Glossary

Glossary: reference checking, GDPR and recruitment

Clear definitions of the terms you encounter in reference checking and Norwegian recruitment. Updated against current GDPR, the Norwegian Personal Data Act and guidance from the Norwegian Data Protection Authority.

Reference check

The process where an employer contacts a job applicant's former colleagues or managers to verify experience, competencies and suitability before hiring. In Norway this is a voluntary but widespread step in recruitment — and a statutory suitability assessment in the healthcare sector.

Automated reference check

Digital reference checking where questionnaires are sent out, answers collected and a summary report generated automatically — without manual phone calls. Reduces time spent from hours to minutes per candidate.

AI report

An automatically generated summary report of reference answers, typically with scores per competency area (collaboration, reliability, communication), strengths, development areas and an overall recommendation.

Candidate

The person applying for or being considered for a position, on whose behalf the reference check is performed. The candidate must give consent before referees are contacted.

Referee (reference)

Former manager, colleague or direct report who answers questions about the candidate. The referee must be informed about how their answers are used and stored.

Consent

Voluntary, informed and specific acceptance from candidate (and referee) that personal data may be processed. Under GDPR art. 7 the consent must be documented and revocable at any time.

Vipps login

Norwegian login via the Vipps app used for identity verification. Used in Referansio to confirm that the recruiter is who they claim to be — building trust with referees. In development.

GDPR

The EU General Data Protection Regulation, implemented in Norway through the Personal Data Act (personopplysningsloven). Requires a legal basis, information duty and technical safeguards when processing personal data.

Norwegian Personal Data Act

The Norwegian law implementing GDPR. The supervisory authority is the Norwegian Data Protection Authority (Datatilsynet). Applies to all processing of personal data about identifiable persons in Norway.

Legal basis

Under GDPR art. 6, all processing of personal data must have one of six legal bases. For reference checks the most common are consent (a) or legitimate interest (f).

Legitimate interest

Legal basis under GDPR art. 6(1)(f) — the employer's interest in verifying the candidate's suitability before hiring. Requires a balancing test against the candidate's interests and rights.

Data controller

The party (typically the employer or recruitment agency) that determines the purpose and means of processing personal data. Holds primary responsibility under GDPR.

Data processor

The party that processes personal data on behalf of the data controller — such as Referansio for its customers. Requires a Data Processing Agreement (DPA).

Data Processing Agreement (DPA)

Written agreement between data controller and data processor under GDPR art. 28. Regulates purpose, duration, security measures and sub-processors.

Retention deadline

The point at which personal data must be deleted after the purpose has been fulfilled. For reference data, a maximum of 12 months after the recruitment closes is recommended.

Suitability assessment

Statutory assessment under the Norwegian Health Personnel Act §4 of the candidate's suitability. The reference check is a central part of this assessment in the healthcare sector.

Qualification principle

Public-sector principle that the best-qualified applicant must be hired. Requires comparable documentation — which is why structured reference checks matter.

Police certificate

Norwegian document showing registered criminal offences. Statutory for certain positions (healthcare §20a, schools, child welfare). Does not replace reference checks — it is complementary.

White-labelled report

PDF report with the customer's (the recruitment agency's) logo and sender details — instead of the platform's. Used to deliver reference checks under your own brand.

ATS (Applicant Tracking System)

Software for managing recruitment processes — for example Teamtailor, Recman or Webcruiter. Referansio's ATS integration is in development.

AI voice agent

AI that calls the referee, conducts the conversation verbally and transcribes the answers automatically. Available on Referansio's Premium plan.

Behavioural question

Open question asking the referee to describe a concrete situation — for example «Describe a situation where the candidate handled conflict». More informative than yes/no questions.

Halo effect

Cognitive bias where one positive (or negative) impression colours the entire assessment. Reduced by using a scale per competency area and multiple referees.

Response rate

Share of invited referees who actually answer the questionnaire. On Referansio, typically 80–90% within 3 days with automatic reminders.

Datatilsynet

The Norwegian Data Protection Authority. Provides guidance, handles complaints and can impose fines for breaches of GDPR / the Norwegian Personal Data Act.

Lovdata

Norwegian database of laws, regulations and court rulings. Central source for verifying the current legal framework around recruitment and data protection.