Write down the agreement
and let the rest stay private.
Data minimisation means limiting the information to what you need for the task. A follow-up note is there to help you carry out the measures.
“Need now: to be able to alternate between seated and standing tasks. We are trying a different division of tasks. The supervisor arranges this. New conversation on Friday to see whether it works.”
First clarify what you need to document and have a lawful basis for. Then note the necessary information about function, the measures, who is responsible and when you follow up. Keep the employee’s description separate from what you have agreed. Go through the note together.
Keep the note to the agreement.
Diagnoses, medicines, treatment details and intimate stories stay out, even when they came up in the conversation. Your own medical guesses, rumours and irrelevant private details do not belong in the note.
This also applies to a note on your computer, an e-mail or an HR or HSE system. The name of the system does not make the information necessary.
Information about function and capacity for work can reveal health. Use your organisation’s approved solution for such follow-up, limit access to those who need it, and have a clear deadline or rule for storage. Everything stays in the approved solution, with no private copies on the side.
Article 9 of the GDPR gives health data extra protection. Necessary documentation of adjustments can still be lawful. The organisation must establish both a lawful basis under Article 6 and a relevant exception under Article 9, as well as necessity and secure handling. That something is told voluntarily is not in itself consent to storage and sharing.
EDPB data protection guide for small businesses → · The GDPR, Articles 6 and 9 →