# Reference Check Compliance: What HR Buyers Should Look For

Canonical URL: https://skillsociety.com.au/blog/reference-check/reference-check-compliance
Markdown URL: https://skillsociety.com.au/blog/reference-check/reference-check-compliance/markdown
Published: 2026-07-15
Author: Alberto Cubeddu
Excerpt: Reference check compliance starts with candidate consent, job-related questions, privacy controls, fair decision-making and software that keeps the evidence reviewable.

Reference checks are meant to reduce hiring risk. Poorly designed reference checks can create it.

For Australian TA, HR and recruitment leaders, reference check compliance is not a single form or a line of consent text. It is the operating model around the check: who can be contacted, what questions can be asked, how personal information is handled, how hiring managers use the evidence, and whether the process can be reviewed later.

The risk usually appears in ordinary moments: a hiring manager calls a mutual contact without telling the candidate, a referee volunteers health information, a recruiter writes subjective notes in an inbox, or one finalist is asked stricter questions than another. None of those failures require bad intent. They happen when reference checking is informal.

Privacy expectations are also rising. The OAIC's 2023 Australian Community Attitudes to Privacy Survey found that 93% of Australians believed they should have the right to ask a business to delete their personal information, while 79% said a privacy certification system would make certified organisations more trustworthy. Even where a particular hiring record sits inside an exemption or a narrow legal category, candidates and referees still expect a controlled, transparent process.

This guide is written for HR buyers assessing reference check software and internal process design in Australia. It is not legal advice. Use it as a practical checklist, then involve legal, privacy, employee relations or risk teams where the role, industry or jurisdiction requires deeper advice.

> **Make the compliant path the easy path.** Skill Society helps hiring teams collect structured, consent-led reference evidence with reviewable source responses and human decision controls: [book a demo](https://skillsociety.com.au/booking?utm_source=blog&utm_medium=cta&utm_campaign=reference-check-compliance-intro).

## The Compliance Baseline for Reference Checks

There is no single Australian "reference check compliance" rule that answers every hiring scenario. A good process usually needs to account for several overlapping areas:

- candidate consent and transparency;
- privacy and personal information handling;
- discrimination and adverse action risk;
- disability, health and sensitive information boundaries;
- confidentiality around current-employer contact;
- record security, access, correction and retention;
- fairness when serious or adverse information is raised;
- vendor, AI and data-processing governance where software is used.

The Australian Privacy Principles do not apply to every employer in every circumstance. For example, the OAIC explains that some private-sector employee records are exempt in certain circumstances, while unsuccessful job applicant information is not covered by the future employment relationship exemption. That nuance matters: a hiring team should not assume reference notes are automatically outside privacy governance just because they are connected to recruitment.

The conservative operational standard is simpler: treat reference checks as formal hiring records containing personal information about the candidate, and sometimes personal information about the referee as well. Ask only for what is reasonably necessary, tell people what is happening, keep the evidence secure, and make sure the decision remains tied to the role.

## What a Compliant Reference Check Process Looks Like

A practical reference check compliance process should be:

- **Consent-led:** Candidates know when checks will happen, who will be contacted and what type of information will be requested.
- **Role-related:** Questions are tied to selection criteria, job requirements and observed work behaviour.
- **Consistent:** Candidates for the same role are checked through a comparable process unless there is a documented reason to vary it.
- **Privacy-aware:** The workflow minimises unnecessary information, discourages sensitive information and controls access to records.
- **Documented:** The team can see who was contacted, when, what was asked, what was received and who reviewed it.
- **Human-reviewed:** Software can organise evidence, but recruiters and hiring managers remain accountable for judgement.
- **Escalation-ready:** Serious, contradictory or adverse information has a defined follow-up path.
- **Retention-controlled:** Reference data is not kept forever by default or scattered across personal systems.

Compliance should not make reference checking slow. It should remove ambiguity so recruiters, hiring managers, candidates and referees understand the rules.

## Consent Comes Before Contact

Candidate consent is the first control buyers should test in any reference check process. The OAIC's consent guidance says consent should be informed, voluntary, current and specific. In reference checking, that means a generic line in an application form may not be enough for a well-governed process, especially where current employers, non-nominated referees, sensitive roles or international vendors are involved.

A strong consent workflow tells the candidate:

- when reference checks will happen;
- which referees are being requested;
- whether a current employer will be contacted;
- whether the candidate can restrict current-employer contact until a later stage;
- what kinds of questions will be asked;
- how the information will be used in the hiring decision;
- who inside the organisation can see the report;
- whether a vendor or AI-enabled workflow is used;
- how access, correction, retention or deletion requests are handled under policy.

This is where software can genuinely reduce risk. A structured workflow can require explicit confirmation before invitations go out, store the consent event, and stop a recruiter from accidentally contacting someone the candidate has excluded.

### Current-Employer Restrictions

Current-employer contact deserves separate treatment. A candidate may not have told their manager they are looking for a new role. Contacting that person without permission can expose the candidate to professional harm and damage trust in the employer brand.

Use a clear current-employer rule:

| Candidate instruction | Safer recruiter action |
| --- | --- |
| "Do not contact my current employer." | Block current-employer contact and request another suitable referee. |
| "Only contact my current manager after offer stage." | Delay contact until the agreed stage and record the condition. |
| "Use this former manager instead." | Contact the nominated former manager and keep the current employer excluded. |
| "I need to brief the referee first." | Pause the workflow until the candidate confirms readiness. |

For senior or regulated appointments, there may be reasons to seek additional references. Even then, make the reason clear, notify the candidate where appropriate, and document the approval path.

## Backchannel References Need Strict Controls

Backchannel references are informal checks with people the candidate did not nominate. They can feel more candid, but they are high-risk because the candidate may not know the contact is happening and the feedback may be biased, stale, irrelevant or impossible to assess fairly.

The OAIC's agency referee report guidance says that if a prospective employer wishes to seek a referee report from someone other than the applicant's nominated referee, they should notify the applicant before seeking the report. The same guidance says supervisors should avoid comments unrelated to work performance, such as political or religious views and generally health information.

Private-sector employers may not be under the exact same public-sector process, but the principle is commercially useful: avoid surprise reference checks. If your policy permits non-nominated referees, require:

- a documented reason connected to the role;
- candidate notice or consent where appropriate;
- approval from HR, talent leadership or legal for sensitive roles;
- the same job-related question set;
- a record of who was contacted and why;
- a fair review process if serious adverse information is raised.

If a hiring manager says, "I know someone who worked with them, I will just call", the process has already lost control. The compliant path should be easier than the workaround.

## Keep Questions Job-Related

The safest reference check questions validate role-related evidence. They ask about what the referee directly observed, not what they assume about the candidate's personal life.

Good questions usually cover:

- the referee's working relationship to the candidate;
- the period and context in which they worked together;
- responsibilities, reporting lines and role scope;
- role-relevant strengths;
- examples of performance, collaboration, reliability or judgement;
- development areas relevant to the new role;
- how the candidate responded to feedback or change;
- whether the referee would rehire or work with the candidate again, and why.

The AHRI notes that reference checks are common but limited, and that unstructured approaches can reduce reliability because referees may focus on different aspects of performance. Its article also points to standardised questions as a way to produce more reliable outcomes, while warning employers not to rely solely on reference checks.

That is a useful buyer standard: your platform should create comparable evidence, not a false sense of certainty.

### Risky Versus Better Question Wording

| Risky question | Better question |
| --- | --- |
| "Do they have any health issues?" | "Were there any role-related support needs or adjustments we should discuss directly with the candidate?" |
| "Will family commitments affect their availability?" | "Were they able to meet the agreed attendance, availability and output requirements of the role you observed?" |
| "Would they fit our young team?" | "How did they handle pace, ambiguity and collaboration in the environment you observed?" |
| "What are they like socially?" | "How did they work with peers, managers and stakeholders?" |
| "Any red flags?" | "Were there any role-related performance, conduct or reliability concerns that were raised and addressed?" |
| "Do they have strong English?" | "Did the role require written or verbal communication, and how did they perform against those requirements?" |

The better wording narrows the question to observed work behaviour. It also gives the recruiter a cleaner record if the decision is later questioned.

## Avoid Discrimination and Sensitive Information Traps

Reference conversations can drift into information the hiring team should not collect or use. A referee might mention age, pregnancy, family circumstances, disability, mental health, religion, union activity, political views or family and domestic violence. The recruiter may not have asked for it, but once it appears in notes or a report, the team needs a process for handling it.

The Fair Work Ombudsman says employers cannot take adverse action against a prospective employee for discriminatory reasons. Protected attributes include race, colour, sex, sexual orientation, age, physical or mental disability, marital status, family or carer's responsibilities, pregnancy, religion, political opinion, national extraction, social origin, breastfeeding, gender identity, intersex status and experiencing family and domestic violence. Adverse action can include not hiring someone.

JobAccess gives a practical disability-related boundary for interviews that also helps reference design: employers should not ask for details about a candidate's disability, and can ask only about how disability may affect doing the job and working safely. For reference checks, the safest path is to keep referee questions focused on role requirements, then discuss any adjustments or support needs directly with the candidate.

### What to Do When a Referee Volunteers Sensitive Information

Train recruiters to pause, redirect and record carefully:

1. Stop probing into the sensitive topic.
2. Redirect the referee to role-related behaviour or requirements.
3. Do not treat protected or irrelevant information as decision evidence.
4. If the comment raises a genuine safety, legal or role requirement issue, escalate to HR or legal before acting.
5. Keep notes factual and limited to what is necessary for the recruitment record.

For example, if a referee says, "She had health issues last year", the recruiter should not ask for diagnosis or medical history. A safer follow-up is, "I cannot discuss medical details. Were there any role-related requirements that were not met, or should we discuss support requirements directly with the candidate?"

## Privacy, Records and Retention

Reference checks can include personal information, opinions, referee contact details, employment history, performance examples, hiring manager conclusions and sometimes sensitive information volunteered unexpectedly. That makes storage and retention part of reference check compliance.

The OAIC's APP 3 guidance says covered organisations should collect only personal information reasonably necessary for their functions or activities, and that data minimisation is best practice. APP 6 limits use and disclosure to the purpose for which information was collected unless an exception applies. The OAIC's security guidance says entities should take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify information once it is no longer needed unless an exception applies.

For HR buyers, the practical question is not "Does the vendor say they are compliant?" It is "Can our team run the process without leaking hiring evidence into uncontrolled systems?"

Ask where reference check records live:

- Are recruiter notes stored in the ATS, reference platform, inboxes or local documents?
- Can access be restricted by role, team, job, client or hiring manager?
- Can the organisation configure retention periods?
- Can reports be exported, and are exports logged?
- Can records be deleted or de-identified according to policy?
- Are changes, approvals and review actions auditable?
- Is there a process for access or correction requests?
- What happens if a data breach involves reference check data?

If the answer depends on manual discipline, the control is weak. Reference check software should reduce the number of places where sensitive hiring evidence can live.

## AI and Automated Reference Checking

AI-enabled reference tools can help summarise long responses, detect missing information, highlight contradictions, classify themes or suggest follow-up questions. They can also create privacy, accuracy and bias risks if used carelessly.

The OAIC's guidance on commercially available AI products says privacy obligations apply to personal information entered into an AI system and to output data where it contains personal information. The same guidance recommends due diligence, human oversight, transparency, privacy governance and caution with personal information in AI systems. It also says organisations should not enter personal information, particularly sensitive information, into publicly available generative AI tools as a matter of best practice.

For reference check buyers, that translates into a few non-negotiables:

- humans must review the underlying referee evidence;
- AI summaries should not become the only record;
- the tool should not make a hiring decision;
- candidates and referees should receive clear notices where AI is materially involved;
- the vendor should explain what data is processed, where, by whom and for what purpose;
- hallucinations, transcription errors and inferred information should be reviewable;
- recruiters should be able to correct or ignore AI outputs;
- access to raw recordings, transcripts, summaries and flags should be controlled.

Use AI to organise evidence, not to outsource accountability.

## Buyer Checklist: Compliance Features to Test in a Demo

When buying reference check software, do not stop at a feature matrix. Ask the vendor to walk through a realistic candidate, referee, recruiter and hiring-manager journey.

| Control area | What to test | Why it matters |
| --- | --- | --- |
| Consent capture | Show the candidate consent screen, current-employer option and stored consent record. | Consent should be specific, visible and auditable. |
| Referee nomination | Show how candidates nominate, replace or restrict referees. | Prevents informal contact and current-employer mistakes. |
| Question governance | Show role-specific templates, approval workflows and version history. | Keeps checks consistent and job-related. |
| Sensitive information handling | Show guidance, disclaimers or recruiter escalation notes. | Reduces the chance that protected information enters decisions. |
| Source evidence | Show raw answers, transcripts, recordings or referee comments beside summaries. | Hiring teams need reviewable evidence, not black-box conclusions. |
| AI controls | Explain whether AI summarises, scores, flags or recommends. | Different AI uses carry different privacy and fairness risks. |
| Access controls | Show who can view, export, share or delete reports. | Reference data should not be open to everyone in the hiring stack. |
| Audit trail | Show timestamps for consent, invitation, completion, review and export. | Auditability supports internal review and dispute handling. |
| Retention | Show configurable deletion, archival or de-identification settings. | Reference records should not be retained indefinitely by accident. |
| Integrations | Show ATS trigger, report writeback and permission mapping. | Workarounds are where compliance controls often fail. |
| Data hosting and subprocessors | Provide documentation on hosting, subprocessors and security controls. | Buyers need to understand where candidate and referee data flows. |
| Candidate response path | Show how adverse or disputed information is escalated. | Serious feedback needs fair human handling. |

The best demos are operational. If a vendor can only show polished reports but not the consent, audit, retention and review paths, keep asking.

## Practical Examples for HR Teams

### Example 1: The Hiring Manager Wants a Backchannel Call

A hiring manager recognises a candidate's former workplace and wants to call a friend there. The recruiter should not let the call happen outside the process.

Better workflow:

- ask why the extra reference is needed;
- decide whether the reason is role-related;
- seek candidate consent or provide notice where appropriate;
- ask the same approved questions;
- record the source, relationship and reason;
- keep the output in the formal hiring record.

If the manager simply wants a "gut check", the answer should be no.

### Example 2: A Referee Raises a Vague Culture Concern

A referee says, "They were not a culture fit." That phrase is too vague to support a decision.

Better follow-up:

- "What specific work behaviour did you observe?"
- "Was it connected to a role requirement?"
- "Was feedback given at the time?"
- "Did the candidate improve?"
- "Is this relevant to the role we are hiring for?"

If the referee cannot provide observed, role-related examples, the comment should carry little weight.

### Example 3: A Referee Mentions Mental Health

A referee says the candidate had "stress issues". The recruiter should not ask for medical details or record speculative health commentary as decision evidence.

Better response:

- stop the medical line of discussion;
- ask whether any role-related performance requirement was not met;
- speak to HR or legal if there is a genuine safety or inherent-requirements question;
- discuss support or adjustment matters directly with the candidate where appropriate.

### Example 4: The Vendor Summary Sounds Too Certain

An AI-generated report says the candidate is "high risk" because one referee mentioned missed deadlines. The hiring team should inspect the source evidence.

Better review:

- read the referee's full response;
- check whether deadlines were core to the old role and the new role;
- compare with interview, work sample and other referee evidence;
- ask follow-up questions if the issue is relevant;
- document the human decision, not just the system label.

## How Skill Society Supports Safer Reference Checks

Skill Society is designed to make structured reference checking easier for hiring teams without turning the process into a black box.

Teams can use Skill Society to:

- collect candidate-led referee details in a controlled workflow;
- standardise question sets by role or hiring process;
- support asynchronous referee responses;
- keep source evidence available for recruiter review;
- help hiring teams identify strengths, concerns and follow-up areas;
- reduce reliance on informal calls and scattered notes;
- support human judgement instead of automated hiring decisions.

That matters because compliance controls only work when recruiters actually use them. The goal is not to add admin. It is to make the right process the default.

> **Need reference checks that are faster and easier to govern?** [Book a Skill Society demo](https://skillsociety.com.au/booking?utm_source=blog&utm_medium=cta&utm_campaign=reference-check-compliance-mid) to see how structured, reviewable reference evidence fits into your hiring workflow.

## Implementation Plan for TA and HR Leaders

Use this sequence when tightening reference check compliance:

1. **Map the current process.** Identify who contacts referees, where consent is captured, where notes are stored and how hiring managers use the output.
2. **Remove informal channels.** Ban reference notes in personal documents, messaging apps and unmanaged inbox threads.
3. **Define consent rules.** Separate normal nominated references, current-employer contact and non-nominated references.
4. **Standardise templates.** Build role-family question sets tied to selection criteria.
5. **Train recruiters and managers.** Focus on protected attributes, sensitive information, backchannel risks and escalation.
6. **Set review thresholds.** Decide what feedback can be handled by recruiters and what must go to HR, legal or risk.
7. **Configure retention and access.** Make sure records are not kept longer or shared wider than policy permits.
8. **Review vendor controls.** Check AI use, data hosting, audit trails, deletion, exports and subprocessors.
9. **Audit a sample.** Review completed checks quarterly for consent, relevance, consistency and decision quality.

This is also a useful procurement scorecard. If a tool cannot support these steps, it may create more risk than it removes.

## FAQ

**Q: What makes a reference check compliant in Australia?**  
**A:** A compliant reference check is consent-led, transparent, role-related, consistent, privacy-aware, documented and reviewed by humans. Exact obligations depend on the employer, role, jurisdiction and data involved, so get legal advice for sensitive or regulated hiring.

**Q: Do candidates need to consent before referees are contacted?**  
**A:** A conservative process should capture clear candidate consent before contact, especially for current employers or non-nominated referees. Consent should be specific enough that the candidate understands who may be contacted and how the information will be used.

**Q: Can an employer contact a current manager without permission?**  
**A:** This is high risk and should generally be avoided unless there is a clear, lawful and documented basis. Most hiring teams should capture a separate current-employer permission field and respect candidate restrictions.

**Q: Are backchannel references illegal?**  
**A:** The answer depends on the circumstances, but they are risky. They can undermine consent, privacy, fairness and consistency. If an organisation permits them, they need strict policy controls, candidate notice or consent where appropriate, and a formal record.

**Q: What reference check questions should employers avoid?**  
**A:** Avoid questions about protected attributes or personal matters, including age, health, disability details, pregnancy, family responsibilities, religion, political views, union activity or personal life. Ask about observed, job-related behaviour instead.

**Q: Can reference check software guarantee compliance?**  
**A:** No. Software can support compliance through consent capture, templates, audit trails, access controls and retention settings, but employers still need sound policy, training and human review.

**Q: Is AI safe to use in reference checking?**  
**A:** AI can help organise or summarise evidence, but it should not replace human judgement. Buyers should confirm how personal information is processed, whether source evidence remains reviewable, how errors can be corrected and whether candidates or referees receive appropriate notice.

**Q: How long should reference check records be kept?**  
**A:** There is no single retention period for every employer. Set a policy based on legal, privacy, operational and dispute-handling requirements, then configure systems so records are archived, deleted or de-identified when no longer needed.

## Ready to Make Reference Checks Easier to Govern?

If your current process relies on informal calls, inconsistent scripts and scattered notes, the compliance risk is operational. [Book a Skill Society demo](https://skillsociety.com.au/booking?utm_source=blog&utm_medium=cta&utm_campaign=reference-check-compliance-final) to see how structured reference checks can give recruiters faster evidence, clearer records and stronger human review.

## Sources

- [OAIC: Agency referee reports](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/government-agencies/agency-referee-reports)
- [OAIC: Consent to the handling of personal information](https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/consent-to-the-handling-of-personal-information)
- [OAIC: APP 3 collection of solicited personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-3-app-3-collection-of-solicited-personal-information)
- [OAIC: APP 6 use or disclosure of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-6-app-6-use-or-disclosure-of-personal-information)
- [OAIC: Employee records exemption](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/employee-records-exemption)
- [OAIC: Guide to securing personal information](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-securing-personal-information)
- [OAIC: Guidance on privacy and the use of commercially available AI products](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)
- [OAIC: Australian Community Attitudes to Privacy Survey 2023](https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023)
- [Fair Work Ombudsman: Protection from discrimination at work](https://www.fairwork.gov.au/employment-conditions/protections-at-work/protection-from-discrimination-at-work)
- [business.gov.au: Guide to hiring employees](https://business.gov.au/guide/hiring-employees)
- [JobAccess: Interviewing people with disability](https://www.jobaccess.gov.au/i-am-an-employer/hire-someone-disability/interviewing-people-disability)
- [Australian HR Institute: Will checking character references really help you find the best candidate for a job?](https://www.ahri.com.au/articles/checking-character-references-candidate)