I have been asked several times since GDPR and the DPA 2018 came into force how this will affect confidential references, both given and received.
Under the DPA 1998 an exemption allowed confidential reference to be exempt from the disclosure but this applied to references given and not those received, therefore an employee was able to access a reference by making a request to the employer that received the reference.
This right has been removed in the 2018 Act as now confidential references can be withheld from a SAR by both the author and recipient of the reference. Of course, an employer can still choose to disclose a reference. If they do they will need to be careful not to disclose information about the person who wrote the reference, or any other third party, unless those individuals have consented to the disclosure or it can considered reasonable to disclose without their consent.