In this Q&A, the reference in question will comprise personal data, so that the employer will need to ensure that it can rely on a lawful condition within Article 6(1) of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). If the enquiry comprises special categories of personal data, the employer will need to ensure, in addition, that it can rely on a specific condition for the processing under Article 9(2) of Regulation (EU) 2016/679, GDPR. For further information, see the sections headed ‘Personal data’, ‘Personal data—lawful processing conditions’ and ‘Special category data—specific processing conditions’ in Practice Note: The UK GDPR and DPA 2018: key data protection issues for employment lawyers. ‘Consent’ is, of course, a lawful condition for processing under Article 6(1)(a). Under Regulation (EU) 2016/679, GDPR ‘consent’ is