Is psychosocial risk assessment a legal requirement?

Hazard identification with risk assessment is a written requirement in internal control rules across the EEA, and psychosocial conditions are not carved out. There is no prescribed template, but the assessment has to exist.

Does the assessment become personal data?

Not necessarily. Descriptions of conditions in the work are not personal data. They become personal data once the text can be linked to an individual, directly or indirectly.

Can we use sickness absence as an indicator?

We would not recommend it as a measure of psychosocial conditions. Use indicators on the work itself, such as staffing against workload and shifts changed at short notice.

How small a group can we report on?

Set a minimum before the survey goes out and hold to it. In small groups the route back to an individual is shorter than people assume, pseudonymisation included.

What does Sydera do with the document?

We read it and point to up to three areas for improvement with reference to relevant legal requirements, plus one suggested rewrite. The document must not contain personal data, and it is deleted after the stated period.

Psychosocial risk assessment as a document

Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS · Working Group Expert, ISO/TC 283/WG 6 and WG 10 · member of SN/K 551. Last reviewed 18 September 2026.

Psychosocial risk is one of the hardest fields to document, because what has to be assessed sits close to what is private. The answer is not to assess less, but to write about something else: the conditions in the work rather than the state of the people doing it. This page is about what the assessment looks like as a document.

What has to be assessed

Workload and pace. Role clarity and conflicting demands. Control over your own working day. Shifts, working time and rest. Support from managers and colleagues. Violence, threats and unwanted attention. Pace of change and predictability. Lone and outdoor working. Every one of these is a property of the work, and each can be described without naming a person.

The document that has to exist

Internal control rules require hazard identification with risk assessment, plans and measures, non-conformity handling and systematic review — in writing. A psychosocial assessment that exists only as a slide from a workshop does not meet that. What is missing is almost always the same three things: an owner, a trigger, and a review date.

Surveys: useful tool, common trap

An employee survey is useful when it asks about conditions and has a stated purpose for the answers. It becomes a trap when it collects experiences in groups small enough for answers to be traced back, or when free-text fields fill up with information about named people. Set the minimum group size before you send it, and decide what will not be reported.

Sickness absence is not a measure of psychosocial conditions

Absence figures get used as an indicator because they exist. They measure something else, and they pull the assessment towards health data. Measure the conditions instead: staffing against workload, share of shifts changed at short notice, non-conformities raised and closed, and how long a case takes.

From assessment to measures that work

A measure that works has four features: it changes a condition in the work, it is triggered by something other than an individual's initiative, it has an owner with a mandate, and it has been reviewed on a date with one line on what changed. Without the fourth, nobody knows whether it worked.

Guidance alongside legal requirements

ISO 45003 offers guidance on psychosocial risk, and ISO 45010:2026 offers guidance on menstruation and menopause at work. Both are guidance alongside relevant legal requirements, not requirements documents. Neither tells you what is lawful to record about a person — that assessment belongs to data protection law.

Test the document

Send in the psychosocial risk assessment, or the routine it rests on. You get up to three areas for improvement with reference to relevant legal requirements and one suggested rewrite. We read the document, never employees.

Check one routine — free

One governance document reviewed free of charge. We read the document, never employees. The document must not contain personal data.

Sources

Frequently asked questions

Is psychosocial risk assessment a legal requirement?: Hazard identification with risk assessment is a written requirement in internal control rules across the EEA, and psychosocial conditions are not carved out. There is no prescribed template, but the assessment has to exist.
Does the assessment become personal data?: Not necessarily. Descriptions of conditions in the work are not personal data. They become personal data once the text can be linked to an individual, directly or indirectly.
Can we use sickness absence as an indicator?: We would not recommend it as a measure of psychosocial conditions. Use indicators on the work itself, such as staffing against workload and shifts changed at short notice.
How small a group can we report on?: Set a minimum before the survey goes out and hold to it. In small groups the route back to an individual is shorter than people assume, pseudonymisation included.
What does Sydera do with the document?: We read it and point to up to three areas for improvement with reference to relevant legal requirements, plus one suggested rewrite. The document must not contain personal data, and it is deleted after the stated period.