GDPR & EHS Data: Compliant Incident Logging in the EU and UK

Every incident report captures personal data: the injured worker's name, role, location, sometimes medical details. In the EU and UK, that data is subject to the GDPR (and the UK GDPR for British operations). EHS programs that handle it informally leave compliance gaps.

This guide walks through how GDPR applies to EHS records, where the common gaps are, and how modern EHS platforms handle privacy by design.

What Personal Data Is in Your EHS System?

More than you think:

• Identification: name, employee ID, photo, contact details
• Employment: job title, department, supervisor, work location
• Health data (sensitive): injury type, body part, medical treatment, return-to-work status, occupational health screenings
• Behavioral: observations of "at-risk behavior" (our BBS guide suggests anonymising them), near-miss involvement, training scores
• Location: site, building, sometimes GPS for lone-worker apps
• Witness statements: statements naming other workers

Of these, health data is "special category" data under GDPR Article 9, subject to stricter rules than general personal data.

Lawful Basis for Processing

GDPR Article 6 makes processing lawful only where at least one lawful basis applies. For EHS, the typical bases are:

General personal data (incident logging, training records)

• Article 6(1)(c) — Legal obligation. Where the law requires a record, this is your strongest basis. The EU Framework Directive 89/391/EEC (Article 9) requires employers to keep a list of occupational accidents that leave a worker unfit for work for more than three working days, and in Great Britain RIDDOR 2013, regulation 12 requires a record of reportable incidents and of work injuries that keep a person off routine work for more than three consecutive days. Check national law for anything beyond that, such as training records.
• Article 6(1)(f) — Legitimate interest. Useful for observations, leading indicators, and analytics, but you must show the processing is necessary and that workers' interests do not override yours. The ICO says you should record this in a Legitimate Interest Assessment (LIA).

Health data (special category)

• Article 9(2)(b) — Employment law. Permits processing necessary for obligations and rights in the field of employment, social security and social protection law, in so far as Union or Member State law (or a collective agreement) authorises it. In the UK the condition is in Schedule 1, Part 1 of the Data Protection Act 2018.
• Article 9(2)(h) — Occupational medicine. Useful for occupational health surveillance, where the data is processed by or under the responsibility of a professional bound by professional secrecy (Article 9(3)).

Consent is rarely the right basis for incident records. The EDPB's consent guidelines (paragraph 21) note the imbalance of power in employment, which makes it unlikely that a worker can refuse consent freely. Use legal obligation or employment-law bases instead.

Common GDPR Gaps in EHS Programs

1. No documented retention period

GDPR Article 5(1)(e) requires that personal data be kept in identifiable form "no longer than is necessary" for its purpose, so keeping EHS data indefinitely is a gap. Define a retention schedule. The periods below are an example to adapt, not legal minimums or maximums; set each one from the record-keeping law that applies (in Great Britain, for example, RIDDOR regulation 12 requires entries in the record of reportable incidents, and of work injuries that keep a person off routine work for more than three consecutive days, to be kept for at least three years):

• Incident records: 5-10 years post-incident (varies by jurisdiction; check national OH&S record-keeping requirements)
• Training records: lifetime of employment + 5-7 years for safety-critical roles
• Observations: 12-24 months
• Near misses: 5-7 years
• Audit findings: 5-7 years post-closure

Set the schedule in the platform; auto-archive or anonymize at expiry.

2. Excessive data collection

GDPR's data minimization principle (Article 5(1)(c)) says: collect only what you need. Common offenders:

• Capturing date of birth when only "adult/minor" is needed
• Capturing home addresses on incident forms
• Free-text witness statements that include irrelevant personal details
• Photographs of injured workers without operational necessity

Audit your forms. Remove anything not directly necessary for the safety purpose.

3. No privacy notice for workers

Workers have a right under GDPR Articles 13/14 to be told what data you collect, why, on what basis, and for how long. If your EHS program has no worker-facing privacy notice, fix it:

• Add a 1-page EHS data privacy notice to your onboarding pack
• Reference it from the EHS software login screen
• Provide a translated version for non-native speakers

4. Cross-border data transfers

If your EHS platform's servers are in the US, every incident logged in the EU is a transfer of personal data outside the EEA. If the US vendor is certified under the EU-U.S. Data Privacy Framework, the transfer can rely on the Commission's adequacy decision (EU) 2023/1795 of 10 July 2023. The Framework remains in force: the General Court dismissed a challenge to it on 3 September 2025 (case T-553/23), and an appeal to the Court of Justice was lodged on 31 October 2025, so keep the fallback below documented. Otherwise, since the Schrems II judgment, you need:

• A transfer mechanism, such as the Commission's Standard Contractual Clauses
• A documented Transfer Impact Assessment (TIA), following the EDPB's Recommendations 01/2020
• Supplementary measures if required (encryption, pseudonymization)

Some platforms offer EU data residency as a feature. If you're processing significant volumes of EU worker data, this is worth specifying in your RFP.

5. No DPIA for high-risk processing

GDPR Article 35 requires a Data Protection Impact Assessment (DPIA) before processing likely to result in high risk, and names large-scale processing of special category data such as health data as one case (Article 35(3)(b)). The ICO's list of high-risk processing adds tracking a person's location or behaviour, including at work. EHS programs that include any of these likely require a DPIA:

• Continuous lone-worker GPS tracking
• Behavioral monitoring at scale
• Sensitive health data on large worker populations

6. Worker access requests not honored

Under Article 15, workers can request a copy of all personal data you hold about them. Test whether your EHS platform can produce a personalized data export: under Article 12(3) you must respond without undue delay and within one month of the request, extendable by two further months for complex or numerous requests.

7. Witness statements containing third-party personal data

A witness statement in an incident report often names other workers. Those named individuals are also data subjects. Their data must be lawful, necessary, and ideally pseudonymized in any document released externally.

What to Look for in GDPR-Aware EHS Software

A platform built with privacy by design (GDPR Article 25) would ordinarily offer features such as:

• Configurable retention rules per record type, with auto-archive
• Field-level pseudonymization — show "Worker #4521" in analytics dashboards, full name only to authorized roles
• Granular role-based access — site lead sees only their site, regional lead sees their region
• Audit log of who viewed which personal data
• Data export at the individual subject level (for SAR responses)
• EU data residency option (servers physically in the EEA)
• DPA (Data Processing Agreement) ready to sign, as Article 28(3) requires processing by a processor to be governed by a contract or other legal act; not "we'll get you one in a few weeks"
• SCCs included in the standard contract for international transfers

Ask each vendor, in writing, for its data processing agreement, sub-processor list and hosting regions during evaluation, and note what is missing, conditional or left to a later contract.

Hosting region and data residency

Do not infer EU data residency or subject-level data export from where a vendor is headquartered. Our research has not established either for EcoOnline or Quentic, so ask every shortlisted vendor to name the hosting region in the contract and to demonstrate a subject-level export. The hosting and data location study shows what the researched profiles document about hosting.

Correction, 23 September 2026: an earlier version of this sentence also named a commercial partner of this site as an EU vendor with EU residency built in. Our profile of that product does not document EU data residency, so it has been removed.

For multi-region operations, the practical pattern is:

• Deploy EU instance for EU/UK operations
• US instance for US/Americas
• Aggregate analytics via the BI layer, with appropriate data minimization

Worked example: a subject access request about an incident file

This is a constructed example, not an observed case. A former employee asks for everything held about an incident two years ago.

For UK requests, Part 5 of the Data (Use and Access) Act 2025 amended the subject access rules, and the ICO said most of the Act's data protection provisions started on 5 February 2026; check the ICO's current subject access guidance for the exact search and clock rules.

Questions for a vendor

This site does not rank vendors on privacy. The security, trial and offline evidence study counts the attestations vendors name, such as SOC 2 and ISO 27001; these concern security controls, not GDPR compliance as such. The QHSE Software Capability Map 2026 lists what the profiles document on audit trail and security. Put the same requests to every vendor:

1. Show a subject-level export for one named worker, including free text and attachments.
2. Show the retention setting for one record type, and what happens at expiry.
3. Name the hosting region, sub-processors and transfer mechanism in the contract.
4. Show which roles can see health fields, and the log of who viewed them.

Features that hold personal data deserve extra care: see lone worker safety software, occupational health software and the glossary entry on incident investigation.

FAQs

Does GDPR apply to UK operations after Brexit?

The UK kept GDPR in national law as the UK GDPR, which sits alongside the Data Protection Act 2018 and has since been amended by the Data (Use and Access) Act 2025. The core principles match the EU GDPR, so most EHS compliance approaches work for both, but check the UK amendments before assuming an EU approach carries over.

Can I share incident data with my client (e.g., on a construction site)?

Sharing requires a lawful basis. A contract between you and your client is not one: the contract basis applies only to a contract with the individual, so the ICO points to another basis such as legitimate interests. Your master service agreement should still set out what is shared, with appropriate data minimization (anonymized statistics, not identified individuals). Get your DPO's sign-off before establishing the data flow.

Is SafetyCulture / Intelex / VelocityEHS GDPR-compliant?

GDPR compliance is not a product feature: the vendor takes on processor obligations under its DPA, and you, as controller, remain responsible for how the platform is configured and used. Our research has not established the DPA terms, international-transfer mechanism or hosting region for Intelex, SafetyCulture (renamed Mitti in August 2026) or VelocityEHS, so ask each vendor for its DPA, the transfer mechanism it relies on and the hosting region it will commit to in the contract. Review our SafetyCulture vs Intelex comparison for more, and the EcoOnline vs Intelex and Cority vs VelocityEHS pages for pairings that include Intelex or VelocityEHS.

How do I handle data when a worker leaves?

Apply your retention schedule. Records you keep under a legal obligation stay for the period that law sets; lower-risk data such as observations can be deleted or anonymized sooner (12-24 months in the example schedule above).

Do I need a DPO (Data Protection Officer) for EHS data alone?

Not necessarily, since it depends on your core activities and national law. Under Article 37(1), a DPO is mandatory for public authorities and where the core activities consist of large-scale regular and systematic monitoring of individuals or large-scale processing of special category data such as health data. Member State law can also require one (Article 37(4)), so check national law. If you have a DPO, Article 38(1) requires them to be involved properly and in good time, which includes EHS platform selection and configuration.

What happens if I get a GDPR fine?

Under GDPR Article 83, fines are up to €20M or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher, for breaches of the basic principles (including storage limitation), the special category rules, data subject rights and the transfer rules, and up to €10M or 2% for other obligations, including security. In the UK the higher maximum is £17.5M or 4% (Data Protection Act 2018, section 157).

---

Need a GDPR-aware EHS platform? Take our Get Matched quiz for a shortlist, then ask each vendor to confirm EU data residency, configurable retention and a signed DPA in the contract.

Sources

• Regulation (EU) 2016/679 (GDPR): Articles 5, 6, 9, 12, 13-15, 25, 28, 35, 37, 38 and 83.
• UK GDPR, Data Protection Act 2018, Schedule 1, Part 1 and section 157, and the Data (Use and Access) Act 2025.
• Council Directive 89/391/EEC (the OSH Framework Directive), Article 9.
• The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, regulation 12.
• WilmerHale: note on the appeal against the General Court's Data Privacy Framework judgment and ICO: statement on commencement of the Data (Use and Access) Act.
• Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework) and Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses).
• EDPB, Guidelines 05/2020 on consent and Recommendations 01/2020 on supplementary measures for transfers.
• ICO guidance on legitimate interests, the contract basis and processing likely to result in high risk.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Reviewed 4 October 2026: the Data Privacy Framework status and UK subject access note were added, an unsupported vendor-response test and a heading that did not match its text were fixed, and a worked example and vendor questions were added.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts. The transfer section now reflects the EU-U.S. Data Privacy Framework, the subject-access deadline is one month rather than 30 days, and the client-sharing answer no longer treats a contract with the client as a lawful basis.