Skip to content
HR & Recruitment calendar_today Updated: 5 October 2026 schedule 6 min read

How Can You Manage Workplace Health Risks Without Asking Applicants for Medical Details?

verified Last reviewed 5 October 2026 · GDPRWise legal team

Workplace safety can require health information, but it does not justify unrestricted medical questions in recruitment. Learn what employers need to know and what belongs with occupational health.

summarize Key Takeaways
  • check_circle Workplace safety requires a risk assessment and the appropriate health-surveillance process, not unrestricted medical questions in recruitment.
  • check_circle A pregnancy-related restriction on particular duties is not an automatic reason to reject a candidate.
  • check_circle Employers should receive the necessary work-related conclusions and measures, while clinical details normally remain with occupational health professionals.
  • check_circle Health data requires both an Article 6 legal basis and an applicable Article 9 exception, with access and retention limited to what is necessary.

A role involves hazardous chemicals, heavy physical work or other health risks. You need to make sure the person can work safely, but you should not turn the interview into a medical examination. The solution is to assess the work, use the appropriate occupational health process and give each person only the information they need to act.

Start with the job and its risks

Being in the chemical sector does not make every job unsuitable for a pregnant person. Assess the actual tasks, substances, exposure and working conditions. An office role and a production role may present very different risks.

Identify the risks and preventive measures before someone starts exposed work. Do not wait for an applicant to disclose a condition before considering whether a task is safe.

Explain the relevant duties and hazards clearly. Where the law requires or permits occupational health assessment for the role, explain that process too. General prevention remains necessary even when no individual health concern is known.

Pregnancy protection is not permission to exclude applicants

The correct question is how to prevent harmful exposure. A rule against pregnant workers performing particular hazardous duties is not automatically a rule against hiring them.

In Mahlburg, C-207/98, the Court of Justice held that an employer could not refuse a pregnant applicant an indefinite appointment because a pregnancy-related statutory work prohibition prevented her from performing the duties at the outset. Protective rules must not be used to undermine access to employment.

Do not introduce a blanket pregnancy question, pregnancy test or declaration of being free from medical conditions as a selection filter. Check local rules on any narrowly relevant questions: their relevance alone does not establish a GDPR basis or make a discriminatory decision lawful.

Equally, the fact that health data needs protection does not mean you must ignore a disclosed safety concern. Arrange the appropriate assessment and protective measures promptly.

The GDPR allows necessary health processing under strict conditions

Pregnancy information, medical findings and some fitness conclusions are health data. Processing normally requires both a legal basis under Article 6 GDPR and an exception to the prohibition in Article 9.

Depending on the activity and applicable law, relevant routes include:

  • Article 6(1)(c), where processing is necessary to meet a specific legal obligation.
  • Article 9(2)(b), for necessary employment or social-protection obligations and rights, where authorised by law or an applicable collective agreement with safeguards.
  • Article 9(2)(h), for occupational medicine or assessment of working capacity, subject to its legal conditions and the professional-secrecy safeguards in Article 9(3).

The employer and the occupational health provider must each establish the basis for their own processing. The provider’s permission to assess health does not give HR permission to obtain the clinical file.

A general legitimate interest in safety does not, by itself, satisfy Article 9. Nor should a consent box be used to bypass restrictions on medical screening or discrimination. Consent must be genuinely free, which is difficult where an applicant believes refusal will cost them the job.

Keep recruitment and medical assessment separate

Recruiters can explain essential tasks and discuss relevant experience and qualifications. They should provide an appropriate route for requesting adjustments without requiring candidates to explain their diagnosis to the selection panel.

Where a health assessment is required or permitted, use a qualified occupational health professional operating under the applicable confidentiality rules. Give that professional an accurate description of the job and its risks. Relevant medical questions can then be addressed in the proper setting.

Check local rules on which roles qualify for assessment, its scope, timing and notification. Do not assume every candidate needs an examination or that adding a medical condition to an offer makes it lawful. Any required clearance must be obtained before the relevant exposure begins.

This builds on the general rule to collect only appropriate applicant data.

What should the employer receive?

Normally, receive the legally permitted conclusion and the information needed to implement it, such as:

  • Whether the person can perform the specified work, with any necessary restrictions.
  • Adjustments to duties, exposure, equipment or working time.
  • The relevant duration or review date.

Diagnoses, detailed test results and clinical notes normally stay with the health professional. CNIL’s guidance for occupational health services explains the importance of confidentiality and controlled access to medical records.

A statement such as a restriction on exposure can itself reveal health information. Protect it accordingly. A line manager may need to know which task cannot be assigned, while designated HR staff handle necessary supporting administration.

An employer may lawfully need limited notification of pregnancy to activate maternity protection or arrange leave. Do not promise that HR can never know about a pregnancy; explain who needs to know, why and through which confidential route.

What if the assessment identifies a risk?

Follow the applicable protective procedure. Under the EU framework for pregnant workers, the sequence is to adjust working conditions or hours to avoid the risk, move to suitable alternative work if necessary, and provide protective leave where neither is feasible, subject to national implementation. Certain exposures are specifically prohibited.

For example, a production role involves a substance identified as presenting a pregnancy risk. The relevant assessment and notification lead to a temporary restriction on exposure. The employer considers safe adjustments or alternative work and, if those cannot be arranged, follows the applicable protective-leave or suspension rules. The manager implements the restriction without receiving unnecessary clinical details.

That example does not mean every medical restriction has the same employment-law outcome. Distinguish temporary pregnancy protection from other fitness findings and assess applicable accommodation, consultation and review requirements before taking an employment decision.

Make the process work in practice

  1. Assess the role: document hazards, preventive measures and any lawful health-surveillance requirement.
  2. Explain the process: tell candidates about relevant duties, assessments, data handling and the confidential contact route.
  3. Separate access: keep clinical information out of the ordinary applicant tracking system and selection notes.
  4. Act on the conclusion: implement restrictions and adjustments before exposure; do not treat the assessment as permission to discriminate.
  5. Handle disclosures carefully: if someone volunteers medical details, avoid circulating them, direct them to the proper professional and retain only what is lawfully necessary.
  6. Keep records proportionate: record the action, authorised access and review date; apply justified retention rules to the employer’s records. Medical and statutory exposure records may have different legal requirements.

Align the candidate notice, Staff Privacy Policy and retention policy with this process. Review access again when the candidate becomes an employee.

Sources and local implementation

This article explains the GDPR and EU principles. Check local employment, equality, occupational health and maternity-protection rules with your occupational health service before designing a screening process.

auto_awesome Is your recruitment and staff data handling clearly documented?

Use GDPRWise to document your recruitment and staff processing activities and prepare the privacy information your team needs.

Share share LinkedIn mail Email
GW
GDPRWise Editorial

This article was written by the GDPRWise team and reviewed by our privacy experts. We regularly review our content for accuracy and legal correctness.