There is no legal obligation on an employer to request a reference, although it is useful to at least obtain one reference from a former employer to verify work experience.
In order to adhere to GDPR and data protection laws you must get proper consent fromt the prospective employee to approach a referee and ensure you consent with your own data protection policy and privacy notice.
Before approaching a referee, you must obtain a written signed consent from the prospective employee. You may ask the referee to confirm:
You may also ask