Health data in HSE documents
Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS · Working Group Expert, ISO/TC 283/WG 6 and WG 10 · member of SN/K 551. Last reviewed .
Most organisations collect health data without deciding to. It happens in a free-text field on a follow-up form, in the note from a well-meant conversation, in an action list with names next to measures, or in a survey with groups too small to protect anyone. This page is about where the line sits, and how health and safety documents can be written so they do the job without crossing it.
What counts as health data
Health data is a special category of personal data under GDPR Article 9. The starting point is a prohibition on processing, with exceptions that must be identified before processing begins. It does not need to be a diagnosis: a line saying a named person sleeps badly and should have shorter shifts is health data. That holds even when it is written with the best of intentions.
The five places it usually happens
The free-text field on the follow-up form. The note from the conversation about working conditions. The action list with names beside measures. The survey with groups small enough to trace. And the handbook's examples, where a real case has been used as an illustration.
Consent rarely solves it
In an employment relationship consent is rarely considered freely given, because the imbalance between the parties makes refusal costly. Someone telling you something does not in itself give the employer a right to record or share it. The question is not whether the employee was willing, but whether the processing is necessary for a stated purpose — and whether anything needs writing down at all.
Data minimisation in practice
Put three questions to every sentence in a health and safety document. Why do we need this? Who will read it? What happens if we leave it out? Often it is enough to record the measure without the reason: “the shift was swapped” rather than “the shift was swapped because …”. Same action, half the risk.
Two tracks, two access levels, two retention periods
The governance document describes arrangements and is shared widely: auditors, safety representatives, customers, employees. Individual matters belong in a separate track with restricted access and a shorter retention period. Mixing them makes either the document too sensitive to share or the cases too easy to reach. Separating them is the simplest data protection improvement available in health and safety work.
Pseudonymisation is not anonymisation
Pseudonymised information is still personal data where a route back to the individual exists. In small organisations and small teams that route is short: “the one on night shift at reception” is not anonymous. Consider group size before reporting, not after.
Have the document read
These are exactly the patterns we look for when we read a governance document: free-text fields, names beside measures, reasons that are not needed, and surveys with groups too small. Up to three areas for improvement and one suggested rewrite, free of charge. The document you send must not contain personal data.
One governance document reviewed free of charge. We read the document, never employees. The document must not contain personal data.
Sources
Frequently asked questions
- Is HSE documentation automatically personal data?
- No. Descriptions of conditions in the work and of arrangements available to everyone are not personal data. They become personal data when the text can be linked to an individual.
- Can a manager note what an employee said about their health?
- Be careful. That is processing of a special category of personal data, and the lawful basis must be identified before it is written. Often the measure can be recorded without the reason.
- What about data we need for sickness absence follow-up?
- That is a separate track with its own rules, access and retention period. It does not belong in the governance document shared with auditors or customers.
- Are anonymous surveys safe?
- Only if they are anonymous in practice. Small groups, free-text fields and combinations of background questions often make answers identifiable.
- Does Sydera delete the document we send in?
- Yes. The document is deleted after the stated period, and the review happens at document level — we never request information about employees.