GDPR-Compliant WHP Employee Survey

How do I run a WHP employee survey in compliance with GDPR — and what do I do with the results?

Note: this guide reflects German law. The GKV guideline explicitly names standardized employee surveys as a suitable instrument of the analysis phase (§ 20b SGB V) — a situation analysis is a funding condition, and the survey is one of several ways to get there. It must be fully anonymous (Art. 9 GDPR) and involve the works council (§ 87 BetrVG). As a guide for meaningful results, a participation rate of about 60% or more is considered reasonable; there is no standardized minimum rate.

Comparison of Survey Instruments

Instrument	Questions	Validation	Minimum Size	GDPR Note	Cost
COPSOQ (Short Form)	Depends on the version (short or standard)	Internationally validated, reference database available	Evaluation only for groups in which no one can be identified	Anonymous, document data flow (GKV requirement)	Questionnaire freely available; survey with evaluation by FFAW is fee-based
SALSA	61 questions (short form SALSA-K: 35)	German-Swiss validation, stress dimensions	Evaluation only for groups in which no one can be identified	Anonymous, no inference to individuals	Fee-based use (according to BGW)
WHO-5 Well-Being Index	5 questions	WHO standard, clinically tested	Evaluation only for groups in which no one can be identified	Fully anonymous, combinable	Free
Custom short questionnaire	10–15 questions	No external validation	Flexible	Describe data flows, involve co-determination bodies	In-house
Work Situation Analysis (health circle)	Moderated group format	Explicitly recommended by the GKV guideline	Groups of at most 10–15 people (Haufe)	No personally identifiable record, results summary anonymized	Moderation costs

Is an Employee Survey Mandatory in WHP?

Not as such: under § 20b SGB V, a situation analysis and the involvement of employees are funding conditions (ch. 6.2.2) — the survey is one way to meet them, alongside insurers' health reports, the risk assessment, and health circles. The GKV Prevention Guideline (December 2025 edition) explicitly names standardized surveys of employees on work and health as a suitable instrument in its analysis phase for identifying health risks and potentials.

The rationale is pragmatic: health-insurer wellness reports and absence statistics only show what has already gone wrong — they don't explain why. A valid employee survey provides indications of the causes: which stressors are linked to absences? Which departments need structural prevention measures first? Without this data, the steering committee is planning in the dark.

Participation is not an end in itself: employees who were involved during the analysis phase are more likely to notice measures during the implementation phase. Acceptance comes from involvement — that is the core logic of the GKV guideline, and also the often underestimated return of a survey.

Why Do Stricter GDPR Rules Apply to a Health Survey?

Health data falls under Art. 9 GDPR — a special category of personal data with heightened protection requirements. An employee survey on health, stress, and well-being is by definition processing of such data. Five requirements must be met before the survey is sent out (this section reflects requirements under German/EU data protection law):

Full anonymity: Do not store IP addresses or metadata that would allow identification. Choose external survey tools with servers located in Europe.
Communicate voluntariness explicitly: Participation is voluntary. This must be stated in the invitation and in the questionnaire itself — no indirect participation pressure from supervisors.
Data flow communication: The GKV guideline requires that data flows for web-based surveys be described — which data, where it goes, how long it is stored.
Scientific basis: for web-based surveys with feedback, it must be explained which scientific sources the feedback and recommendations are based on (GKV guideline, Chapter 7.2). A self-invented evaluation logic without validation does not meet this requirement.
Involve the works council: Before sending, not after. § 87 BetrVG already applies at the design stage of the instrument.

When Is a Survey Not Enough — and What Does a Health Circle Add?

An employee survey delivers quantitative data — it shows how many people suffer from time pressure, not why, and not what specifically should be done. The GKV guideline therefore explicitly complements surveys with participation-oriented methods: health circles, work situation analyses, and future workshops.

A health circle is a moderated small group that analyzes specific stressors over several meetings and develops proposed solutions — Haufe cites about 8 to 12 meetings in a group of at most 10 to 15 participants. The results feed directly into the steering committee's action plan as recommendations. The GKV guideline names health circles as a participatory analysis instrument (ch. 6.3.3).

Important for GDPR compliance: the health circle's results summary is anonymized — no statements attributed by name, no examples that could identify individuals. Moderation is ideally handled by someone outside the company (occupational physician, external WHP consultant) to ensure psychological safety.

What Co-Determination Rights Does the Works Council Have in the Survey?

Which co-determination right applies depends on the design: if the survey runs on an online tool, § 87 (1) no. 6 BetrVG (technical systems) is affected; if it is part of the risk assessment, § 87 (1) no. 7 BetrVG (health protection). Personal questionnaires additionally require the works council's consent under § 94 BetrVG. Whether § 87 (1) no. 1 (order in the company) is also affected depends on the individual case.

The GKV guideline explicitly requires that for web-based surveys, the relevant co-determination bodies be involved by those responsible for the company. In practice, this means: the works council receives the draft questionnaire for review, approves the procedure, and can request changes — before the first link is sent out.

In companies without a works council, the workforce should be involved through another participation format (e.g., a representative employee group in the steering committee). This is not a legal requirement but a recommendation from the GKV guideline for sustainable acceptance.

What Is the Most Common Mistake After a Survey — and How Do You Prioritize Measures?

The most common mistake after a survey: results are presented internally, everyone is affected — and then nothing happens for months. Trust and willingness to participate decline permanently.

The steering committee interprets and evaluates the survey results along two axes: urgency (how widespread is the burden?) and feasibility (can the company actually do something about it?). The intersection produces the priorities for the action plan per GKV guideline Chapter 6.3.4.

Communicating results is part of it: employees should learn soon after the survey closes what happens with their answers — which measures were adopted, which were not, and why. Silence after a survey is worse than no survey at all.

High + feasible: Immediate measures (0–3 months), e.g., flexible break times, eliminating noise hotspots
High + hard to implement: Medium-term structural measures (6–18 months), e.g., shift-model adjustments
Low + feasible: Quick wins with high visibility, e.g., fruit basket, walking group
Low + hard to implement: Park for later — reassess in the next WHP cycle

Quick check

What's your company's workplace-health maturity?

Your maturity level shows how far your measures already sit within a structured health promotion process. Under German tax law, such a process is one way for measures to be tax-free up to the allowance of €600 per employee per year (§ 3 No. 34 EStG) — only your tax advisor can confirm this. Answer in about 7 minutes, no sign-up.

Start maturity check (about 7 min.)

Related measures & topics

Key takeaways

Note: This guide reflects German law. Employee surveys are an instrument of the analysis phase named by the GKV guideline — without a documented situation analysis, insurers do not support measures under § 20b.
Art. 9 GDPR applies: full anonymity, describe data flows, no inference to individuals.
Involve the works council under § 87 BetrVG before sending — not after.
Guide value: participation of about 60% or more; with a lower response, read the results with caution and use health circles as a complement.
Report results back promptly — otherwise participation drops in the next cycle.

Frequently asked questions

From how many employees does a WHP employee survey make sense?+

There is no fixed lower limit. What matters is that every evaluated group stays large enough that no one can be identified — in small companies that often means one evaluation for the whole company, not by department. Where a survey yields too little, health circles are a participatory alternative.

Does the survey have to be conducted externally?+

Not strictly necessary, but recommended. External administration (e.g., by a health insurer or a survey provider) increases trust in anonymity and meets the GKV requirement that data flows be described and that the evaluation logic be based on scientific sources.

What counts as a sufficient response rate?+

There is no statutory or standardized minimum rate. As a guide, participation of about 60% or more is considered reasonable (WEKA practical guide). With a clearly lower response, the steering committee should read the results with caution and use health circles as a complementary instrument before adopting measures.

May company management view the raw survey data?+

No — only anonymized aggregate data. Individual answers, even without names, must not be accessible to management or HR. This requirement must be technically ensured and documented in the records of processing activities (Art. 30 GDPR).

Does an employee survey count toward GKV funding under § 20b SGB V?+

Under the GKV guideline (ch. 6.2.2), a situation analysis is a condition for insurers to support measures under § 20b SGB V. A survey or a health circle are suitable instruments for this, but not the only ones — insurers' health reports and the risk assessment count too.

Determine Your WHP Maturity Level and Structure the Analysis Phase

Our WHP maturity check shows you which phase your WHP is in and which analysis steps come next — including pointers to suitable survey instruments.

Check WHP Maturity Now All Guides

Sources

Last updated: 2026-06-24. Not legal or tax advice — have your specific case reviewed by a professional.

Health Data & GDPRWhich health data may HR analyze — and what does the GDPR prohibit?Building a WHP StructureHow do I build a WHP structure that is well organized and meets the prerequisites for a funding conversation with a German statutory health insurer (Krankenkasse)?WHP Results ReportWhat belongs in the WHP results report for executive leadership?