MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
An employer may register absenteeism, but not data regarding the nature or cause of the illness — they are not even allowed to ask about that. These are special (health) personal data, which only the occupational health service or company doctor may process. A company that registered illnesses, complaints, and pain indications (and secured them poorly) was fined 15,000 euros by the Dutch Data Protection Authority.
The Dutch Data Protection Authority (AP) fined a maintenance company that recorded health data of sick employees. That does not mean you are not allowed to keep any absence records at all — we explain the limits.
What went wrong?
The company maintained an absence register. Keeping track of absences is permitted, for example for reintegration or replacement. However, this company went much further and also recorded the cause of the absence: names of illnesses, pain indications, and specific complaints. These are special personal data, which are subject to extra protection. Processing them is prohibited in principle and can only be done on the basis of a statutory exception — which was lacking here.
In fact, privacy legislation prohibits employers from recording information about the nature and cause of the sick leave; they are not even allowed to ask for it. Only the occupational health service or company doctor is permitted to do so. In very exceptional cases, deviating from this can be useful — for example, recording that someone has epilepsy so that colleagues know what to do in the event of a seizure — but that is the exception.
Particularly reprehensible: the registration was accessible online without authentication. Special personal data, in particular, must be secured with extra care. According to the AP, a username and password are not sufficient; multi-factor authentication is required. The AP imposed a fine of 15,000 euros.
Which absence data are you allowed to register?
The GDPR allows scope to request and record necessary information — information needed to determine how to proceed with the work:
- the estimated duration of the absence;
- the nursing/residence address;
- a phone number where the employee can be reached.
Not necessary (and therefore not permitted to ask): what illness someone has, what medication they are using, or how an accident occurred. If an employee shares this voluntarily, you may offer a listening ear, but you may not record the information. Only in exceptional cases where the diagnosis is truly necessary may it be included in the personnel file — with proper security.
Frequently Asked Questions
May I ask why an employee is sick?
No. You may not ask about the nature or cause of the illness, nor may you record it. Only the occupational health service or company doctor is permitted to do so. You may not record voluntarily shared information.
Which absence data am I allowed to keep?
Only necessary data, such as the expected duration of the absence, the nursing address, and a telephone number. Not the diagnosis or medication use.
How do I secure health data?
Exercise extra caution. A username and password are not sufficient; the DPA requires multi-factor authentication and appropriate access restrictions.
Making absence registration GDPR-compliant?
The privacy and employment law specialists at MKB Juristen help you register absenteeism correctly and securely. View our expertise in privacy and data protection or schedule an intake meeting .
