Write down the agreement.
Let the rest stay private.
Data minimisation means limiting the information to what you need for the task. A follow-up note is there to help you carry out the measures.
“Need now: to be able to alternate between seated and standing tasks. We are trying a different division of tasks. The supervisor arranges this. New conversation on Friday to see whether it works.”
First clarify what you need to document and have a lawful basis for. Then note the necessary information about function, the measures, who is responsible and when you follow up. Keep the employee’s description separate from what you have agreed. Go through the note together.
Don’t write a little medical record.
Do not enter diagnoses, medicines, treatment details or intimate stories just because they were mentioned. Your own medical guesses, rumours and irrelevant private details do not belong in the note.
This also applies to a note on your computer, an e-mail or an HR or HSE system. The name of the system does not make the information necessary.
Information about function and capacity for work can reveal health. Use your organisation’s approved solution for such follow-up, limit access to those who need it, and have a clear deadline or rule for storage. Do not create private copies on the side.
Article 9 of the GDPR gives health data extra protection. It is not an absolute ban on necessary documentation of adjustments. The organisation must establish both a lawful basis under Article 6 and a relevant exception under Article 9, as well as necessity and secure handling. That something is told voluntarily is not in itself consent to storage and sharing.
EDPB data protection guide for small businesses → · The GDPR, Articles 6 and 9 →