Health Data & GDPR
Which health data may HR analyze — and what does the GDPR prohibit?
Under German law, health data analysis falls under Art. 9 GDPR. For WHP analyses, only fully anonymized data is permitted (e.g., statutory health insurer reports). Individual medical certificates are strictly off-limits for HR analytics; HR may record the bare number of sick days only for administrative purposes such as the BEM deadline.
Permitted vs. prohibited data sources in WHP
| Data Source | GDPR Status | Correct Use in WHP |
|---|---|---|
| Individual medical certificates (sick notes) | Strictly prohibited for HR analytics | Remain in the personnel file — for administrative purposes only |
| Statutory health insurer reports | Permitted — if anonymized | From the minimum number of insured employees set by the insurer: GDPR-compliant basis for the annual plan |
| Scientifically validated employee surveys | Permitted — with the right safeguards | Anonymous external tool, no IP address storage, participation communicated as explicitly voluntary |
| Internal sick-leave statistics (aggregated, anonymous) | Permitted | HR may analyze cross-department rates — never at the individual level |
| Diagnoses from medical certificates | Strictly prohibited | Diagnoses do not belong in the HR file — not even “just for information” |
Why Do Rising Sick Leave Rates Put HR Under Pressure?
Note: this guide explains requirements under German and EU data protection law. When sick leave rates climb, management demands immediate answers. Understandable — but the reflex to dig deeper into personnel data leads straight into a GDPR trap. Art. 9 GDPR classifies health data as a special category, giving it the highest protection level under European data protection law.
HR managers who inadvertently handle sick-note diagnoses, or who create demographic breakdowns fine-grained enough to identify individuals, risk fines of up to €20 million or 4% of global annual revenue — whichever is higher.
The GKV Prevention Guideline (German statutory health insurance) requires, as a condition for support from the health insurers, that health promotion measures are based on an analysis of the current situation (Leitfaden Prävention 2025, ch. 6.2.2). This analysis should be GDPR-compliant and based on anonymized data. Anyone who misunderstands this and starts cataloguing the causes of individual employees' illnesses not only breaches the GDPR but also loses the basis for working with the insurer.
Which Analysis Tools Are Permitted?
Statutory health insurer reports: under Section 20b SGB V (German law), health insurers are tasked with supporting workplace health promotion and, in doing so, assessing the health situation in the company — this includes anonymized health reports. These show aggregated absences, diagnosis groups (by ICD-10 chapter), and workload hotspots without identifying individuals. The hurdle: each insurer decides how many of its insured employees it needs in the company before it issues a report — ask your insurer. For smaller companies, some insurers offer alternative solutions.
Workplace health surveys: Scientifically validated survey instruments such as the COPSOQ (psychosocial workload), SALSA (resources), or a company-adapted short questionnaire are a central tool for the baseline analysis. They comply with data protection law under three conditions: (1) complete anonymity with no IP address storage, (2) explicit voluntariness communicated before the survey, (3) results evaluated only in aggregate for groups of 5 or more people.
Aggregated sick-leave rates: HR may calculate cross-department absence rates and present them to the steering committee. The limit is identifiability: common practice is not to report departments with fewer than 5 people separately — there is no fixed legal number, and works agreements often set a higher minimum size. This also applies to seemingly harmless combinations like “Department X in Q3.”
How Do You Check a Survey for Data Protection Before Sending It?
Before an employee survey goes out, this quick check is recommended:
Check 1 — Re-identification test: Could demographic questions (department + age + gender) combine in small groups to identify individuals? Do not evaluate groups of fewer than 5 people separately (common minimum size, not a legal figure).
Check 2 — Voluntariness clause: Does the survey's landing page clearly state that participation is voluntary and that no IP addresses or timestamps are stored?
Check 3 — Purpose-limitation proof: Is it contractually and technically ensured that the data is used exclusively for WHP measure planning and then deleted? Linking it to performance reviews is a serious GDPR violation.
What to Do When Managers Ask About Diagnoses
A real-world scenario: a department head asks in the steering committee meeting why “everyone in logistics always seems to be sick.” HR feels pressure to provide concrete answers. The right response is not to pull individual sick-leave data, but to channel the question toward the permitted analysis tools.
In practice: the Health Working Group commissions a short analysis using aggregated data. If available, the relevant insurer's sick-leave report is pulled. If not, a voluntary, anonymous flash survey within the department (respecting the minimum group size) can provide initial indications.
What HR can say: “We look at the department's anonymized absence rates and compare them to the previous year. We don't look at individual data — that's not permitted under data protection law, and it isn't our goal anyway. The goal is to understand workload, not the causes of individual employees' illnesses.”
Related measures & topics
Key takeaways
- Under German data protection law, individual sick-note diagnoses are off-limits for HR analytics — not even “just for information.”.
- Statutory health insurer sick-leave reports (from the minimum number of insured employees set by the insurer) are a privacy-friendly analysis tool.
- Surveys require: anonymity, voluntariness, purpose limitation, and works council involvement.
- Do not evaluate groups of fewer than 5 people individually — a common minimum size, often set in a works agreement.
Frequently asked questions
May HR track the number of sick days per employee?+
Yes — under German law, the raw number of sick days (without diagnosis) may be recorded for administrative reasons, e.g., for BEM monitoring (§ 167 SGB IX requires tracking the 6-week threshold). However, this data may not be used for performance reviews or for analysis purposes beyond the BEM trigger.
What health data may the works council access?+
The works council (Betriebsrat) has a general right to information (§ 80 BetrVG), but it, too, has no claim to individual diagnosis data. It can request aggregated absence statistics. The works council takes part in an individual BEM procedure only with the consent of the person concerned (Section 167(2) SGB IX); it does, however, monitor that the employer offers BEM.
Do we need the works council's approval for the health insurer survey?+
As a rule, yes. Under German law, if the survey runs on a technical system (e.g., an online tool), co-determination under Section 87(1) No. 6 BetrVG (technical equipment) applies; a standardized questionnaire may also require approval as a personnel questionnaire under Section 94 BetrVG. Without the works council's approval, it can demand that the survey be stopped. Involving the works council is not an obstacle, though — it typically strengthens the workforce's acceptance of the survey considerably.
Can we conduct a well-founded baseline analysis without a statutory health insurer report?+
Yes. For companies below the reporting threshold, a combination of aggregated internal sick-leave rates (HR monitoring), workplace walkthroughs by the company physician, and a voluntary flash survey is recommended. This combination provides a solid analysis of the current situation even without a health insurer report.
Analyze Health Data — the Right Way
EasyWHP aggregates absences, BEM triggers, and measures — without HR ever seeing individual diagnosis data.
Sources
- Art. 9 GDPR — Processing of Special Categories of Personal Data (Health Data) ↗
- Section 20b SGB V — Workplace health promotion: the health insurers' mandate ↗
- § 167 (2) SGB IX — BEM Obligation: Sick-Day Tracking as a Legally Permitted Basis ↗
- § 87 BetrVG — Co-Determination in Employee Surveys (No. 6: Technical Equipment) ↗
- § 80 BetrVG — General Duties of the Works Council (Right to Information) ↗
- Section 94 BetrVG — Personnel questionnaires (works council approval) ↗
- GKV-Spitzenverband: Leitfaden Prävention 2025 (ch. 6.2.2, funding criteria) ↗
Last updated: 2026-06-24. Not legal or tax advice — have your specific case reviewed by a professional.