Guide: sick leave and privacy: how far can an employer go with monitoring?

When an employee in the Netherlands calls in sick, the employer’s ability to monitor them is strictly controlled. The guiding principle is simple: employers manage the absence, not the illness. You can ask when the employee expects to return and discuss how their work will be covered, but you are legally forbidden from asking about the nature or cause of their sickness.

Drawing The Line Between Management And Monitoring

Handling sick leave in the Netherlands can be a real head-scratcher, especially for international employers. The system is built on a delicate balance: the employer's need to keep the business running versus the employee's fundamental right to medical privacy. Getting this distinction right is the very first step toward compliant absence management.

The process involves three key parties, each with a distinct and legally defined role: the employee, the employer, and the occupational physician (bedrijfsarts). Unlike in many other countries, the employer is not the go-to for medical details. This strict separation of duties is a cornerstone of Dutch employment law.

The Key Players and Their Roles

To manage sick leave correctly, it is essential to know who is responsible for what.

• The Employee: Their duty is to report their absence according to company policy. They must also remain available for contact with both their employer and the occupational physician. Critically, they provide medical details only to the physician.

• The Employer: This role is purely administrative and organisational. You record the absence, arrange for the occupational physician's involvement, continue to pay wages, and help create a reintegration plan based on the physician's non-medical advice.

• The Occupational Physician (Bedrijfsarts): This is the independent medical expert. They assess the employee's health, determine their capacity for work, and advise both the employee and employer on the expected duration of the absence and any functional limitations. In short, they are the legal gatekeeper of all medical information.

This flowchart illustrates the clear separation of roles and the flow of information in the Dutch sick leave process.

As the visual shows, medical information flows directly from the employee to the physician. The physician then translates this sensitive data into practical, non-medical advice for the employer.

The Legal Framework

This strict separation isn't just good practice; it's the law. The legal framework in the Netherlands creates a clear line in the sand between managing absenteeism and protecting privacy. Under the Dutch Civil Code and the General Data Protection Regulation (GDPR), employers are explicitly prohibited from asking about an employee’s diagnosis or medical history.

Only a bedrijfsarts is permitted to process this sensitive health data. They can only share limited, practical information with the employer, focusing on fitness for work and functional limitations. You can learn more about recent trends in Dutch sick leave reporting in this iamexpat.nl article.

In essence, the Dutch system forces employers to focus on what an employee can do, rather than why they cannot work. This shifts the focus from medical diagnosis to functional capacity, protecting privacy while supporting a structured return to work.

The table below breaks down exactly what information each party is permitted to handle.

Employer Vs Occupational Physician Information Access

Information Type	Employer (Permitted)	Occupational Physician (Permitted)
Start/End Date of Sickness	Yes, for payroll and administration.	Yes, as part of the medical assessment.
Expected Return Date	Yes, a general estimate.	Yes, a professional medical prognosis.
Diagnosis/Cause of Illness	No, strictly forbidden.	Yes, this is core to their assessment.
Contact Details/Address	Yes, for staying in touch.	Yes, for scheduling appointments.
Functional Limitations	Yes, e.g., "cannot lift over 5kg."	Yes, and they translate medical data into these limitations.
Work Adjustments Needed	Yes, based on physician's advice.	Yes, they provide recommendations for adjustments.
General Work Capacity	Yes, "fully unfit," "partially fit."	Yes, they determine the level of capacity.
Medical Treatment Details	No, this is private health data.	Yes, if relevant to work capacity.

This clear division of responsibility ensures that while the employer has the necessary information to manage the operational side of an absence, the employee's sensitive health information remains protected and confidential.

What Lawful Sick Leave Monitoring Looks Like In Practice

It can be a real tightrope walk: managing an employee's absence without crossing the line into prying about their personal health. Thankfully, Dutch law offers a clear framework for what's practical and, more importantly, what's lawful. The guiding principle is simple: any action you take must be strictly necessary for business reasons and must always respect the employee’s medical privacy.

This means employers can—and absolutely should—take certain steps. These aren't about snooping or verifying an illness; they're about managing the ripple effects of that absence on the business.

Permissible Actions for Employers

When an employee calls in sick, you are allowed to carry out activities directly tied to managing their absence and planning for their return. Think of these as routine management, not intrusive monitoring.

• Record Absence Details: You can, of course, legally note the start date of the absence and keep a running count of sick days. This is crucial for payroll and for knowing when long-term sick leave procedures kick in.

• Maintain Reasonable Contact: It's perfectly fine to check in with the employee from time to time. The key is that the conversation must stick to work-related logistics. You can ask about the expected duration of their absence (without asking for medical details) and sort out a handover for their work.

• Engage the Occupational Physician: This isn't just a suggestion; it's a mandatory step. You must report the absence to your occupational health service (arbodienst). They will then have their occupational physician (bedrijfsarts) assess the employee's fitness for work. This is the only lawful channel for getting a professional opinion on their work capacity.

• Discuss Reintegration Possibilities: Once you get non-medical feedback from the bedrijfsarts, you can—and should—start a conversation about the employee's return. This could involve talking about adjusted duties, different hours, or other modifications to ease them back in.

These actions are all above board because they are directly linked to an employer's legal duties, like continuing to pay wages and helping the employee reintegrate into the workplace.

Strictly Forbidden Monitoring Activities

On the flip side, some actions clearly step over the line from sensible management into unlawful surveillance. These activities smash right through GDPR principles that require any processing of health data to be necessary and proportionate, and they can land you in serious legal trouble.

Under Dutch law, an employer's curiosity about an employee's health is never a valid reason for monitoring. The focus must remain on functional capacity and organisational needs, with the bedrijfsarts acting as the sole gatekeeper of medical information.

Here’s a look at what you absolutely cannot do:

• Demand a Doctor's Note: You are not allowed to ask for a note from their GP (huisarts) or any other medical specialist. Medical diagnoses are completely off-limits to the employer.

• Ask About Symptoms or Cause: Direct questions like "What have you got?" or "Is it the flu?" are strictly forbidden. The employee has no obligation to tell you about the nature of their illness.

• Scour Social Media: Actively digging through an employee’s social media profiles for photos or posts that might seem to contradict their sick leave is a major privacy violation. This is seen as collecting health data without any legal basis.

• Use Surveillance Software: Installing software to track an employee’s online activity while they're off sick is incredibly intrusive and almost certainly unlawful. It would never pass the tests of necessity and proportionality.

• Make Unannounced Home Visits: Just showing up at an employee's home to "check on them" is a huge invasion of privacy. This is not a permissible way to monitor an absence.

At the end of the day, lawful sick leave monitoring is about process, not private investigation. It's about tracking dates, keeping professional contact about work logistics, and leaving all medical judgements to the designated occupational physician. Anything more is a step too far.

The Occupational Physician As Your Legal Gatekeeper

In the complex world of Dutch employment law, one person is central to protecting privacy during sick leave: the occupational physician, or bedrijfsarts. This isn't just any doctor an employee might see; they are an impartial, legally required intermediary. It's best to think of them as the sole gatekeeper of sensitive medical information. Their job is to make sure employers get the operational insights they need without ever seeing an employee's private health data.

This setup often surprises international companies new to the Netherlands. Unlike systems where an employer might get a doctor's note detailing an illness, the bedrijfsarts acts as a firewall. Their main duty is to translate a medical situation into practical, non-medical advice for the workplace.

The Physician's Assessment Process

When an employee reports sick, the employer must engage an occupational health service (arbodienst), which then appoints a bedrijfsarts. The physician's assessment focuses entirely on functional capacity, not the medical diagnosis. They are there to answer one core question: what is this employee capable of doing from a work perspective?

Their assessment will look at things like:

• Functional Limitations: Can the employee sit for long periods? Are they able to lift heavy objects? Can they concentrate on complex tasks?

• Work Capacity: Is the employee completely unable to work, or could they handle some duties for a few hours a day?

• Prognosis: What's the likely timeline for recovery and a full return to work?

• Necessary Adjustments: What changes to the workplace or their role would help them return faster and more sustainably?

While the employee is legally required to cooperate with the physician, any medical details shared during the consultation are strictly confidential between them and the doctor. You can explore the specific obligations for both parties in our detailed guide on employee sickness rights and what you need to know.

What The Employer Receives

After this assessment, the employer doesn't get a medical file. Instead, they receive a concise, practical summary known as a terugkoppeling (feedback report). This report is specifically designed to leave out any and all medical information.

The occupational physician's report is a carefully crafted document. It tells the employer how to manage the employee's return to work—focusing on abilities and limitations—without ever revealing the underlying medical cause of the absence.

This feedback gives clear, actionable guidance that respects employee privacy while helping the business plan effectively. It basically translates sensitive health data into a simple operational roadmap.

This unique gatekeeper system ensures that sick leave and privacy can coexist. It protects the employee from intrusive questions while giving the employer the legitimate, non-medical information required to manage their workforce and support a successful return to work.

How GDPR Protects Your Health Data During Sick Leave

When an employee calls in sick, the information about their absence isn't just a simple note for the file. It immediately enters a legally protected space. The General Data Protection Regulation (GDPR) provides the bedrock for sick leave and privacy, setting firm rules for how employers can handle this sensitive information.

The GDPR classifies any data about health as ‘special category data’. This isn't just a bit of legal jargon; it's a classification that grants this information the highest possible level of protection. Think of it as a digital vault: access is severely restricted, and anyone handling it must have a very specific, legally sound reason for doing so.

The Legal Basis for Processing Absence Data

Given these strict protections, you might wonder how an employer can legally process any sick leave data at all. The answer lies in having a clear and lawful basis. For sick leave, employers primarily rely on the grounds of a legal obligation. Under Dutch law, employers are required to continue paying an employee's wages during sickness and must actively work towards their reintegration.

Processing basic absence data—like the start date and expected duration of the leave—is essential to fulfil these duties. Without it, it would be impossible to manage payroll correctly or to kick off the mandatory reintegration process with the occupational physician. To get a better grasp of the foundational rules, you can explore our detailed guide on understanding the General Data Protection Regulation.

The High-Risk Nature of Health Data

Under the GDPR, any system used to monitor or process health data is automatically considered high-risk. This triggers a need for a solid legal basis, strict data minimisation, and often a Data Protection Impact Assessment. While employers can track absence dates, duration, and reintegration steps, they are strictly forbidden from collecting data about symptoms (e.g., “burn-out,” “depression”) or using automated profiling to draw conclusions about someone’s health.

A Data Protection Impact Assessment (DPIA) is essentially a formal risk assessment for privacy. If an employer plans to implement a new system for systematically tracking employee absences, they first need to conduct a DPIA. This forces them to identify and mitigate any risks to employees' data protection rights before the system goes live.

This requirement acts as a crucial check, compelling organisations to think critically about privacy from the outset. It ensures any system for monitoring sick leave is designed with privacy at its core, not as a bolted-on afterthought. To understand the broader context of data protection, it's often useful to review how companies articulate their commitment in their general employer privacy policies.

What Can and Cannot Be Recorded

The principle of data minimisation is central here. In simple terms, it means an employer should only collect and store the absolute minimum information needed for a specific, legitimate purpose. Anything more is a breach.

For sick leave records, this creates a very clear dividing line. It’s important for both employers and employees to understand precisely what information can be kept in a personnel file and what crosses the line into a privacy violation.

Permissible Vs Prohibited Data In Employee Files

Here is a summary of the kind of data employers can and cannot legally record about an employee's sickness absence.

Data Point	Permissible To Record	Legal Rationale
Absence Dates	Yes	Necessary for payroll and to track the duration of the absence as required by law.
Contact Details	Yes	Needed to maintain contact during the absence and for reintegration purposes.
Cause of Illness	No	This is medical information protected under 'special category data'. Only an occupational physician can process it.
Medical Diagnosis	No	Strictly prohibited. An employer has no right to know the specific diagnosis (e.g., flu, back pain, depression).
Workplace Accident	Yes	Employers must record if the absence is due to a workplace accident for insurance and reporting obligations.
Reintegration Plan	Yes	Agreements made based on the occupational physician's advice are necessary for managing the reintegration process.

This table makes the boundaries clear. By adhering strictly to these GDPR principles, employers can meet their legal obligations without infringing on an employee's fundamental right to privacy. The law draws a distinct line in the sand: employers manage the logistics of the absence, but the medical details are left to the medical professionals.

Putting Theory Into Practice: Navigating Tricky Sick Leave Scenarios

Legal principles are one thing, but the real test comes when they meet the messy, unpredictable reality of the workplace. When it comes to sick leave and privacy, employers often run into situations that aren't black and white. Let's walk through a few concrete examples to see how to apply the law correctly when faced with these tricky, grey-area challenges.

The key is always to pause, resist jumping to conclusions, and follow the legally defined process. Direct confrontation or unauthorised snooping is never the right answer and can land you in serious legal trouble.

Scenario 1: The Case of the "Monday Sickness"

An employee has a habit of calling in sick, and you notice it's almost always on a Monday. You’re getting suspicious and start to wonder if the absences are legitimate or just a way to get a long weekend.

What an Employer Cannot Do:
Your suspicion, however understandable, doesn't give you the right to play detective. You absolutely cannot confront the employee with accusations or demand a detailed medical explanation for this pattern. Saying something like, "You seem to be sick every other Monday, what's really going on?" is a direct violation of their medical privacy.

The Lawful Path Forward:
Your concern is valid, but you have to channel it through the correct legal process. The right move is to report the recurring absences to the occupational health service (arbodienst).

Frequent, short-term absences can be a legitimate reason to request an assessment from the occupational physician. The goal isn't to "catch" the employee, but to fulfil your duty of care by finding out if there’s an underlying issue that needs support.

The bedrijfsarts can then schedule a consultation. They are trained to assess these kinds of patterns and can determine if there’s a medical reason for the absences. The physician will then give you non-medical feedback—perhaps advising on work adjustments if a condition is found—without ever revealing the diagnosis.

Scenario 2: The Social Media Holiday Post

An employee is on sick leave, citing stress and burnout. A week later, you see photos of them on a friend's public social media profile, smiling on a beach in Spain. You feel deceived and are tempted to take immediate action.

What an Employer Cannot Do:
It's unlawful to use a social media post as grounds for disciplinary action without proper medical context. You can’t just call the employee and demand an explanation or stop their sick pay based on a single photo. For all you know, a holiday or a trip might even be part of a doctor-recommended recovery plan.

The Lawful Path Forward:
You should immediately forward this information to the occupational physician. It is the physician's job—and theirs alone—to evaluate this new information in the context of the employee's medical condition.

The bedrijfsarts can contact the employee to discuss the trip and assess whether it is compatible with their recovery. Based on this professional medical judgement, the physician will advise you on the employee’s fitness for work. You must wait for this official guidance before making any decisions about their sick leave status.

Scenario 3: Suspicions of Working a Second Job

You suspect an employee on long-term sick leave is secretly working a second, cash-in-hand job. A colleague mentioned seeing them at a local market, seemingly working at a stall.

What an Employer Cannot Do:
You cannot hire a private investigator to follow the employee or install monitoring software on their company laptop to track their activity. That kind of surveillance would be a severe breach of privacy and almost certainly illegal. Acting on hearsay from a colleague is also not a valid basis for taking action.

The Lawful Path Forward:
Once again, the concern must be raised with the occupational physician. The physician is entitled to ask the employee about any other activities they are undertaking during their sick leave, as this is relevant to assessing their overall work capacity. If the employee is indeed working elsewhere, it could affect their reintegration obligations.

If the physician confirms that the employee is performing work that contradicts their reported limitations, they will inform you. Only then, with a professional assessment in hand, can you consider disciplinary measures, such as stopping wage payments or even dismissal for cause (ontslag op staande voet). Without this crucial step, any action you take would be on very shaky legal ground.

Understanding Employee Rights And Employer Risks

When the delicate balance between managing sick leave and respecting an employee's privacy is upset, the consequences can be severe. Unlawful monitoring isn’t just bad practice; it’s a direct violation of fundamental rights that can trigger serious legal and financial penalties. For everyone involved, understanding these rights and risks is the first step toward building a compliant and trust-based workplace.

For employees, the feeling of being unfairly watched while unwell can be deeply distressing. It's crucial to know that Dutch law provides clear avenues for recourse if you suspect your privacy has been breached.

On the other side of the coin, employers who ignore the strict rules around sick leave and privacy are taking a massive gamble. The risks go far beyond a simple warning, potentially leading to steep fines, legal challenges, and lasting damage to the company's reputation.

What Employees Can Do

If you believe your employer has crossed a line—perhaps by demanding specific medical details, checking your social media, or pressuring you for information only the occupational physician is entitled to—you have several options.

• Internal Complaint: The first port of call is often to raise the issue internally. This could be with a manager, the HR department, or a trusted representative (vertrouwenspersoon).

• Formal Grievance: If an informal chat doesn't resolve the situation, you can file a formal written grievance with your employer, clearly outlining your privacy concerns.

• Dutch DPA Complaint: You have the right to file a formal complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens or AP). The AP is empowered to investigate and can impose significant penalties on non-compliant organisations.

• Legal Action: In more serious cases, you might seek legal advice to explore taking the matter to court, which could result in compensation for damages.

A key part of asserting these rights is understanding the core tenets of fundamental workplace privacy principles.

The High Stakes for Employers

Employers who disregard the rules on sick leave monitoring are exposing their business to substantial risks. The potential fallout is not something to be taken lightly and can impact the business on multiple fronts.

The GDPR isn't just a set of guidelines; it has real teeth. Fines for serious breaches involving 'special category data'—which includes all health information—can reach up to €20 million or 4% of the company's annual global turnover, whichever is higher.

Beyond the threat of massive fines, there are other serious risks to consider:

• Inadmissible Evidence: If an employer gathers evidence of misconduct through unlawful monitoring (for example, finding incriminating social media posts), a court is very likely to rule that evidence inadmissible in any subsequent dismissal case. This could cause the entire legal case against an employee to collapse.

• Reputational Damage: News of a company snooping on its sick employees can spread like wildfire, severely damaging its reputation and making it difficult to attract and retain top talent. Trust, once broken, is incredibly difficult to rebuild.

• Employee Relations Breakdown: An atmosphere of suspicion is toxic for any workplace culture. It erodes morale, drives up staff turnover, and can lead to a complete breakdown in the employer-employee relationship.

It's also important to remember these privacy rules apply to all forms of communication. For more on adjacent issues, you might be interested in our article on whether your employer can read your WhatsApp messages.

Ultimately, creating a clear, transparent, and legally sound sick leave policy is the best protection for everyone. It ensures everyone knows their rights and responsibilities from the outset, fostering a culture of trust and mutual respect that benefits the entire organisation.

Frequently Asked Questions

When you're off sick, it’s natural for questions about privacy and what your employer can and can’t do to pop up. Let's tackle some of the most common ones that arise when an employee is on sick leave.

Can My Employer Contact Me About Work While I Am Sick?

Yes, they can, but there are strict boundaries. Your employer is allowed to call you about practical, work-related matters. A classic example is calling to arrange a handover for urgent tasks or to get an idea of how long you might be off so they can organise cover.

What they absolutely cannot do is turn the conversation into a medical interrogation. Your employer is legally barred from asking about your symptoms, what your doctor said, or the specifics of your illness. The purpose of any contact has to be purely organisational, not an investigation into your health.

What If I Disagree With The Occupational Physician's Assessment?

If you feel the occupational physician (bedrijfsarts) has got it wrong about your fitness for work, you don’t have to just accept it. You have the right to ask for a second opinion, known as an 'expert opinion' (deskundigenoordeel), from the Employee Insurance Agency (UWV).

This is an independent assessment that either you or your employer can request. The UWV will then provide a binding opinion on the matter. This can be a critical step in settling disputes over your capacity to work or whether the reintegration tasks being suggested are actually suitable for you.

Can My Employer Use Software To Monitor My Activity While On Sick Leave?

Using software to check up on an employee's computer activity while they're on sick leave is almost always illegal under Dutch law and the GDPR. It’s seen as a major invasion of privacy and would fail the crucial legal tests of necessity and proportionality.

Simply put, your employer has no legitimate reason to track your digital movements to "verify" you're genuinely ill. The only lawful way to assess your work capacity is through the occupational physician. Any kind of digital surveillance during sick leave would be a fast track to a complaint with the Dutch Data Protection Authority.

Are Privacy Rules Different For Short-Term Versus Long-Term Sick Leave?

No, the fundamental privacy rules don't change whether you're off for a day or a year. An employer is never allowed to ask for medical details. Your health data is always classed as 'special category data' under the GDPR, which means it gets the highest level of protection.

The main difference you'll see is in the procedure. As an absence becomes long-term (approaching the two-year mark), the reintegration process gets more formal, involving detailed plans and regular reviews with the UWV. But the core principle never changes: the occupational physician is the one and only gatekeeper of your medical information, from start to finish.

---

At Law & More, we understand that navigating Dutch employment law can be complex, especially when it involves sensitive issues like sick leave and privacy. Our team of expert lawyers is dedicated to providing clear, practical legal advice to help both employers and employees understand their rights and obligations. If you are facing a challenging situation or need to ensure your company policies are fully compliant, we are here to help.

For expert legal guidance on employment matters, visit us at https://lawandmore.eu.