September 6, 2026
Category:
Pay TransparencyAuthor:
Adam Seoudi
/
Head of CX
The EU Pay Transparency Directive gives employees a right to meaningful information about pay. It does not give them a right to discover a named colleague's remuneration.
Those two propositions are compatible. Article 7 of Directive (EU) 2023/970 entitles a worker to receive information on their individual pay level and the average pay levels, broken down by sex, for the category of workers performing the same work or work of equal value. Article 12 recognises that even an average can reveal another identifiable worker's pay and allows Member States to create a restricted route through workers' representatives, a labour inspectorate or an equality body.
The responsibility for managing this tension rests primarily with the employer. The employer controls the pay data, determines the response process and usually acts as the controller under the GDPR. It must organise that process so that it complies with the employee's statutory information right without unlawfully revealing another person's pay. A failure may create exposure under the national rules implementing the Directive and, depending on the circumstances, under data-protection law.
The hard practical question is: when does an average pay level stop functioning as an aggregate and become an indirect disclosure of personal data?
The answer is not simply "when there is only one woman or one man". A one-person sex cell is the clearest case, but exact disclosure can also occur with two people, with a larger cell containing known pay values, or by combining overlapping averages. Conversely, a small group does not always reveal an exact individual figure. Employers need both a consistent numerical screen and a documented contextual assessment.
Article 7 of Directive (EU) 2023/970 gives workers the right to request and receive in writing:
The Directive defines "pay level" as gross annual pay and the corresponding gross hourly pay. Its broader definition of "pay" covers ordinary basic or minimum salary and any complementary or variable components received directly or indirectly from the employer, whether in cash or in kind.
The practical consequence is important. The employer must use the legally required scope of remuneration when calculating the pay level, but Article 7 does not itself say that every component must be disclosed as a separate average. In a standard Article 7 response, the employee-facing comparison is therefore based on total pay expressed through the annual and corresponding hourly measures required by the applicable national law.
Separate component figures appear elsewhere in the Directive. Article 9 reporting includes the gender pay gap in complementary or variable components and the category-level gender pay gap broken down by ordinary basic salary and complementary or variable components. Article 10 also requires information on average female and male pay levels and complementary or variable components as part of a joint pay assessment.
Additional detail may also be required by national law or offered voluntarily by an employer. Examples include:
Each additional statistic creates another output that may be combined with the others. An employer should therefore test the information that the employee is legally entitled to receive and separately assess every optional figure before adding it to the response.
Article 12 requires personal-data processing under Articles 7, 9 and 10 to comply with the GDPR. It also limits the use of personal data processed under those provisions to applying the principle of equal pay.
Most importantly, Article 12(3) allows a Member State to decide that where disclosure would lead directly or indirectly to disclosure of the pay of an identifiable worker, only workers' representatives, the labour inspectorate or the equality body may access that information. Workers' representatives or the equality body may then advise the employee about a possible equal-pay claim without disclosing the actual pay level of another worker.
This is an option for Member States, not one uniform EU procedure. National approaches can therefore differ materially.
The Netherlands is a particularly important example. Its bill expressly recognises that the average for a very small group may reveal an identifiable person's pay, including where only two employees are in the relevant comparison. Nevertheless, the Dutch government chose not to implement the restricted route in Article 12(3). It treats the national statutory obligation as the GDPR legal basis for the disclosure and gives greater weight to the worker's direct access to information, combined with purpose limitation. This approach is unusual among the national texts reviewed and shows why a multinational employer cannot apply one suppression rule in every country. See the Dutch explanatory memorandum to Bill 36 949.
Slovakia takes the opposite route. Its law states that the employee-facing average does not have to be provided where it would allow another specific employee's pay level to be determined. In that situation, access is limited to workers' representatives, the labour inspectorate and the Slovak National Centre for Human Rights, which may advise the worker without revealing the protected pay information. See sections 6 and 10 of Slovak Act 76/2026.
Italy adds a further variation. Article 7(8) of Legislative Decree 96/2026 states that, to prevent direct or indirect identification, employers with up to 49 employees may provide the information using the method to be defined under Article 9(4). This does not remove the worker's right to information, and 49 is not a minimum comparator-group size. It is an employer-size threshold linked to the method of providing information. See Article 7 of Italian Legislative Decree 96/2026 and Article 9(4).
Article 12(3) refers to access to "that information", but it does not explain how a response must be divided when only one part creates an identification risk. It does not expressly state that the employer must always send the worker's own pay level and every non-identifying comparison figure directly while routing only the risky element through a representative or authority.
Article 7 separately creates the right to the employee's individual pay level and the relevant averages. The interaction between those provisions must be resolved under the applicable national implementing legislation.
A partial response may be proportionate and transparency-supporting where national law requires or permits it. It should not, however, be described as an express EU-level obligation. The employer should document whether its approach is required by national law, permitted as an internal practice or still legally uncertain. It should also verify that the figures released directly cannot be combined to reconstruct the restricted information.
The safest way to understand the problem is to work through exact annual total-pay examples. Each example assumes the same pay definition, employee population and reference period. Changing any of those assumptions can change the result.
The basic formula is:
Group pay total = average pay level x number of employees in the cell
If every value except one is known:
Unknown pay = group pay total - sum of known pay values
A category contains eight men and one woman. The female average annual pay level is EUR 60,000.
EUR 60,000 x 1 = EUR 60,000
The "female average" is her exact annual pay level. Calling the figure an average or omitting her name does not anonymise it.
There are two women in the category. The requester earns EUR 55,000 and the female average is EUR 60,000.
(EUR 60,000 x 2) - EUR 55,000 = EUR 65,000
The requester can calculate that the other woman earns EUR 65,000. A threshold of two per sex therefore does not protect the other employee where the requester is included in the average.
There are three women. Their average is EUR 60,000 and the requester earns EUR 54,000.
(EUR 60,000 x 3) - EUR 54,000 = EUR 126,000
The requester learns only that the other two women earn EUR 126,000 in total. On those facts alone, neither individual pay level can be calculated. Many pairs fit the result, including EUR 60,000 and EUR 66,000, EUR 61,000 and EUR 65,000, or EUR 63,000 and EUR 63,000.
Suppose, however, that one of those two colleagues has voluntarily disclosed an annual pay level of EUR 61,000 for the same period:
EUR 126,000 - EUR 61,000 = EUR 65,000
The third woman's pay is then revealed exactly. The privacy result depends not only on headcount but also on information reasonably available to the recipient.
There are five women and their average annual pay is EUR 60,000. Four of the values, including the requester's own pay, are already known and each is EUR 58,000.
(EUR 60,000 x 5) - (EUR 58,000 x 4) = EUR 68,000
The fifth woman's annual pay is EUR 68,000. This is why five can be a useful screening threshold but cannot be treated as automatic permission to disclose.
For the same period, the employer provides an average of EUR 60,000 for a six-woman category and an average of EUR 58,000 for an identifiable five-woman subgroup within it.
EUR 60,000 x 6 = EUR 360,000
EUR 58,000 x 5 = EUR 290,000
EUR 360,000 - EUR 290,000 = EUR 70,000
If the recipient can identify the one worker excluded from the subgroup, her annual pay is revealed as EUR 70,000. Each output may look sufficiently aggregated in isolation. Together, they are not.
In month one, a category contains four women whose average hourly pay is EUR 30. In month two, one new woman joins, nobody leaves and the published average rises to EUR 32.
If the four existing employees' hourly values are unchanged:
Month one total of individual hourly values = EUR 30 x 4 = EUR 120
Month two total of individual hourly values = EUR 32 x 5 = EUR 160
New employee's hourly value = EUR 160 - EUR 120 = EUR 40
Repeated outputs can therefore reveal the pay of a new joiner even where the current group contains five people.
This conclusion must be applied carefully to rolling reference periods. When the calculation window moves by one month, the values attributed to existing employees may also change because one month drops out and another enters. The subtraction is exact only if those existing values remain unchanged or are otherwise known. Even when exact reconstruction is impossible, the second output may materially narrow the range for the new employee's pay.
Return to the two-woman example. Assume the displayed average is EUR 60,000 rounded to the nearest EUR 1,000 and the requester earns exactly EUR 55,000.
The true average lies from EUR 59,500 up to, but not including, EUR 60,500. The other woman's pay must therefore lie between:
(2 x EUR 59,500) - EUR 55,000 = EUR 64,000
and
(2 x EUR 60,500) - EUR 55,000 = EUR 66,000
Rounding changes an exact disclosure into a range from EUR 64,000 to just under EUR 66,000. That may still identify pay with meaningful precision. Deliberately rounding a statutory answer may also be inconsistent with national accuracy requirements.
Where the requester is included in the same sex cell, the amount of additional information needed to reconstruct one colleague's pay changes with the group size:
This explains why larger cells generally reduce routine risk. It does not create a mathematically guaranteed safe size. An overlapping output that differs by one identifiable employee may reveal that person's value without the requester knowing any individual salaries in advance.
An employer will not know everything the recipient knows. It should not attempt to investigate workplace gossip or assume access to every theoretically obtainable fact. The relevant assessment concerns means reasonably likely to be used and information reasonably available in context, including:
The employer should record the realistic inference route. It should not rely on an unsupported statement that a group is "too small" or that every average for three, four or five people automatically reveals a salary.
The EDPB Guidelines 02/2026 on Anonymisation are unusually relevant because they include a worked salary example involving aggregate employer data.
Their status must be described accurately. Version 1.0 was adopted by the EDPB on 7 July 2026 for public consultation. The consultation runs until 30 October 2026. The document is therefore an official EDPB draft, not final guidance, and it may change after consultation.
The draft does not interpret Directive 2023/970 specifically. It does not establish a minimum pay-disclosure cell size or determine how a Member State must implement Article 12(3). Its practical value is that it provides a structured GDPR framework for asking whether apparently aggregated information is genuinely anonymous from the relevant recipient's perspective.
The EDPB describes two possible approaches.
Under the simplified approach, the controller does not differentiate between the capabilities of different parties who might identify a person. This is conservative and convenient. It may treat information as non-anonymous even where a particular recipient could not realistically identify anyone.
Under the contextual approach, anonymity is assessed separately from the perspective of each relevant entity based on the information and capabilities realistically available to that entity. For an Article 7 response, the worker receiving the report is a central perspective. A statistic may be anonymous to the public but identifying to a colleague who knows the category's composition.
The two approaches can be combined. An employer may use a conservative threshold as the simplified first screen, then perform a contextual review where the screen is triggered or where other risk indicators appear.
The draft uses three criteria:
If all three criteria are passed under the selected approach, the EDPB says that the data can safely be considered anonymous. If one criterion fails, further analysis is required. Failure does not by itself mean that the information must automatically be classified as personal data in every context.
That nuance fits the pay-transparency problem. A cell below the employer's threshold should trigger review, but the employer should still identify the real route to disclosure. Equally, a cell above the threshold cannot be cleared merely because it contains five, six or ten people.
Example 16 in the draft works as follows:
The sixth engineer's annual salary is:
EUR 550,000 - EUR 480,000 = EUR 70,000
Both source figures are aggregates. Neither report names the sixth engineer or contains an individual row. Nevertheless, anyone with both reports who can identify the engineer outside Product Engineering can infer that person's exact annual salary.
The failure does not arise simply because a group has fewer than five people. One aggregate covers six and the other covers five. The problem is that the groups overlap and differ by exactly one identifiable person.
Example 21 returns to the same facts to explain the contextual approach. If the internal report is public, the No Inference criterion is violated from the perspective of everyone able to use it. If access is effectively restricted and there is no other realistic path to the same information, the criterion may be violated only from the perspective of entities that can access both figures.
The EDPB example uses total salary expenses, while Article 7 requires average pay levels broken down by sex. The arithmetic is nevertheless transferable where the recipient also knows the cell size:
Average pay level x cell size = aggregate pay for the cell
If the employee receives two overlapping averages for the same measure and period, knows both cell sizes and can identify the person present in only one cell, the employee can subtract the reconstructed totals. This can arise through:
The employer should therefore assess the portfolio of outputs accessible to the recipient, not only the document awaiting approval.
The national examples below should not be averaged into one European threshold. They concern different statistics, audiences and legal processes.
.png)
Sources: Dutch Bill 36 949 explanatory memorandum, Slovak Act 76/2026, Italian Legislative Decree 96/2026, Finnish July 2026 proposal, Finnish Ombudsman guidance, Sodra guidance, German sections 11 and 12 EntgTranspG and Norwegian Bufdir guidance.
Neither number is universally correct.
Where national law does not prescribe another approach, five employees per sex is a reasonable screening point. It appears in Finnish legislative reasoning as an illustrative statistical practice and broadly corresponds with Norwegian guidance. Six per sex is a more conservative multinational screen and aligns with the existing German rule, although that German rule concerns a median under a different regime.
The difference should not be overstated. Neither five nor six prevents inference when enough values are known, when groups overlap or when outputs are repeated after one identifiable person joins or leaves.
The threshold should therefore operate as a triage rule:
The threshold applies to each sex cell, not to the whole category. If a category contains 23 men and four women, a five-person screen flags the female average even though the total headcount is 27.
An employer may select another number, but it should be able to defend the choice using actual disclosure risk, workforce structure, national law and the need to preserve an effective information right. A blanket threshold of 10, 15 or 20 per sex may suppress most meaningful comparisons in many organisations and may be difficult to justify without evidence that a lower threshold creates a genuine risk.
Where national law implements Article 12(3), identifying information may still be provided to the authorised workers' representative, labour inspectorate or equality body. The representative or equality body can advise the worker about a possible equal-pay claim without revealing the protected pay level.
This creates a difficult practical question. What happens if the authorised body cannot reveal the underlying figure but advises the worker that there may be an unjustified pay difference? The worker may decide to pursue a formal claim with limited visibility of the evidence.
Article 20 of the Directive addresses the later evidential stage. National courts or competent authorities must be able to order disclosure of relevant evidence, including confidential information, where it is relevant to an equal-pay claim. They must also have measures to protect that information. This does not mean that the employee will automatically receive every internal report without restriction. Access will depend on national procedural law and the safeguards imposed by the court or authority. It does mean that restricted employee-facing access is not necessarily the end of equal-pay scrutiny.
Identify employees performing the same work or work of equal value using objective, gender-neutral criteria such as skills, effort, responsibility and working conditions. Do not enlarge, merge or redraw the category merely to cross a privacy threshold.
Privacy controls must operate on the legally valid comparator group. Combining unrelated roles may conceal a small cell, but it can also make the response substantively incorrect.
Use the pay-level definition and calculation method required by the Directive as transposed nationally. Record:
This is essential for both accuracy and the privacy assessment. An inference is exact only where the compared figures use compatible measures, populations and periods.
Calculate the requester's individual pay level and the female and male average pay levels required under national law. Count women and men separately. Apply any binding national rule before applying the organisation's internal screen.
Flag every sex cell below the selected threshold. The flag should initiate review, not generate an unexplained refusal. Also flag one-person differences between earlier and current populations even where both cells meet the threshold.
For every flagged output, and for other outputs presenting an overlap or known-value risk, ask:
Record the concrete inference path rather than relying only on labels such as "small group", "unique role" or "outlier".
Where there is no material identification risk, provide the required information accurately and within the applicable deadline.
Where disclosure would identify another worker's pay, follow the applicable national rule. This may require providing information only to a workers' representative, labour inspectorate or equality body. In another country, including under the Dutch proposal, the law may require direct disclosure despite the identification risk.
Do not assume that Article 12(3) authorises an employer-created refusal mechanism where the Member State has not implemented it.
Do not respond only that "the GDPR prevents us from answering". Where legally appropriate, explain:
Avoid volunteering the exact cell count if the number is not legally required and would itself help identify a colleague.
Log the requester, category, period, pay measure, cell counts, output, decision, approver and recipients. A later request may become sensitive only because of what was disclosed earlier.
The history should support checks for:
The log itself is sensitive. Access should be limited, security controls applied and retention tied to a documented legal and operational need.
Component-level analysis matters, but it should not be confused with the standard Article 7 response.
If national law, Article 9 reporting, a joint pay assessment or an optional employer breakdown requires separate figures for bonus, overtime, commission or allowances, run the privacy test again for every disclosed statistic. A total-pay cell containing 10 women does not make a relocation-allowance figure safe where only one woman received that allowance.
For each component output, check:
Component-level risk does not automatically mean that every figure in the Article 7 response creates the same risk. Whether total-pay averages can still be disclosed depends on national law and whether the remaining figures would reconstruct the restricted information.
Rounding may replace an exact value with a narrow interval. It does not guarantee anonymity and may make a statutory response inaccurate or incomplete.
A broad pay band reduces precision, but it is not automatically a substitute for the average pay levels required by Article 7.
Withholding the exact group size can be useful. A category of workers often extends beyond the requester's immediate team, and the worker may not know everyone included in it. Without the cell count, the simplest multiplication and residual calculation becomes harder.
This is not a complete solution. The requester may infer the population from other sources, and omitting the count can make the result more difficult to interpret. The employer should therefore decide consistently whether headcount is legally required, operationally helpful and safe to disclose.
Instructions limiting the use of the information to equal-pay purposes may reduce misuse and are expressly contemplated by the Directive. They do not undo a disclosure already made to the requester. They complement disclosure control rather than replace it.
Noise and differential privacy can be valuable in public statistics. They should not be used to invent or deliberately alter an individual employee's statutory comparison figure. Article 7 gives workers a right to request reasonable clarifications where information is inaccurate or incomplete. A lawful restricted route is preferable to supplying a perturbed number.
Pay is not automatically special-category data under Article 9 GDPR, but it is sensitive personal data in the ordinary sense and can materially affect employees. The process should therefore be designed around the GDPR principles and the relevant national legal basis.
An employer should address at least the following:
A written policy shows that privacy decisions were defined in advance, applied consistently and not invented after an uncomfortable request arrived.
The policy should state:
The reviewer should record a concrete reason. "Cell below five" may justify escalation, but it should not automatically justify final suppression where national law requires a contextual test or direct disclosure. For a cell at or above five, the record should identify any actual inference route, such as a new five-person subgroup and a previously released six-person average differing by one known employee.
This protects the employer from two opposite errors - disclosing a colleague's pay and using privacy as an unreviewable reason to obstruct an employee's information right.
For each request:
PayGap allows employers to configure a minimum group size for employee pay-information requests. This provides a consistent first-line screen aligned with the employer's documented policy and the rules selected for the relevant jurisdiction.
The threshold is only the beginning. PayGap also allows authorised HR users to review an employee's earlier requests and the information previously made available to that employee. This helps HR identify repeated, overlapping or sequential requests that may create a disclosure risk when combined.
The system automatically flags requests that meet the configured sensitivity conditions and prevents the sensitive report from being released through the employee-facing workflow. In those cases, the report can be downloaded only by authorised HR users, who can review the facts, apply the relevant national route and document the decision.
This gives employers:
Automation does not replace the legal and contextual assessment. It makes that assessment manageable, consistent and auditable, while reducing the manual workload involved in screening every request.
If you would like to see how this works in practice, book a PayGap demo using the form at the bottom of this page.
There is no mathematically universal cell size at which an average becomes anonymous. A one-person cell always reveals that person's value. A two-person cell is exactly reversible where the requester knows their own pay. Three people may be safe on the stated facts, but one additional known value can reveal the third. Five people materially reduces routine risk, yet known values or an overlapping output can still reveal the remaining employee.
The defensible approach has two layers: a consistent numerical screen and a case-specific inference assessment. Five employees per sex is a sensible starting point where national law is silent. Six may be used as a more conservative multinational baseline. Either choice must be documented, reviewed against the real disclosure context and adjusted where national law takes a different approach.
The governing principle is straightforward: protect a colleague's personal pay while preserving an effective route to equal-pay scrutiny in the manner required by national law.
This article provides general information and reflects the legal and regulatory material available on 6 September 2026. National implementation of Directive (EU) 2023/970 continues to develop. Employers should verify the law and official guidance applicable in each jurisdiction. This article is not legal advice.
