A reference will include personal data relating to the individual and may, depending on the circumstances, include special category data (or special categories of personal data, formerly known as sensitive personal data), eg where it includes information concerning the individual’s sickness absence record, ie health. Before processing personal data in relation to an individual, an employer will need to consider whether that processing is lawful under Assimilated Regulation (EU) 2016/679, UK GDPR (UK GDPR) and the Data Protection Act 2018 (DPA 2018). For further information, see Practice Note: References, under the section dealing with ‘Data protection issues’. For information about the lawful processing of personal and special category data, generally, see Practice