risky to give a negative reference?

Referees in the UK and Ireland owe a duty of care to be accurate. A good-faith reference has qualified privilege against defamation, lost through malice. In the UK, refusing a reference or giving a worse one because someone brought a discrimination claim can be victimisation. Keep comments factual and supported.

Are there special rules for financial services employers?

Yes. In the UK, FCA and PRA regulated firms must request regulatory references covering the previous six years. Since April 2026 the FCA expects replies within four weeks and bars adverse content based on unproven suspicion. Ireland's Central Bank fitness and probity rules and Australia's Financial Accountability Regime require due diligence on key roles, which usually includes references.

Ready to Hire With Full Confidence?

Tell us the role and where it sits. We run structured reference checks with nominated referees and plan them around the privacy rules in that location.

Aristo Search - Your Global Partner in Professional Recruitment

Get a Quote