Reference check: questions, rules and a sample form

How to run a reference check: which questions may you ask?

A reference check is a short conversation with someone who has worked with your candidate, usually a former manager. It tells you what a CV and an interview cannot: how the person actually did the job.

A CV is written by the candidate, and an interview shows how someone presents themselves for over an hour or two. A referee has seen them at work for months or years: on good days and bad, under deadlines, with difficult clients and in a team. That is why a reference check is often the last step before an offer, and sometimes the one that changes the decision.

It is also different from employment verification. Verification confirms facts, such as job titles and dates. A reference check goes further and asks how well the candidate did the work, how they worked with others, and whether the referee would hire them again.

Done well, a reference check takes 15 to 20 minutes per referee and gives you specific examples you can weigh against the interview. Done badly, it can breach the GDPR, put the referee in an awkward position, and give you vague praise you cannot use. The difference usually comes down to three things: the candidate's consent, the right questions, and careful notes.

This guide covers the rules in plain terms: when to check, how to get consent, 12 questions you may ask, and the topics you must avoid.

When to run a reference check

Run it at the end of the process, once you have one or two finalists. Checking every applicant wastes time and collects more personal data than you need, which the GDPR does not allow.

Many employers make the offer conditional on satisfactory references. That works, as long as you say so in the offer letter and tell the candidate what "satisfactory" means.

Two referees are enough for most roles. For senior or high-trust positions, three gives you a fuller picture. Focus on the last five years: a manager from ten years ago says little about how someone works today.

A reference check is one part of pre-employment screening, alongside employment history checks, diploma verification and, where the role requires it, a certificate of conduct.

Consent and the GDPR

You may only contact a referee if the candidate knows about it and has agreed. This is the rule in the Dutch NVP Sollicitatiecode (recruitment code), and it is the safest reading of the GDPR across the EU.

Legal basis

Most employers rely on legitimate interest: you need reliable information to hire the right person. The Dutch Data Protection Authority (AutoriteitPersoonsgegevens) warns that consent from a job applicant is rarely truly free, because they fear losing the job. So, treat the candidate's permission as an extra safeguard on top of your legal basis, not as the basis itself. Record it in writing either way.

Tell the candidate:

• which referees you will contact, and that the candidate chooses or approves them;
• what you will ask about (the role, the work, the reason for leaving);
• how long you keep the notes and who sees them;
• that they will hear the outcome, positive or negative, and can respond to it.

Only named referees 

Do not ring a former employer the candidate did not list, and do not dig for "backdoor" references through your own network. Without consent, both you and the referee risk a GDPR breach, and the referee may be liable for damage caused.

Only job-relevant data

Ask only what you need to judge suitability for this role. Anything else is excess data you should not collect.

Retention

Delete reference notes for unsuccessful candidates within four weeks of the end of the procedure. You may keep them for up to one year only with the candidate's explicit consent. For the person you hire, relevant notes move to the personnel file.

12 reference check questions you may ask

Every question below is about the work itself. Ask open questions and follow up with "Can you give me an example?" Specific examples are worth more than any rating.

Facts first

1. How do you know the candidate, and for how long did you work together?
2. What was their job title, and what were their main responsibilities?
3. Can you confirm their start and end dates?

Performance

1. What were their main strengths in the role?
2. Which of their results or projects stands out most?
3. Where could they still grow, and what support helped them most?
4. How did they handle pressure, deadlines or a heavy workload?

Working with others

1. How did they work with colleagues, clients or the people they managed?
2. How did they respond to feedback or disagreement?

Fit for the new role

1. We are hiring them as [role], which involves [two or three key tasks]. How well do you think they would do?
2. What kind of manager or environment brings out the best in them?

The closing question

1. Why did they leave, and would you work with them again?

The last question is the most telling. A warm, immediate "yes" says a lot. So does a long pause.

What you may not ask in a reference check

If a question is not about how the candidate did the job, leave it out. Some topics are special category data under the GDPR or protected by equal treatment law, and a referee should not answer them even if you ask.

Do not ask about

• Health, illness or sick leave
  Health data is special category data. Employers may not ask about it during hiring. Instead, describe the role's physical demands to the candidate; they decide what to share.
  
• Pregnancy or plans for children
  Sex discrimination under equal treatment law. This is never relevant.
  
• Religion or beliefs
  Special category data and a protected ground. Instead, ask the candidate directly about availability, such as weekend shifts.
  
• Ethnic origin or nationality
  Protected ground. Instead, check right to work with the candidate's own documents.
  
• Sexual orientation or relationships
  Special category data and a protected ground. This is never relevant.
  
• Age
  Protected ground. Dates of employment are enough.
  
• Trade union membership
  Special category data. This is never relevant.
  
• Political views
  Special category data. This is never relevant.
  
• Criminal record
  Referees are not a lawful source of criminal data. Instead, ask the candidate for a certificate of conduct (in the Netherlands, a VOG) if the role requires one.
  
• Salary at the previous job
  The EU Pay Transparency Directive bars employers from asking about pay history; EU countries are writing this into national law. Instead, discuss pay expectations with the candidate.
  
• Private life and family situation
  Not relevant to the role. This is never relevant.

A practical test: would you be comfortable if the candidate read your notes? Under the GDPR they have the right to, so write every note with that in mind.

How to run the reference call, step by step

1. Get written consent. Ask the candidate to name two referees and sign a short consent form. Note the date.
2. Check the referee is real. Find the referee's work number or email through the company's own website or switchboard, not only the details on the CV. Fake referees do turn up, so this step matters.
3. Book a slot. Email the referee, mention that the candidate gave permission, and propose a 15-minute call. Phone or video gets franker answers than a written questionnaire.
4. Open the call. Introduce yourself, name the role, confirm the candidate agreed to the call and say how you will use the answers.
5. Ask the same questions of every referee. Use the form below so you can compare candidates fairly. Follow up on vague answers.
6. Take factual notes. Write down what was said, not your interpretation. Leave out anything off limits, even if the referee volunteers it.
7. Share the outcome. Tell the candidate what you learned, especially if it counts against them, and let them respond before you decide.
8. Delete or file. Delete the notes within four weeks if you do not hire the candidate. If you do, keep only what is relevant in the personnel file.

Vague or negative references: what to do

The referee will only confirm the dates. Many companies have a policy of confirming only job titles and dates. Accept it, note it on the form, and do not count it against the candidate. Ask the candidate for a second referee instead.

The answers are vague. Ask for a concrete example: "Can you describe the time they did that?" If nothing specific comes back, treat the reference as neutral, not positive.

The reference is negative. One bad reference is a reason to ask more questions, not to reject them on the spot. Check it against the other referee and the interview. Then share it with the candidate and hear their side, as the NVP code requires. There may be a clear explanation, such as a conflict with one manager.

The referee volunteers something off limits. If a referee mentions an illness or a pregnancy, stop them politely, do not write it down and do not let it affect your decision.

Common mistakes

• Calling a referee, the candidate did not name.
• Checking references before the final round, for every applicant.
• Asking different questions about different candidates.
• Keeping notes on rejected candidates "just in case".
• Relying on a single glowing reference from a friend or peer rather than a manager.

Frequently asked questions

• Can I check references without the candidate's permission?

No. Always tell the candidate and get their agreement in writing first. Without it, you and the referee both risk breaching the GDPR.

• Can I reject a candidate who refuses a reference check?

You may make the offer conditional on references, as long as you say so upfront. If a candidate objects to one specific referee, such as a current employer who does not know they are leaving, agree on another referee instead.

• Is a former employer obliged to give a reference?

No. A referee may decline or confirm only the basic facts. If they do give a reference, it must be truthful and limited to the work.

• How long can I keep reference notes?

For candidates you do not hire, up to four weeks after the procedure ends, or up to one year with their explicit consent. For the person you hire, keep only what is relevant in the personnel file.

• Does the candidate have a right to see what the referee said?

Yes. Under the GDPR, candidates can ask for access to the personal data you hold about them, including your reference notes.

• Do these rules apply in the UK and Ireland?

The principles are the same: the UK GDPR and the EU GDPR both require a lawful basis, transparency and data minimisation, and equality law in both countries protects the same core grounds. The details of national guidance differ, so check with your local adviser.