Article 12 sets three boundaries for personal data processed under measures implementing the worker-information, reporting and joint-assessment provisions. Processing must comply with the GDPR; the data must be used only to apply the principle of equal pay; and Member States may use a controlled-access route when disclosure would identify a worker’s pay.
The applicable GDPR lawful basis and the legal assessment of a particular disclosure require separate, context-specific analysis. Article 12 defines the Directive’s boundaries without creating a universal anonymisation or withholding rule.
The three Article 12 rules
Directive requirements
GDPR compliance. To the extent information provided under measures taken pursuant to Articles 7, 9 and 10 involves processing personal data, it must be provided in accordance with the GDPR. [Directive, Article 12(1)]
Equal-pay-only purpose. Personal data processed under measures taken pursuant to Articles 7, 9 or 10 must not be used for any purpose other than applying the principle of equal pay. [Directive, Article 12(2)]
Controlled access where pay would be identifiable. Where disclosure of information under Articles 7, 9 and 10 would lead, directly or indirectly, to identification of an individual worker’s pay, Member States may provide that access is limited to worker representatives, the labour inspectorate or the equality body. Only worker representatives or the equality body advise workers regarding a possible claim under the Directive, without disclosing actual pay levels of individual workers performing the same work or work of equal value. Information is unrestricted for the monitoring purposes in Article 29. [Directive, Article 12(3)]
What this means for Articles 7, 9 and 10
For Article 7 requests, the employer must still meet the written-information and two-month duties while applying the controlled-access route where the applicable measure uses it. [Directive, Article 7(1), (2) and (4); Article 12(3)]
For Article 9 reporting, employers must distinguish public or authority-facing reporting from category-level information and manage any personal data consistently with Article 12. [Directive, Article 9(1), (7)–(10); Article 12(1)–(3)]
For Article 10 assessments, the assessment’s required content and recipient rules remain in place; personal-data handling must comply with Article 12. [Directive, Article 10(2)–(3); Article 12(1)–(3)]
Operational data-governance controls
Operational recommendations — not express Article 12 requirements
- Map personal data used for Articles 7, 9 and 10, including sources, users and outputs.
- Apply a purpose field or case reference so reuse can be checked against the equal-pay-only rule.
- Define role-based access for raw data, calculations, reviewed outputs and controlled-access cases.
- Build an identification-risk check into each disclosure workflow.
- Establish a secure handoff to worker representatives, the labour inspectorate or the equality body where the Article 12(3) route applies.
- Record what the permitted recipient received and, where a worker representative or equality body advises a worker, what non-identifying advice was returned.
- Obtain specialist GDPR advice on lawful basis, notices, retention, security, data-subject rights and any national rules.
Encryption, access logging, retention controls, privacy notices and audits may be appropriate GDPR or security measures. They are operational measures rather than the operative wording of Article 12. The appropriate GDPR lawful basis requires context-specific legal analysis.
Small categories and identification risk
A small category can create a risk that an average reveals an individual’s pay. Article 12 addresses that possibility through controlled access where the relevant national measure provides it. The appropriate response is to assess the risk, apply any available Article 12(3) controlled-access route and obtain context-specific advice.
Directive framework