EU Pay Transparency Directive: Data protection

Why should I read this?

The deadline for the local implementation of the EU Pay Transparency Directive (Directive) into national laws was 7 June 2026, although many Member States missed that deadline. The Directive aims to combat pay discrimination and help to close the gender pay gap in the EU by requiring employers to share information on pay, ensure gender-neutral pay structures, and take action where a gender pay gap exceeds 5% within a given category of workers. 

Whilst the Directive's transparency objectives are clear, on the face of it they create a fundamental tension with the data protection obligations under the General Data Protection Regulation (GDPR). The question of how these two regimes interact is a frequent compliance concern among employers preparing for implementation. 

This briefing examines some of the practical data protection considerations that arise from the Directive and sets out recommended steps for addressing compliance with the two regimes.

What do I need to know?

The Directive imposes three principal sets of obligations:

• pre-employment transparency, including pay range disclosures and a ban on pay history enquiries
• in-employment transparency, including the right of employees to request pay information
• organisational transparency, including mandatory gender pay gap reporting for employers with 100 or more employees, phased by headcount 

All of these obligations are likely to involve the processing of personal data to a greater or lesser degree. In particular, the in-employment and organisational transparency requirements require employers to share averages of the pay of male and female workers per category, either at the request of an individual worker or as part of periodic pay reporting.

The processing of salary data of individual workers is not classed as special categories of personal data. Nevertheless, that processing must still comply with the wider GDPR obligations placed on employers, as controllers. These include (amongst others):

• fairness and transparency – i.e. what employers are telling their employees about their processing activities in existing employee (or applicant) privacy notices
• lawfulness – what lawful basis is being relied upon for the processing of personal data carried out in this area
• data minimisation – whether the personal data processed for such purposes is truly limited to what is necessary and no further

A particular challenge is in respect of the lawful basis for processing. First, until jurisdictions have pay transparency laws in place and in force, the lawful basis of compliance with a legal obligation will not be available. Second, the current lack of clarity in the Directive on what data must be disclosed (including around the scope of the definition of ‘pay’) as well as the broad ability for workers to request reasonable clarifications poses a risk of data being disclosed beyond the data minimisation principle.

But these core legal obligations are not the only considerations. The ability for workers to request pay information and request clarifications means that companies will need to differentiate between such requests and data subject access requests (DSARs). DSARs must be addressed within one month of receipt of the request (unless the request is complex or clarification is required), whereas information under the Directive must be provided within two months of the request. Without clear processes in place for identifying and differentiating between the two processes, there is a real risk that requests that are properly DSARs will not be dealt with appropriately or on time.

Further, where data is generated for the purpose of responding to pay transparency requests but, due to data protection constraints, it is ultimately disclosed only to workers’ representatives, the labour inspectorate or the equality body (see further below), employers should be mindful that the worker may instead seek access to that information (as it relates to them personally) by submitting a DSAR. Employers should therefore ensure that the disclosure routes are aligned, to ensure that the pay of another worker is not inadvertently disclosed.

National approaches

The Directive acknowledges the privacy overlap, but does not resolve it, simply providing that any processing or publication of information under the Directive “shall be provided in accordance with” the GDPR. It invites Member States to use a discretionary power to decide that, where the disclosure of information would lead to the disclosure of the pay of an identifiable worker, “only the workers’ representatives, the labour inspectorate or the equality body shall have access to that information”.

Some jurisdictions, including Sweden and the Netherlands, have chosen not to incorporate within their draft legislation to implement the Directive the discretionary power, reasoning that the Directive's own purpose limitation and proportionality provisions already adequately address GDPR requirements.

Other jurisdictions have included the optional limitation on disclosure, although none have yet enacted any definitive statutory numerical threshold for when a worker category will be deemed too small to disclose safely. Finland's draft explanatory memorandum suggests that whilst a minimum threshold of five workers has often been seen in practice, this is not fixed and must be determined on a case-by-case basis. Germany’s Commission report makes clear that either a threshold should be stated (a threshold of six workers is already found in other German legislation), or that the significance of data protection in this context should be clarified in the explanatory memorandum to the law. The French draft bill refers to a minimum number of employees to be set by a future decree. 

Whilst Poland has included the discretionary power in its draft legislation, it does not suggest any minimum threshold trigger. It has further addressed the timing issue between DSAR and pay transparency requests by maintaining a proposal that the timescale to respond to information requests should be 30 days, a reduced period to that contained in the Directive.

Employers operating across multiple jurisdictions will therefore need to navigate a patchwork of national approaches to this question and develop jurisdiction-specific workflows accordingly.

Late transposition: the additional data protection challenge

The majority of EU jurisdictions are yet to fully transpose the Directive. As a result, in those jurisdictions without existing pay transparency laws, data collection aligned to the requirements of the Directive cannot be anchored to a domestic legal obligation.

This creates an additional data protection challenge, as compliance with a legal obligation is the primary lawful basis for processing pay data under the Directive. However, this ground requires the existence of a clear and specific legal obligation in domestic law. The Directive itself, as an unimplemented directive, does not directly impose obligations on employers and therefore does not, by itself, constitute a sufficient legal obligation for GDPR purposes.

Employers that begin collecting and processing pay data in anticipation of future transposition legislation must therefore consider whether an alternative lawful basis could support their processing activities. Legitimate interest may be an appropriate alternative basis, namely taking preparatory steps to ensure that the requirements of the law can be met once in force, but would need to be accompanied by robust safeguards, including an audit trail supporting the reasoning behind the plans (e.g. in the UK, that might be a legitimate interest assessment), the reinforcement of data minimisation, clear purpose limitation, and access controls.

The risk landscape

Employers that breach pay transparency and data protection requirements face a dual enforcement risk. The risk profile can be expected to significantly increase over time as pay transparency requirements become clearer and practices embed.

The Directive materially increases litigation, enforcement and reputational risk, including the risk of class actions, by exposing pay practices to scrutiny and strengthening employee remedies. Employers face financial penalties set at Member State level that must be effective, proportionate and dissuasive, alongside uncapped or full compensation for affected workers (including recovery of arrears, bonuses and benefits), and potential corrective orders. The Directive also shifts evidential burdens where employers fail to comply with transparency obligations, increasing the likelihood of adverse findings.

In parallel, data protection failures around data minimisation, accuracy, access controls, lawful basis, or transparency can trigger regulatory action. GDPR penalties are significant, with administrative fines of up to €20 million or 4% of global annual turnover (whichever is higher), alongside orders to restrict processing and potential compensation claims by individuals.

In practice, during both the pre-transposition phase and the initial stages of transposition, while pay transparency practices are still being established and uncertainties persist regarding the timing and manner of transposition, data protection authorities are unlikely to initiate extensive punitive investigations. Instead, their early focus is expected to be on providing guidance, responding to complaints, and addressing clear governance failures. Individual complaints to authorities may be a more likely trigger for regulatory engagement, particularly where employees suspect personal data to have been processed and/or disclosed in a non-compliant way. In any event, organisations should anticipate heightened data protection scrutiny throughout the EU as pay transparency frameworks become more firmly embedded.

Addressing the conflict: practical strategies

Employers should adopt a structured, proactive approach to ensuring compliance with both local laws implementing the Directive and the GDPR. Key practical tips include:

• Assess the regulatory environment: Employers should review the relevant national legislation in each jurisdiction to determine the exact legal requirements governing the processing of pay data for pay transparency purposes. This includes considering provisions that permit alternative methods of disclosure when revealing information could disclose the pay of an identifiable employee, as well as any applicable thresholds
• Take accountability measures: Employers building new processes, systems, and reporting frameworks in an effort to meet the Directive’s requirements should be mindful of their data protection by design and by default obligations – i.e. embedding privacy into pay transparency workflows from inception, not retrofitting them. Accountability measures will include updating records of processing activities, as well as conducting DPIAs and applying data minimisation techniques (see below). Further, any use of algorithmic tools to categorise workers, calculate pay gaps, or flag outliers may trigger the engagement of GDPR obligations relating to automated decision-making
• Conduct a data protection impact assessment (DPIA): Given the sensitivity of remuneration data and the risks inherent in disclosure, a DPIA is advisable to assess the risks associated with each type of disclosure (individual information requests, periodic pay gap reports, and joint pay assessments) and to identify appropriate mitigating measures. All steps and decisions relating to the processing and disclosure of pay data should be documented to create an audit trail that can be referred to in the event of challenge
• Apply data minimisation: In the absence of any numerical threshold in the local laws of the operating location, employers should consider defining internal criteria for when disclosure may risk identifying individuals. Depending on the particular profile of jobs within an organisation, a minimum comparison group size of five to ten employees may offer a reasonable starting point based on indicative approaches to date
• Ensure data protection notices are up to date: Employers should review privacy notices to ensure that they clearly explain the processing of pay data for pay transparency purposes. Since this should include the types of disclosure that may be made and the recipients of the data, it will be important to make clear that information may be shared with workers’ representatives, the labour inspectorate or the equality body
• Update internal documentation and processes: Employers should review and update any internal documentation and processes underpinning the use and/or disclosure of pay transparency data within their organisations, including data sharing agreements, data transfer mechanisms, policies, security measures (see more below) and training
• Establish access controls and enforce purpose limitation: Clear access concepts should be established specifying who has access to which data and for which purposes. Personal data processed for pay transparency purposes should not be used for any other purpose, and employers may require workers who have obtained pay information about others to use it solely for exercising their right to equal pay. Internal policies should make this restriction clear
• Design robust information request procedures: Employers should create a standard operating procedure for handling employee pay information requests, with clear instructions on how to operate the right, approval steps, and plain-language templates. The procedure should address how requesters are classified, authenticated, how and when data is extracted whilst protecting co-worker privacy, and how requests and responses are logged to demonstrate compliance. Employers should also consider whether and how pay transparency requests may interplay with DSARs, and align the processes accordingly

How we can help

With our established equal pay and data protection practices, we are ideally placed to support employers with pay transparency readiness. Our lawyers are not only experts in the complexities of different laws, but also in the management of projects spanning jurisdictions and driving those projects to maximise the strategic aims and benefits.

You can track the latest developments on our Navigating Global Pay interactive site, as well as accessing essential FAQs, timelines, a summary of the Directive, a glossary and briefings (request access to our site here). With the added benefit of our Diversidata product which provides the latest information around the collection, retention and use of diversity data, our teams are ideally placed to help companies ensure legal compliance.