What this source is
An awareness campaign by the European Agency for Safety and Health at Work, together with a thematic page. It is not a decision, not guidelines, and it introduces no obligations: it informs. We say so at the top because the distinction matters — what follows in the first part is content of the source, what follows in the last part is the writer's reading.
What the source says
Psychosocial risks arise from poor work design, organisation and management, and from a poor social context of work. The page lists ten typical conditions: excessive workloads, conflicting demands and lack of role clarity, lack of involvement in decisions affecting the worker, lack of influence over how the job is done, poorly managed organisational change, job insecurity, ineffective communication, lack of support from management or colleagues, psychological and sexual harassment, and dealing with difficult customers, patients or pupils.
- Stress, anxiety and depression are the second most common work-related health problem affecting European workers.
- Nearly 45% of workers report facing risk factors that can adversely affect their mental health.
- According to the Agency's 2022 OSH Pulse survey, 27% of workers experience stress, anxiety or depression caused or made worse by work. The 2025 round, cited by the campaign, gives 29%, alongside 37% reporting overall fatigue.
- Among the factors found most detrimental to health are unsocial working hours and work intensity.
- The ESENER survey shows psychosocial risks are seen as harder to manage than “traditional” ones, and that micro and small companies tend to underestimate them.
The page presses one point that is not statistical but structural: when psychosocial risk is treated as an organisational issue rather than an individual fault, it can be tackled in the same structured way used for other safety and health risks.
The legal framework the source invokes
Here the page is explicit: managing work-related psychosocial risks is not just a moral obligation and a good investment, it is “a legal imperative set out in Framework Directive 89/391/EEC”, supported by the social partners' framework agreements on work-related stress and on harassment and violence at work. Employers have a legal responsibility to ensure workplace risks are properly assessed and controlled, and involving workers in that process is described as a success factor, not a courtesy.
Directive 89/391/EEC is a directive: it binds Member States as to the result and has been transposed into national law. In Italy the transposition is Legislative Decree 81/2008, whose Article 28 expressly includes work-related stress among the risks to be assessed in the risk assessment document. The obligation has existed since 2008 and the campaign does not change it: what changes is attention, not scope.
From here on this is my reading, not content of the source
The EU-OSHA page does not mention the data protection regulation, does not deal with the collection or assessment of health data, does not mention the data protection officer, and does not claim that companies are measuring their employees' wellbeing. What follows is the writer's reasoning about a possible consequence, and should be read as such.
Why it can land on the desk of whoever handles data
To be assessed, psychosocial risk has to be measured. And the most common instrument for measuring it is a questionnaire to workers. The moment that questionnaire allows a person to be identified, and asks about that person's psychological state, health data is being processed — and consent collected on a company form will rarely do, because in an employment relationship consent is almost always questionable. The campaign does not say this: it is the consequence produced when the campaign works and organisations start measuring.
- Aggregation is not automatic. If a department has six people, the figure “aggregated by department” identifies everyone who works there.
- The anonymous questionnaire that is not anonymous: department, age band, seniority and gender together identify a person in almost any firm under two hundred staff.
- A form administered through the company's own tool carries the identity of the respondent, whatever the screen says.
- Individual results kept after processing: the assessment serves the risk document, not the personnel file.
One question to ask the client
In the past year, have you given employees a questionnaire on climate, wellbeing or stress? If the answer is yes, ask to see the form and the information notice. It takes two minutes to ask, and when the answer is yes it almost always opens a chapter that is not in the record of processing activities.
The campaign is launched on 13 October in Brussels and runs for 2026-2028, within the EU strategic framework on health and safety at work 2021-2027. It looks in particular at new and overlooked occupational groups, sectors and areas: which are also the ones where no procedure exists yet, making them interesting for advisers and uncomfortable for those advised.
Official source:EU-OSHA — Psychosocial risks and mental health at work (thematic page)Official source:EU-OSHA — Healthy Workplaces Campaign “Together for mental health at work” 2026-2028Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free