Un recruteur ne peut pas contacter un ancien employeur sans respecter le RGPD et le principe de transparence.
In Luxembourg, the Labour Code and data protection legislation strictly regulate the taking of references.
It is possible to negotiate a non-disparagement clause when leaving a job to secure future references.
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
Block quote
Ordered list
Unordered list
Bold text
Emphasis
Superscript
Subscript
Reference checks involve a recruiter contacting a former employer to obtain information about a candidate's skills, professional conduct or reliability. This is a common practice in recruitment processes, particularly for positions of responsibility or in regulated sectors.
The fundamental principle laid down by the General Data Protection Regulation (GDPR) is clear. Article 5 of Regulation (EU) 2016/679 stipulates that data must be ‘collected for specified, explicit and legitimate purposes’. Article 6 specifies that processing is only lawful if it is based on a legal basis, in particular ‘the consent of the data subject’ or a duly justified legitimate interest.
The European Data Protection Board also points out that consent must be ‘freely given, specific, informed and unambiguous’ (Guidelines on consent under Regulation 2016/679). In other words, a recruiter cannot contact your former employer informally and without informing you.
In Luxembourg, the GDPR is supplemented by the Law of 1 August 2018 on the protection of individuals with regard to the processing of personal data.
The National Commission for Data Protection (CNPD) thus points out that ‘all processing of personal data must have a legal basis and comply with the principles of proportionality and transparency’.
In the context of recruitment, these principles mean that the candidate must be informed of the collection of their data, that the information collected must be relevant and necessary, and that no excessive data or data unrelated to the position may be collected.
The Luxembourg Labour Code also regulates the pre-contractual phase. Article L.121-6 stipulates that the information requested from the candidate must have ‘a direct and necessary link with the job offered’. Contacting a former employer without informing the candidate could therefore be considered non-transparent and disproportionate data collection. In practice, the correct approach is for the recruiter to seek the candidate's explicit consent before making any reference checks.
In 2026, the most secure legal basis remains the explicit consent of the candidate. Some employers invoke ‘legitimate interest’ (Article 6(1)(f) of the GDPR), which authorises processing that is ‘necessary for the purposes of the legitimate interests pursued by the controller’. However, this interest must be balanced against the fundamental rights and freedoms of the candidate.
Contact made without the candidate's knowledge could be considered a violation of their rights, especially if they are still employed. During the recruitment phase, the potential imbalance between employer and candidate requires particular vigilance. Implicit or presumed consent is therefore not sufficient.
When leaving a company, some employees wish to anticipate future references and protect their professional reputation.
Under Luxembourg law, Article 1134 of the Civil Code states that ‘legally formed agreements are binding on those who have entered into them’. In other words, it is legally possible to negotiate, in a termination agreement or settlement agreement, a non-disparagement clause binding the parties not to make prejudicial statements about each other.
The principle of contractual loyalty also applies after the end of the contract. Luxembourg case law reminds us that freedom of expression is limited by abuse of rights and wrongful disparagement (established case law of the Court of Appeal in matters of civil liability).
Furthermore, Articles 1382 and 1383 of the Luxembourg Civil Code establish civil liability in the event of fault. The communication of false or excessively negative information when providing references could render the former employer liable.
However, a non-disparagement clause cannot compel an employer to provide a positive or false reference. Its sole purpose is to prohibit malicious, inaccurate or disproportionate comments.
In practice, this clause can be negotiated during a mutual termination, as part of a settlement, or in a departure agreement. Even in the absence of a specific clause, a former employer cannot legally make defamatory or false statements.
In the event of a breach of the GDPR, Article 83 of the Regulation provides for fines of up to ‘€20,000,000 or, in the case of a company, up to 4% of total worldwide annual turnover’.
In Luxembourg, the CNPD can be contacted by anyone who believes that their data has been processed illegally. A candidate could also claim moral damages if unauthorised contact compromises their professional situation.
In 2026, a future employer cannot contact your former employer without complying with a strict legal framework. The GDPR, the Luxembourg law of 1 August 2018 and the Labour Code require transparency, proportionality and a clear legal basis.
Reference checks are legal, but they must be regulated. For candidates in Luxembourg, knowing their rights allows them to protect their professional reputation and approach the recruitment process with greater peace of mind.
To secure your application:
If in doubt, you can consult the resources made available by the CNPD.
