Under the GDPR, workforce health data is special category data: processing it is prohibited unless one of the conditions in Article 9 applies, and it is lawful only with a lawful basis under Article 6 as well. Two conditions are written with work in mind: obligations under employment, social security and social protection law (Article 9(2)(b)), and occupational medicine and the assessment of working capacity under professional secrecy (Article 9(2)(h) and 9(3)).

As the UK regulator puts it, these rules do not prevent the processing of health information; they limit when it can happen. This is general information, not legal advice.

What counts as workforce health data

The GDPR defines data concerning health as personal data related to a person’s physical or mental health, including the provision of health care services, that reveal information about their health status (Article 4(15)). Recital 35 adds test and examination results, and information on a disease, disability, disease risk, medical history or clinical treatment, whatever its source.

At work, the ICO’s guidance on workers’ health information lists health questionnaires, sickness absence forms, disability details, eye test results for display screen users, blood tests for work with hazardous substances, drug and alcohol test results, fitness-to-work assessments and vaccination records.

Two boundaries matter:

  • Every identifiable person is covered. Personal data is any information relating to an identified or identifiable natural person (Article 4(1)), so contractors’ health data is protected too. See contractor health records.
  • Anonymous data is outside the GDPR. Recital 26 excludes information rendered anonymous so that the person is no longer identifiable. Pseudonymized data that can be attributed to a person with additional information is still personal data.

Processing health data needs a condition under Article 9(2), which lifts the prohibition, and a lawful basis under Article 6(1). Recital 51 says the general rules on lawful processing should still apply to special category data.

The Court of Justice of the EU confirmed the double test in case C-667/21 on December 21, 2023: processing based on Article 9(2)(h) must also satisfy at least one condition of Article 6(1). In the UK, since August 20, 2025, UK GDPR Article 9(2) lifts the prohibition only if the processing is based on Article 6(1) and a condition applies, wording added by the Data (Use and Access) Act 2025.

For employment, the ICO names contract (occupational sick pay), legal obligation (statutory sick pay, injury reporting under RIDDOR), legitimate interests and, in life-or-death cases, vital interests as the likely Article 6 bases.

The Article 9 conditions employers use

Employment, social security and social protection law

Article 9(2)(b) covers processing necessary to carry out the obligations and exercise the specific rights of the employer or the worker in employment, social security and social protection law. It applies only as far as EU or member state law, or a collective agreement under member state law, authorizes it with appropriate safeguards, so its reach depends on national law.

The ICO says this condition does not cover purely contractual employment rights or obligations; its examples of what it does cover include ensuring the health, safety and welfare of employees (ICO, conditions for processing). In the UK, paragraph 1 of Schedule 1 to the Data Protection Act 2018 also requires an appropriate policy document. Under paragraphs 39 and 40 it explains compliance with the UK GDPR principles and its retention and erasure policies, and is kept until six months after the processing stops.

The CNIL, France’s data protection authority, gives a work accident example in its HR reference framework: the declaration states the nature and site of the injuries, which is health data, and the employer may process it under Article 9(2)(b).

Occupational medicine under professional secrecy

Article 9(2)(h) covers processing necessary for preventive or occupational medicine, the assessment of the working capacity of the employee, medical diagnosis and health or social care, on the basis of EU or member state law or under a contract with a health professional. Article 9(3) requires the data to be processed by or under the responsibility of a professional bound by professional secrecy, or by another person under an obligation of secrecy.

In the UK, section 11 of the DPA 2018 says this includes a health or social work professional, or another person who owes a duty of confidentiality under an enactment or rule of law.

The C-667/21 judgment adds two points. Article 9(2)(h) can apply when a medical examination body processes the health data of one of its own employees, acting not as employer but as a medical service, to assess that employee’s working capacity, provided the conditions of Article 9(2)(h) and 9(3) are met. And Article 9(3) does not, by itself, require the controller to ensure that no colleague of the worker can access the data, although national rules under Article 9(4), or the integrity and confidentiality principle (Article 5(1)(f)) and security rules (Article 32), can impose that duty.

In France, Article L4624-8 of the Labor Code provides for an occupational health medical record compiled by the occupational physician, or another health professional of the occupational health team, in compliance with medical secrecy. The worker may ask to receive it.

Explicit consent is an Article 9 condition (Article 9(2)(a)), but a weak one at work. Recital 43 says consent should not be a valid legal ground in a specific case where there is a clear imbalance between the person and the controller, and the EDPB says such an imbalance also occurs in employment. The European Data Protection Board says that for most processing at work, the lawful basis cannot and should not be employees’ consent, which they can give freely only in exceptional circumstances, when refusing has no adverse consequences (Guidelines 05/2020, paragraphs 21 and 22).

Who holds what

Regulators’ guidance points to a general split: as far as possible, outcomes travel and clinical detail stays with health professionals.

Data Usually held by What the sources say
Sickness absence evidence for statutory sick pay (UK) HR The ICO places statutory sick pay under the employment condition, Article 9(2)(b)
Work accident declarations, including the nature of the injury (France) HR or HSE The CNIL’s example of processing under Article 9(2)(b)
Fitness-to-work outcomes and proposed adjustments HR and managers The CNIL lists visit dates, fit or unfit decisions and the physician’s adjustment proposals as HR data; the ICO says managers typically need only current or likely future fitness to work
Exam results, health surveillance results, diagnoses Occupational health professionals Article 9(2)(h), with the professional secrecy safeguard of Article 9(3)
Health trends by site or exposure group Leadership Outside the GDPR once truly anonymous (Recital 26)

The ICO says that, as far as possible, access to information on medical conditions should be limited to health professionals such as doctors and nurses, and that health information could be kept on a separate database or system, or behind separate access controls. With an occupational health provider, the ICO says the provider is likely a controller in its own right and the manager should be told only the results of the health assessment. For the same split under US rules, see employee health records vs personnel files.

The principles that shape every use

The ICO’s guidance shows what the Article 5 principles mean in practice:

  • Purpose limitation. Reuse health data only for a compatible purpose, with specific consent, or where a clear legal obligation applies.
  • Data minimization. Collect no more than needed, ask targeted questions rather than request full medical records, and do not collect data on the chance it may be useful later.
  • Storage limitation. The GDPR sets no fixed period: set retention schedules, subject to other legal duties for employment and health and safety records. See how long to keep occupational health records.
  • Integrity and confidentiality. Article 32 requires security appropriate to the risk, including, as appropriate, pseudonymization and encryption; the ICO adds need-to-know access.
  • Transparency. Tell workers what health data is collected, why, and who can access it.
  • Accountability. The employer must be able to demonstrate compliance (Article 5(2)), and its record of processing (Article 30(1)) lists purposes, categories, recipients and, where possible, erasure time limits.

When a DPIA is needed

Article 35(1) requires a data protection impact assessment (DPIA) before processing likely to result in a high risk, and Article 35(3)(b) requires one for large-scale processing of special category data. The DPIA guidelines endorsed by the EDPB (WP248 rev.01) list nine criteria. Two describe workforce health data: sensitive data, which includes Article 9 data, and data concerning vulnerable data subjects, a category that names employees. In most cases, the guidelines say, a controller can consider that processing meeting two criteria requires a DPIA. The ICO says employers should carry out a DPIA for workers’ health information.

Multi-country employers

Article 9(4) lets member states maintain or introduce further conditions, including limitations, for health data, and Article 88 lets them set more specific rules for employees’ data, including for health and safety at work. The UK has its own regime, and the ICO says its guidance cited here is under review due to changes made by the Data (Use and Access) Act 2025. Sending health data to a third country is allowed only under the transfer conditions of Chapter V (Article 44).

A working checklist:

  1. Map health data by site and purpose: who holds it, the Article 6 basis, the Article 9 condition and, in the UK, the Schedule 1 condition. Include contractors.
  2. Keep clinical detail with health professionals. Fitness-to-work outcomes and work restrictions reach HR and managers; results and diagnoses stay with the health team.
  3. Set access by role and keep a trail. The CNIL asks for access authorizations to be documented and access to be traceable.
  4. Run a DPIA before rolling out a new health record system.
  5. Set retention by country, keeping the longest period that applies to each record.
  6. Check national law wherever Article 9(4) or Article 88 rules apply.

This is the model MyC is built on: one health record per worker, employees and contractors alike. Authorized health professionals work in the full record, while HSE, HR and managers see only what their responsibilities require, such as fitness decisions and work restrictions, without medical details. Every access is logged, health data is encrypted at rest and in transit on secure cloud servers, and MyC supports GDPR and HIPAA compliance. See the occupational health EHR or book a demo. For US sites, read does HIPAA apply to employee health records.

Questions

Is workers’ health data special category data under the GDPR?

Yes. Data concerning health is one of the special categories in Article 9(1). The ICO counts sickness absence forms, fitness-to-work assessments and drug and alcohol test results among workers’ health information.

Rarely. The EDPB says employees can give free consent only in exceptional circumstances. Two conditions are written for the workplace instead: employment law obligations (Article 9(2)(b)) and occupational medicine under professional secrecy (Article 9(2)(h)). Either needs an Article 6 basis as well.

Can HR see occupational health records?

Generally not the clinical content. The ICO says access to medical conditions should, as far as possible, be limited to health professionals, and that an occupational health advisor should tell the manager only the results of a health assessment. A manager may sometimes need more to protect the worker or others.

Do employers need a DPIA for workforce health data?

Often. Article 35(3)(b) requires one for large-scale processing of health data, and the ICO says employers should carry one out for workers’ health information.

Sources

  1. Regulation (EU) 2016/679 (GDPR): Articles 4, 5, 6, 9, 30, 32, 35, 44 and 88, Recitals 26, 35, 43 and 51
  2. Court of Justice of the EU, case C-667/21, Medizinischer Dienst der Krankenversicherung Nordrhein, judgment of December 21, 2023
  3. EDPB Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1
  4. Article 29 Working Party: Guidelines on data protection impact assessment (WP248 rev.01), endorsed by the EDPB
  5. EDPB: Endorsed WP29 guidelines
  6. UK GDPR Article 9: Processing of special categories of personal data
  7. Data Protection Act 2018, section 11: Special categories of personal data etc: supplementary
  8. Data Protection Act 2018, Schedule 1: Special categories of personal data and criminal convictions etc data
  9. ICO: Data protection and workers' health information
  10. ICO: What are the conditions for processing? (special category data)
  11. ICO: What if we use occupational health schemes?
  12. CNIL: Référentiel relatif aux traitements de données à caractère personnel mis en œuvre aux fins de gestion du personnel (2019, amended 2022)
  13. French Labor Code, Article L4624-8: Occupational health medical record

Written by Lisa Bardet, VP Marketing at MyC. Every factual claim in this article is checked against primary sources, such as regulations, regulators and peer-reviewed studies, in three passes before publication, and the sources are listed above.

This article is general information for employers and occupational health teams. It is not legal or medical advice for a specific situation.