Disclosure of Former Employee Information in Third-Party References

A manager, responding to a reference request from a prospective employer, shares details about a former team member that extend beyond standard employment confirmation — including performance observations, reasons for leaving the organisation, and interpersonal assessments — communicated informally over email or messaging platforms.
 

1. Does the disclosure of a former employee's professional performance and conduct information to a third party constitute a DPDP compliance obligation for the organisation?
2. What risks arise from informal reference practices conducted outside organisational oversight?
3. What is the recommended framework for managing third-party reference requests in a DPDP-compliant manner?
    

Yes — with significant caveats. An individual's performance history, reasons for leaving, and interpersonal assessments are personal data under DPDP. Their disclosure to a third party — even in a professional reference context — is a processing activity. Whether it is permissible depends entirely on whether the former employee consented to this specific disclosure and whether the information shared is accurate, proportionate, and limited to what was requested.
 

• Processing without consent — A former employee's data protection rights do not expire with their employment. Unless the individual has consented to a reference being provided — and specifically to the categories of information being shared — the disclosure may not have a valid lawful basis under DPDP.
• Informal channels and uncontrolled disclosure — References communicated over personal email, WhatsApp, or verbal calls leave no organisational record, cannot be audited, and may contain subjective assessments that the organisation cannot defend if challenged. The individual being referenced has no visibility into what was said about them or to whom.
• Accuracy obligation — DPDP requires that personal data used in processing activities be accurate. Subjective managerial assessments — particularly regarding interpersonal conduct or reasons for departure — may be contested, outdated, or influenced by personal bias. Acting on such data without verification mechanisms exposes the organisation to grievance.
• Liability if information is adverse — If a former employee is denied employment based on an inaccurate or unduly negative reference, and subsequently links that outcome to information shared without their knowledge, the organisation faces potential grievance proceedings under DPDP and civil liability.
   

1. Establish a formal reference policy. All third-party reference requests should be directed to HR, not to individual managers. HR should maintain a standard reference template that confirms employment dates, role, and — only if the employee has pre-authorised it — additional professional observations.
2. Obtain prior consent from the employee. At the point of exit, employees should be offered the opportunity to authorise or decline reference disclosures, and to specify what categories of information may be shared. This consent should be documented.
3. Restrict informal manager references. Managers should be explicitly instructed that providing references outside the formal HR process — verbally or through personal channels — is not permitted. This protects both the former employee and the organisation from uncontrolled data disclosure.