The provision of an employment reference by an employer, in respect of a departing or former employee, to a third party, will, from the point of view of the framework under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), involve the processing of personal data. It follows that in order for such provision to be lawful, at least one of the six ‘lawful grounds’ conditions listed in Article 6(1) of the GDPR must apply. See Practice Note: Introduction to the EU GDPR and UK GDPR—Lawful basis of processing. Of those six, only four could even potentially be of application in the context of providing an employment reference, namely: • the data subject has given consent to the processing of his or her personal data for one or more specific purposes • processing is necessary for the performance of a contract to which the data subject is party or in order