A Journey From Data Privacy to Pay Transparency – The Legal Odyssey Unfolding Across Europe

Just when global compliance teams were getting comfortable with the alphabet salad of GDPR (General Data Protection Regulation), a new three letter contender has burst onto the scene: the Pay Transparency Directive (PTD). Even if your organization only has a small workforce in Europe, you will need to get used to this one too.

The deadline for the implementation of the EU Pay Transparency Directive passed on June 7, 2026, although implementation across European member states has been patchy. Only a small number of member states have fully transposed the PTD, some countries have signaled a delay, all while others have provided no update at all.¹

The introduction of the PTD heralds a new dawn in pay transparency across Europe, with binding measures such as broad pay reporting requirements, joint pay assessments, and–of particular interest for this article–the right for workers to request information on individual and average pay levels (the “Right to Information,” or “RTI” to add to your acronym index).

However, this presents a tension:

• The EU loves data privacy; the GDPR has set up a framework of protections and protocols that regulates the processing and disclosing of personal data within the EU.
• Pay information is personal data (albeit ordinary and not special category personal data).
• The PTD wants pay information to be more freely available, with RTI proving key in driving pay data information from employers to employees.

In a battle between two Brussels-based behemoths such as these, can the tension between protecting personal data and being open about pay be resolved?

Navigating the Privacy/Transparency Tension

The starting point is that in the hierarchy of laws, a regulation (like the GDPR) trumps a directive or national implementing legislation in EU member states.

The PTD itself also recognizes the issue. Article 12 expressly provides that any personal data processed when employers are complying with the PTD must comply with the GDPR and be processed solely for the purpose of applying the principle of equal pay.

Importantly, under Article 12(3), where disclosure pursuant to those provisions would lead, directly or indirectly, to the disclosure of the pay of an identifiable worker, member states may (but are not required to) provide that access to the information is restricted to workers’ representatives, the labor inspectorate, or the equality body. In such circumstances, the workers’ representatives or equality body may advise workers on a potential claim without disclosing comparator pay information.

However, because the PTD grants member states broad discretion to decide how this safeguard should operate, we are not yet seeing a clean and consistent approach. Instead, there are three approaches emerging: (1) incorporating Article 12(3) without a defined threshold; (2) having numerical minimum thresholds; and (3) taking a transparency-first approach.

1. Restriction with No Defined Threshold 
    
   Some countries are proposing to incorporate Article 12(3), but do not currently appear to prescribe a minimum numerical threshold to prevent the disclosure of identifiable pay information. In practice, this leaves employers needing to determine internally how to balance the PTD’s transparency objectives with GDPR obligations. This is the case in Italy where further ministerial decrees are needed to understand how this will operate in practice.
2. Numerical Threshold Models 
    
   A different model can be seen in jurisdictions where numerical thresholds are being considered or inferred from existing law. The German Expert Commission advising on the PTD recommends retaining a minimum threshold of six people for comparison groups when implementing the PTD (although it is unclear if this is six in total, or six men and six women). France appears to be taking a similar path, but the threshold number has not yet been published.
3. Transparency-First or No Additional Restriction Approach 
    
   Some jurisdictions are proceeding on the basis that the PTD itself meets GDPR requirements because the processing of personal data is necessary to give effect to the principle of equal pay and to enable workers to exercise their rights effectively. It approaches the question by taking the view that there is no less intrusive way to achieve meaningful transparency and that the benefits of transparency outweigh the relevant privacy concerns. In such countries (e.g., the Netherlands), employers will need to provide pay data to workers even if it potentially identifies the pay of another worker in the process.

It is this third approach which is causing the most consternation. In a recent update from the Commission, the Frequently Asked Questions (FAQs) suggest the GDPR and the PTD can work in tandem without additional safeguards or thresholds[EMR21.1]:

The Directive does not ever require disclosing individual pay data, only average pay levels in categories of workers. In situations where there might be a risk of disclosure of personal data, when the number of comparators (co-workers performing the same work or work of equal value) is very small, the Directive does not infringe the General Data Protection Regulation.

This is a little difficult to square in practice. For example, if the average pay is disclosed in a category of two, assuming one of those individuals lodged the right to information request, the requestor could patently work out the pay of the other worker.

What This Means for Employers

Although the guidance in the FAQ document represents only preliminary views and is not legally binding, the response is clear – “the Directive does not infringe the General Data Protection Regulation.”

This will give some comfort to data protection teams, but every organization must consider their own legal obligations and answer the following question: can the pay data of one worker be lawfully disclosed (albeit indirectly) to another worker under GDPR principles?

In most cases, the answer is likely to be “yes” – subject to any local legislation which states otherwise. Provided there is a lawful basis to process and disclose a worker’s personal data (such as complying with the legal obligations of the PTD), employers have the legal right to disclose such data. As mentioned above, pay data is ordinary personal data and as such, processing requires a lawful basis, which in our view is in most cases likely to be that processing is necessary for compliance with a legal obligation to which the employer is subject.

However, employers will need to carefully consider their data sets and cases where there are small numbers of employees of a certain gender, where special attention should be paid to any data that is shared. Employers should ensure that their privacy notices are updated to ensure that transparency requirements are complied with under GDPR and ensure that managers and stakeholders are trained on the employer’s legal obligations and the potential risks.

Different jurisdictions will take different paths when deciding how to balance such competing interests. This makes a consistent approach for multijurisdictional employers very difficult, or even impossible. It therefore remains one of the core problematic aspects of local implementation of the PTD for most employers.

However, we have seen that with careful planning and bespoke approaches in each hiring location, compliance is possible. And it needs to be as neither the PTD nor the GDPR are going anywhere, and we are all going to have to learn how to make them get along.