Employee health data and the GDPR: what may an employer record?

VerumVault AVG · Francesco Zerbonia · 19 October 2026

Data about employees' health is among the most sensitive information in any organisation. The GDPR classes it as special category data (Article 9 GDPR) and in principle prohibits processing it. Yet an employer must be able to support a sick employee. Where is the line? And how do you discuss an absence case without breaching someone's privacy?

The general rule

An employer may only process health-related data where an exception in Article 9 applies, for example obligations in employment and social security law, and only as far as necessary. Member States may set more specific rules for the employment context (Article 88 GDPR). In practice, employers almost everywhere need far less than they think: whether someone is unfit for work, for how long, and what they can still do.

Examples from three countries

Netherlands: according to the Dutch Data Protection Authority, an employer may ask for and record only a limited set of data on a sick note, such as contact details, the expected duration, ongoing work and appointments, and whether the absence relates to a work accident or a traffic accident with a liable third party. The diagnosis and the nature of the illness are for the company doctor only.
Germany: the employer's version of the incapacity certificate (now electronic, the eAU) does not show the diagnosis. Employees are generally not obliged to tell their employer what they are suffering from.
Italy: with the online medical certificate, the employer receives a certificate of incapacity without the diagnosis.

Discussing absence cases without privacy risk

HR staff and managers sometimes want to put a case to a colleague, an adviser, a peer group or an AI assistant, for example to prepare a conversation or draft a letter. The rule: don't share data that can be traced back to the employee unless necessary.

Replace name, staff number, department and town with labels.
Leave out medical details; describe only what is functionally relevant ("cannot lift heavy loads for now").
Watch out for indirect identifiers, such as a unique job or a striking date. More in Pseudonymisation or anonymisation.
Never paste an absence file unchanged into an AI chatbot. Regulators have warned about breaches caused this way; see Using ChatGPT under the GDPR.

Tip: with VerumVault you replace names, addresses, phone numbers and other numbers in a letter or meeting note with labels such as [PERSON_1], locally. Check yourself whether any health information remains that doesn't belong there, and remove it.

Storage and security

Permitted absence data must also be properly secured (Article 32 GDPR) and kept no longer than necessary. Limit access to the people who really need it. If something goes wrong, for example an absence overview sent to the wrong colleague, it may be a reportable breach; read Reporting a data breach.

Frequently asked questions

May my employer ask what illness I have?

As a rule, no. In many EU countries, including the Netherlands, Germany and Italy, the diagnosis is not shared with the employer as standard; it stays with the doctor or company doctor.

Is health data special category data?

Yes. Data concerning health falls under Article 9 GDPR and gets extra protection.

May HR discuss an absence case with an adviser?

Yes, where necessary, but share as little identifiable and medical data as possible. Anonymise or pseudonymise the case first.

How do I anonymise an absence case?

Replace names, numbers and places with labels, leave out medical details and check for indirect identifiers. VerumVault does the first step locally in your browser.