Consent and GDPR when you refer a client onward

It is easy to think of a referral as a friendly gesture rather than a legal event, but from a data protection standpoint it is unambiguous: you are disclosing personal data about an identifiable person to a third party. Under the UK GDPR and the Data Protection Act 2018, that disclosure needs a lawful basis, and the client needs to understand what is happening to their information.

This applies even when the details are modest. A name, a phone number, and a note that the person is exploring their retirement options together identify an individual and reveal something about their circumstances. The obligation does not depend on the volume of data; it depends on the fact that the data is personal and is being shared. Treating every referral as a data transfer from the outset keeps you on solid ground.

UK data protection law recognises several lawful bases for processing. In a referral context, the two most relevant are usually consent and, in some situations, legitimate interests. Consent is the cleanest and most transparent: you ask the client, they agree, and you record it. It fits the referral scenario naturally because the client is an active participant who wants the introduction to happen.

• Consent: the client freely and clearly agrees to their details being shared
• Legitimate interests: relied on only after a proper balancing assessment, and never where it overrides the client's rights
• Transparency: whatever the basis, the client is told what is shared and with whom

For most professional referrals, freely given, specific, informed consent is both the safest basis and the one that best matches the spirit of an introduction the client actively wants.

Consent under the UK GDPR must be freely given, specific, informed, and unambiguous. In plain terms, the client must genuinely agree, know exactly what they are agreeing to, and do so through a clear affirmative act rather than silence or a pre-ticked assumption. For a referral, that means telling them which category of firm you will share their details with and for what purpose, then getting their clear agreement.

You do not need legalistic language. A clear explanation that you would like to pass their name and contact details to a vetted, regulated advice firm so that firm can contact them about the matter in hand, followed by the client saying yes, meets the standard, provided you record it. Avoid bundling the referral consent into unrelated permissions; specific consent means the client is agreeing to this transfer, not to a vague catch-all.

Two further principles shape a clean referral: data minimisation and purpose limitation. Minimisation means you share only what the receiving firm actually needs to make contact and understand the context, not your entire file on the client. Purpose limitation means the data is shared for the introduction, and the receiving firm should use it for that, not for unrelated marketing.

In practice, resist the urge to forward everything. The specialist does not need years of history to place a first call; a name, contact details, and a short description of what the client is looking for are usually enough. Sharing less reduces your risk, respects the client, and keeps the transfer proportionate to its purpose. If the receiving firm needs more later, the client can provide it directly once the relationship is established.

Consent that is not recorded is difficult to prove, so keep a note of what the client agreed to and when. A dated line in the file, or a short written confirmation the client acknowledges, is enough to evidence that the transfer was lawful. A well-run referral network will often build this record into its process so it happens by default.

Finally, remember that the client retains rights over their data. They can ask what you hold, ask you to correct it, and in many circumstances withdraw their consent to further processing. Withdrawing consent does not undo a transfer that already happened lawfully, but it should stop further sharing. Making it easy for a client to change their mind is not just a legal nicety; it is part of treating them fairly. When consent is clear, minimal data is shared, and everything is recorded, the referral is lawful, the client is respected, and you are protected.