EU Pay Transparency Directive vs. GDPR: Navigating Pay Data Compliance

Introduction: When Transparency Meets Privacy

The EU Pay Transparency Directive (Directive (EU) 2023/970) is set to transform how employers handle pay data across the EU. With the transposition deadline of 7 June 2026 approaching, organizations are scrambling to prepare for new obligations—ranging from gender pay gap reporting to granting employees the right to request individual pay levels. But there's a catch: the very data that must be disclosed is personal data under the General Data Protection Regulation (GDPR).

This collision creates a genuine compliance dilemma. How do you reconcile the PTD's mandate for transparency with GDPR's principles of data minimization and purpose limitation? And what happens when disclosing pay data to one employee inadvertently reveals another employee's salary?

In this guide, we'll break down the PTD's requirements, analyze the GDPR tensions, and provide actionable steps to build a compliant pay transparency framework that respects both regulations.

Understanding the EU Pay Transparency Directive

Adopted in May 2023, the PTD aims to close the gender pay gap by requiring employers to be more open about pay. Key obligations include:

• Pay gap reporting: Employers with 100+ employees must report gender pay gaps and, where gaps exceed 5% in any category, conduct a joint pay assessment.
• Right to information: Workers can request information on their individual pay level and the average pay levels for comparable workers, broken down by gender.
• Pay transparency in job postings: Employers must disclose the initial pay or pay range in job advertisements.
• Prohibition on pay secrecy: Contractual clauses that restrict workers from discussing their pay are banned.

Member states must transpose the directive into national law by 7 June 2026. However, as with many EU directives, transposition varies—and that variation creates compliance headaches for multinational employers.

The GDPR Tension: Pay Data as Personal Data

Under GDPR, pay data—including salary amounts, bonuses, and other compensation details—qualifies as personal data because it relates to identifiable individuals. This means any disclosure of pay data must comply with GDPR principles, particularly:

• Lawfulness, fairness, and transparency (Article 5(1)(a))
• Purpose limitation (Article 5(1)(b))
• Data minimization (Article 5(1)(c))
• Security (Article 32)

The PTD, however, pushes for greater transparency, which can conflict with these principles. For example, when an employee requests pay information for a comparator group of only two or three people, disclosing average pay may effectively reveal an individual's exact salary—a clear breach of data minimization and potentially the rights of that comparator.

Emerging National Approaches: A Patchwork of Interpretations

As member states transpose the PTD, three distinct approaches are emerging, as highlighted in recent legal analysis:

1. No Defined Threshold (e.g., Italy)

Some countries, like Italy, incorporate Article 12(3) of the PTD without setting specific numerical thresholds for what constitutes a 'sufficiently large' comparator group. This leaves employers to balance transparency against privacy on a case-by-case basis, creating significant legal uncertainty.

2. Numerical Thresholds (e.g., Germany, France)

Other countries, including Germany and France, are considering or implementing numerical thresholds. For instance, they may require that pay data be aggregated only when a comparator group reaches a certain size (e.g., 10 or more employees) to prevent individual identification. This approach offers more clarity but may limit the usefulness of the information for employees in small teams.

3. Transparency-First (e.g., Netherlands)

A third approach, seen in the Netherlands, assumes that the PTD's requirements inherently satisfy GDPR, arguing that the directive itself provides a legal basis for processing. However, this stance may not hold up in practice, especially when individual pay can be inferred.

The European Commission's FAQs assert that the PTD does not infringe GDPR, but they don't resolve operational challenges. Employers must navigate this uncertainty, especially in countries with no clear guidance.

Practical Steps for GDPR-Compliant Pay Transparency

Regardless of the national approach, there are concrete steps employers can take to balance PTD obligations with GDPR compliance:

1. Conduct a Data Protection Impact Assessment (DPIA)

Given the high risk to individuals' rights, a DPIA is mandatory before implementing pay transparency processes. Your DPIA should:

• Assess the necessity and proportionality of the processing.
• Identify risks to individuals, such as re-identification or discrimination.
• Define mitigating measures, such as anonymization or aggregation.

2. Establish a Clear Legal Basis

Under GDPR, you need a lawful basis for processing pay data. For PTD compliance, the most likely bases are:

• Legal obligation (Article 6(1)(c)): When national law transposing the PTD explicitly requires disclosure.
• Legitimate interest (Article 6(1)(f)): For voluntary transparency initiatives, but you must balance interests and document the assessment.

If you process special category data (e.g., disability status for pay gap analysis), you'll need an additional basis under Article 9.

3. Apply Data Minimization and Aggregation

Where possible, aggregate pay data to prevent identification of individuals. For small comparator groups, consider providing ranges rather than exact averages, or use anonymization techniques.

4. Update Privacy Notices

Inform employees about the new processing of pay data, including the purpose, legal basis, and their rights. Update your privacy notices to reflect PTD-related activities.

5. Implement Strict Access Controls

Limit access to pay data to authorized HR and legal personnel. Use role-based access controls and audit logs to ensure only those who need the data can see it.

6. Prepare for Employee Rights Requests

Employees have the right to access their own data (Article 15), but also the right to object to processing of their data by others. When responding to pay transparency requests, ensure you don't violate the rights of other employees.

Regulatory Expectations: Lessons from CNIL's Guidance

European data protection authorities are increasingly scrutinizing employer data practices. For example, France's CNIL has issued guidance on collaborative tools, emphasizing that employers must respect data minimization and purpose limitation when monitoring employees. While not directly about pay, this guidance signals that DPAs expect rigorous compliance with GDPR principles in the workplace.

Similarly, the European Data Protection Board (EDPB) has indicated that pay data processing for transparency purposes must be carefully balanced. Expect DPAs to issue more specific guidance as transposition progresses.

Key Takeaways

• The PTD's transposition deadline is 7 June 2026—prepare now, even if your member state hasn't finalized legislation.
• Pay data is personal data under GDPR, so any disclosure must comply with GDPR principles.
• National approaches to balancing transparency and privacy vary; monitor developments in every jurisdiction where you operate.
• Conduct a DPIA, establish a clear legal basis, and implement data minimization and access controls to reduce risk.
• Stay informed about regulatory guidance from DPAs and the European Commission.

Managing Cross-Functional Compliance with AIGovHub

Navigating the intersection of pay transparency and GDPR requires coordination across HR, legal, and data protection teams. AIGovHub's platform can help you stay ahead of regulatory changes and build a compliant framework.

Use our HR Compliance Checker to assess your readiness for the PTD, and our Privacy Impact Assessment Tool to conduct DPIAs efficiently. With real-time regulatory alerts across 47+ jurisdictions, you'll never miss a transposition update.

Start building your compliant pay transparency strategy today—because the deadline is closer than you think.

This content is for informational purposes only and does not constitute legal advice.