ESRS S1 and data protection: reporting without health data
Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS · Working Group Expert, ISO/TC 283/WG 6 and WG 10 · member of SN/K 551. Last reviewed .
ESRS S1 concerns an organisation's own workforce in sustainability reporting, where it applies. The duty to describe what the organisation does about working conditions meets the same limit as OHS documentation: health data is a special category under data protection law. The way through is the same — report on the arrangements, not on the people.
What the reporting asks for, where it applies
It asks about governance: what the organisation has decided about working conditions, which arrangements exist, how workers take part, how concerns are raised and followed up, and what the result was. Which organisations are in scope and from when follows from the applicable rules — check what applies to you before building a reporting process.
Where reporting and data protection collide
The temptation is to report on health: how many people received adjustments, how many have a diagnosis, absence figures broken down by cause. At that point the documentation moves into special category data, and data minimisation applies. A report is also a document that leaves the building, which makes the mistake more expensive than in an internal note.
What can be reported without special category data
Describe arrangements, not people: which arrangements are available to everyone, how they are triggered, which roles own them, how workers take part, how many role clarifications and reviews were completed, how many raised concerns were closed, what changed over the year. These are governance facts, not health data.
Aggregation is not automatically safe
Group-level figures can still be personal data when the group is small enough. In a team of four, “one employee had working hours adjusted” is often identifying. Set a floor for what gets reported per unit, and write that floor into the routine.
One set of documentation, several purposes
The descriptions used in internal control can be reused in reporting where both apply. That saves work and gives something more valuable: the same story in two documents. Where the OHS document and the sustainability report say different things about the same arrangement, that difference is what an auditor notices first.
How to get started
Take one document that describes a working environment arrangement and read it as if it were going into a report. Does it say what the arrangement is, who it applies to, how it is triggered and what changed last time? Where the answer is missing, so is the basis for reporting. We are happy to read that one document free of charge.
One governance document reviewed free of charge. We read the document, never employees. The document must not contain personal data.
Sources
Frequently asked questions
- Does ESRS S1 apply to us?
- That follows from the applicable reporting rules and from the size and circumstances of the organisation. Check what applies to you before building a reporting process.
- Can we report absence broken down by cause?
- Be careful. Cause of absence can reveal health data, particularly in small units. Report on arrangements and governance, and keep cause data out of anything that leaves the building.
- Are group-level figures safe?
- Not automatically. If the group is small enough, the figure can identify a person. Set a floor per unit and write it into the routine.
- Can OHS documentation be reused in reporting?
- Yes, and it should be. The same description of the same arrangement in both documents saves work and prevents the two from saying different things.
- What do you look for in a document with reporting in mind?
- Whether the arrangement is described so an outsider can read what applies, to whom, how it is triggered, who owns it and what changed last time.