Workplace health data: occupational health surveillance, sickness absence and how far the employer can go

Of all the processing activities Human Resources manages, health data is the most delicate. Employee health is special category data (art. 9 GDPR): the applicable regime is stricter, the legal bases more limited, the safeguards reinforced and the split of information between the company, medical service and mutual insurance is expressly delimited by labour law.

The practical issue is that HR teams handle sickness notes, fitness certificates, requests for workplace adaptations, communications with the mutual and occupational health surveillance results on a daily basis. This guide sets out the applicable criteria under the GDPR, the LOPDGDD (Spain's Organic Law 3/2018), the Spanish Occupational Risk Prevention Act (Law 31/1995) and the Spanish Workers' Statute.

Art. 9 GDPR and the dual legal basis

Data concerning health is special category personal data (art. 9(1) GDPR), prohibited as a general rule unless one of the exceptions in art. 9(2) applies. In the workplace, the typical enabling basis is:

• Art. 9(2)(b) GDPR: processing is necessary for compliance with obligations of the controller or the data subject in the field of employment, social security and social protection law.
• Art. 9(2)(h) GDPR: processing necessary for preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, provision of healthcare, carried out by a health professional bound by secrecy.

That art. 9 enabler must always be combined with an art. 6 GDPR basis (the dual-basis doctrine): typically compliance with a legal obligation (art. 6(1)(c)) or performance of the employment contract (art. 6(1)(b)). It is the concurrence of the two bases that legitimises the processing, not either of them alone.

The split of information: who knows what

The core point is that the company does not handle the clinical data of the employee, only the labour consequences of their state of health. The law splits information between three actors:

Occupational health surveillance (art. 22 Law 31/1995): what reaches the employer

Art. 22 of the Spanish Occupational Risk Prevention Act (Law 31/1995) governs the periodic surveillance of the employee's state of health in relation to the risks inherent to the role. It is the cornerstone of how workplace health data is handled. Operational rules:

• Voluntariness as the rule (art. 22(1)): the examination is carried out with the employee's consent, save for the specific cases of mandatory examinations described in the act itself (examinations essential to assess effects of work on health, risk to the employee or to third parties, or required by specific legal provisions).
• Competent healthcare personnel (art. 22(6)): only healthcare professionals with the requisite technical competence, training and accredited capacity have access to personal medical information.
• Reinforced confidentiality (art. 22(2)): occupational health surveillance data cannot be used for discriminatory purposes or to the detriment of the employee.
• Communication to the employer (art. 22(4)): the employer and persons or bodies with prevention responsibilities will only be informed of the conclusions drawn from the examinations regarding the employee's fitness for the role and the need to introduce or improve protection and prevention measures.

In practice, the employer receives the fitness assessment (fit, fit with limitations, not fit) and, where applicable, the functional limitations (cannot lift weights above X kg, cannot work at height, requires screen adaptation, etc.). It does not receive: diagnosis, tests, history, clinical reasons for the limitation.

Sickness absence: the mutual circuit and the notes

When an employee enters temporary incapacity, the information flow is bounded by Spanish Social Security rules and medical confidentiality. The employer receives:

• Sickness note: identification of the employee, start date, contingency (common or occupational) and estimated duration where applicable. NO diagnosis.
• Confirmation notes: during the process, no diagnosis.
• Return-to-work note: end date, no diagnosis.

Clinical information about the process (diagnosis, evolution, treatment, tests) stays within the healthcare sphere: GP, doctors at the partner mutual insurance company, specialists involved. It is covered by medical confidentiality and the art. 9 GDPR regime.

The employer has no right to demand the diagnosis, medical tests, reports or clinical reasons. The mutual does not send that information to the employer either. Trying to obtain it through parallel channels (questions to colleagues, social media, phone calls to the home, pressuring the employee) may constitute an infringement under both data protection and labour law.

Workplace adaptation and especially sensitive employees

Art. 25 of Law 31/1995 requires the employer to specifically guarantee the protection of employees who, due to their personal characteristics or known biological state, are especially sensitive to work-related risks. The interaction with data protection:

• The identification of an especially sensitive situation is carried out through the occupational health surveillance service, NOT by the employer interrogating directly.
• The employer receives the functional limitation (what the employee cannot do in the role), not the clinical cause.
• Adaptations are designed jointly with the prevention service.
• Information is kept only while the limitation is in force and under restricted access.

Common cases and typical mistakes

Medical certificates voluntarily provided by the employee

If the employee voluntarily delivers a medical report or tests, the company must apply minimisation: keep only the information strictly necessary (justifying the absence, date of consultation, possibly the functional limitation if the purpose is to adapt the role). Detailed tests and diagnoses must be returned to the employee or securely destroyed. The professional route to adapt a role is referral to the occupational health surveillance service.

WhatsApp and sickness communications

The employee communicates the absence through the company's usual channel. The company should NOT request screenshots of the detailed note, photos of medication or clinical descriptions. If the usual channel is WhatsApp, a dedicated work mailbox is advisable (not the personal mobile of the manager) and a clear periodic deletion policy should apply.

Internal communication about the reason for the absence

When a colleague is absent, communication to the team must be limited to the fact of the absence and, where applicable, cover measures. The clinical cause should NOT be disclosed, not even generically ("they have depression", "they have an oncological issue"). That information belongs to the employee.

Dismissal on health grounds

The employer's knowledge of an employee's state of health cannot be used to their detriment (art. 22(2) Law 31/1995). Dismissals motivated by illness or disability are vulnerable to a declaration of nullity for breach of fundamental rights. This is an area where data protection and employment law overlap especially delicately.

Mutual and communication with the company

The mutual deals with the employee as a patient and with the company as a member. Information flows are separated: the mutual can inform the company about administrative and management matters, but not about the clinical content of the process.

Retention and custody

Sickness notes and other labour documentation are kept in the employee's file for the limitation periods of labour and social security obligations (typically 4 years for infringements, specific periods for social security documentation that may reach 5 years). Occupational health surveillance documentation kept by the medical service has its own healthcare regime.

Minimum custody rules:

• Access restricted to HR personnel with a specific function.
• Separate storage of health-data documentation from the general personnel file.
• Encrypted archiving in digital systems.
• Secure destruction policy on expiry of the periods.
• Access logging where volume justifies it.

HR checklist for health data

• Internal policy on health data handling, with a clear split between HR and medical service.
• Procedure for receiving sickness notes without requesting additional clinical information.
• Clear channel for the employee to request workplace adaptations, with referral to occupational health surveillance.
• Training for HR and line managers on the limits of art. 22 of the Spanish Occupational Risk Prevention Act.
• Separate custody of health-data documentation (restricted access, encryption, access logging).
• Art. 28 GDPR contract with the external prevention service and with the mutual where applicable.
• Internal communications about absences without revealing the clinical cause.
• Procedure for handling employee rights over their health data.
• Periodic review of the personnel file to purge unnecessary clinical documentation.

Frequently asked questions

Can the employer know the medical diagnosis of an employee on sick leave?

No. The employer receives sickness, confirmation and return-to-work notes, without diagnosis. Clinical information stays within the healthcare sphere (doctor, mutual, specialists) and is covered by medical confidentiality and art. 9 GDPR. Trying to obtain it through parallel channels may constitute an infringement.

What occupational health surveillance results does the employer receive?

Only the fitness assessment (fit, fit with limitations, not fit) and, where applicable, the functional limitations. It does NOT receive diagnosis, tests or occupational clinical history. This is set out in art. 22(4) of the Spanish Occupational Risk Prevention Act (Law 31/1995).

Is occupational health surveillance voluntary or mandatory?

General rule: voluntary (art. 22(1) Law 31/1995). Specific exceptions: where it is essential to assess the effects of work on health, where there is risk to the employee or third parties, or where required by a specific legal provision (chemicals, noise, food, etc.).

What if an employee voluntarily gives me a certificate or medical tests?

Apply minimisation: keep only what is necessary for the specific purpose (justify absence, adapt role). Clinical detail must be returned or securely destroyed. The professional route to adapt the role is referral to the occupational health surveillance service.

This content is for general information purposes only and does not constitute specialist legal advice. The application of the rules to each specific case requires individual analysis. Spanish regional sector-specific rules may extend or modify timeframes and requirements.