SHALL WE TALK ABOUT IT? The well-meant conversation that can turn into a GDPR problem.

A working life that asks employees to explain menstrual pain in a conversation may, in practice, force risky "processing of health data" — even when the intention is only to help.

Background

Menstruation-related challenges at work are largely handled today through individual conversations and accommodation between manager and employee. The practice is well meant, but it can create unforeseen legal risk.

Reproductive health counts as a special category of personal data under GDPR Article 9. When employees have to explain pain, bleeding or cycles in order to get adjustments to their working day, the employer may in practice end up collecting and processing health data for which there is no adequate legal basis.

At the same time, research and surveys show that many of the challenges connected to cyclical health at work are not individual but structural. They are about access to facilities, products and solutions that make the working day manageable.

That raises a more fundamental question: is working life trying to solve a collective and predictable need through individual health disclosures?

This article argues that a more robust approach lies in designing the workplace for everyone — where basic needs, well known and well documented in research and statistics, are handled through system design and available infrastructure, without employees having to identify themselves or share sensitive health data.

Other potential risks to life and health we have managed to solve proactively, even for things that may never happen, through arrangements built into the infrastructure: first-aid equipment, fire extinguishers and defibrillators.

In this article I am not discussing what MIGHT happen — but what CERTAINLY happens, every single month, all year round.

CASE: an HR director invites an employee to a conversation

The intention is good. The employer wants to help. The employee explains that she has severe pain and heavy bleeding around menstruation.

She goes on to say that it affects her concentration. She shares her worry and puts it exactly as it is: she is afraid of bleeding through the white uniform at work.

The HR director listens respectfully, takes notes and promises to follow up.

The moment those notes are written, the employer moves into a high-risk area under GDPR Article 9 — without necessarily knowing it.

What is normal is treated as a deviation.

Menstruation is not a deviation. It is a normal, predictable, cyclical biological function — for a large share of the workforce, monthly, through a large part of life.

Nothing is wrong. Something is normal, and working life has consistently designed around it without factoring it in. The result is that a normal physiological fact ends up in a reactive, individual accommodation track — where the employee has to identify herself, ask for help and carry a need that should never have been hers to raise alone.

CARE Norway conducted, in 2024, together with Respons Analyse, a representative survey of 1,015 women aged 16–40, weighted against national population figures.

The findings are unambiguous

Seven in ten say that their productivity at work is negatively affected by their period. Four in ten say the pain makes it hard to function in everyday life. Eight in ten already use painkillers or other measures on their own initiative to get through the working day — without the employer knowing, and without the employer contributing.

And half of the respondents lack access to basic facilities and products for handling menstruation and cycles with dignity at their workplace. Half. In a statistically significant, representative sample.

When half of a group has the same need, it is by definition not an individual need.

It is an infrastructure need.

It is a warning light indicating a fault. Not in the workforce. In the infrastructure meant to serve their needs.

What the law already requires

What is striking is that Norwegian law already contains the necessary requirements. A lack of rules is not the problem.

The problem is that the system design is not compatible with what the law requires.

A little like sitting in a broken-down car on the motorway, under a sign reading: "NO STOPPING AT ANY TIME."

Section 3-1 of the Working Environment Act requires you as an employer to carry out systematic, preventive health and safety work covering "all matters of significance to employees' physical and mental health".

Section 5 of the Internal Control Regulations requires the employer to assess risk, implement measures and document that the measures work. Section 4-1 of the Working Environment Act requires the working environment to be "fully satisfactory" — physically and mentally.

Section 22 of the Equality and Anti-Discrimination Act gives employees the right to suitable individual accommodation of workplace and tasks, and section 26 obliges employers to work actively and purposefully to promote equality.

None of these provisions requires the employee to describe her body or her symptoms. Only her capacity for work.

They require the employer to assess and act — proactively, systematically and without making it the individual's responsibility.

Yet the advice circulating in working life — from HR guides, unions and occupational health services — is largely built on the same model: talk about it.

*"Have an open conversation. Ask the employee what she needs."*

It is well meant. And it is legally risky.

The legal problem

Reproductive health is a special category of personal data under GDPR Article 9.

That means the employer cannot collect, record or process such data without an explicit and necessary legal basis.

Section 9-1 of the Working Environment Act limits control measures towards employees to what is objectively justified and not disproportionately burdensome — and data protection law applies in full to such processing. The individual conversation — where the employee describes pain and bleeding — collects, by definition, reproductive health data.

If the manager takes notes, forwards them to HR, or uses the information in an assessment of work capacity, it can quickly become processing of health data in the sense the law intends.

The Norwegian Data Protection Authority is clear that an employee has a duty to inform about work capacity — not about cause or diagnosis. And consent in an employment relationship is rarely free enough to satisfy GDPR Article 7, precisely because the power relationship between employer and employee is asymmetrical.

GDPR Article 83 allows for fines of up to 4 % of global turnover for breaches of Article 9. The Data Protection Authority has stated in its guidance that health data in employment is a high-risk area. The paradox is that employers who follow the well-meant advice to solve this through individual conversations can create significant privacy risk — without knowing it.

Two problems — two solutions — one infrastructure

Menstruation at work creates two practical challenges. Both are predictable. Both are straightforward to solve.

One is the need for autonomous, dignified access to menstrual and sanitary products.

Without access to menstrual products at work, an unnecessary stigmatising pressure arises, along with psychosocial stress that affects concentration, presence and wellbeing.

CARE Norway's 2024 survey shows that easy access to sanitary products is among the things missed most. Half of the respondents said so.

The solution is simple: available products — without anyone having to ask. The second challenge is pain relief.

The CARE survey shows that eight in ten already use painkillers or other measures on their own initiative to get through the working day.

Severe menstrual pain reduces cognitive capacity — something well documented in research. About half resort to a hot water bottle or a hot bath. That is not a solution compatible with an ordinary working day.

Certified, effective alternatives exist that can prevent and relieve quickly — and that work through the whole day. Here too the answer is access, not conversation.

When both solutions are made as available as coffee, paper clips, toilet paper and lighting — that is, as infrastructure — the warning light goes out.

We would react strongly if something as basic as running water or toilet paper required a conversation with someone to get access. The solution is access — not conversation.

Infrastructure designed for everyone — not accommodation

There is a decisive legal and strategic distinction between accommodation and design for everyone. Accommodation is reactive. It assumes the employee identifies herself, asks for help and thereby carries the burden of turning a normal need into an individual matter.

A deviation the system can pretend it did not foresee. Section 22 of the Equality and Anti-Discrimination Act gives a right to individual accommodation — but it is a right the employee has to activate. It is a safety valve, not a system solution.

Design for everyone is the opposite. It is proactive.

It is the principle we all instinctively follow when we host a party:

The venue is adapted to the guests you invited. In a professional, data-driven context that means the system is designed to work for all bodies — without anyone having to identify themselves or ask. This principle — prevention and system design rather than individual disclosure — is implicit in the Working Environment Act's requirements for systematic health and safety work (sections 3-1 and 4-1) and section 5 of the Internal Control Regulations.

The problem is that many organisations believe diversity in the workforce creates inclusion by itself. As if it were enough to invite many different guests to the party — without furnishing the room for them.

If we do not account for the guests' needs — seating, ramps, allergies — that is not inclusion. It is poor hosting.

And when organisations tick green on SDG 5 (Gender Equality) without adapting the infrastructure, a paradox appears:

Equality gets reported while biological needs in the working environment go unnoticed.

If we speak concretely about biological differences, the workforce can be divided roughly into two groups:

those with a uterus — and those without.

Two groups of roughly equal size. With different biological needs.

These are needs toilet paper cannot solve.

To put it sharply: a lift is not an accommodation for wheelchair users. It is inclusive design. It is access. It is infrastructure. In the same way, access to menstrual products and pain relief at work is not an accommodation for women.

It is an obvious part of the infrastructure in a working life designed for bodies that menstruate. Or we could say: it is a matter of course in a working life made up of human beings.

When we design for universal use, something important happens: responsibility moves from the individual to the system. Only then do we start seeing scalable solutions — solutions that do not depend on someone being brave enough to have a conversation, and that do not place the employer in a legal grey zone.

A call to upgrade the infrastructure

Eighty-five per cent of respondents in the CARE survey do not sense that society accepts being away from work because of menstrual complaints. Four in ten believe there is no acceptance for it at all.

And still the model for solving it is: talk about it. Openness is not what is missing. Architecture is. Intelligent design. We have systems for finance, customers and IT. We have almost no systems for the people who actually do the work — and for the biological variation that is part of it.

NOU 2023:5 documents that menstruation-related health challenges are widespread, under-reported and under-treated in Norwegian working life. The Labour Inspection Authority's 2025 KOMPASS report on women's occupational health points the same way.

The law is in place. The knowledge is in place. The numbers are in place. When a collective need is solved through individual health disclosures, unnecessary privacy risk arises.

That is why the answer has to be infrastructure to a far greater extent — not confession.

How do we design a working life that handles biological variation without anyone having to identify themselves?

That is precisely what we are now preparing to test through a limited number of pilots in larger organisations over the coming year.

The aim is to build a knowledge base that genuinely deserves the word evidence-based — and at the same time to stress-test robustness against GDPR Article 9 in practice, not only on paper.

If you recognise the problem and think your organisation could be relevant for such a pilot, I would like to hear from you. The research-driven part of our work sits at Forskningsparken in Oslo. There we host privacy-friendly conversations — over freshly ground coffee.