Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation August 27, 2026 6 min

The European campaign on mental health at work starts on 13 October. It creates no obligations, which is exactly why it should be read carefully

EU-OSHA launches “Together for mental health at work” for 2026-2028, aimed at new and overlooked occupational groups, sectors and areas. The Agency's thematic page sets out the figures and invokes Framework Directive 89/391/EEC

What this source is

An awareness campaign by the European Agency for Safety and Health at Work, together with a thematic page. It is not a decision, not guidelines, and it introduces no obligations: it informs. We say so at the top because the distinction matters — what follows in the first part is content of the source, what follows in the last part is the writer's reading.

What the source says

Psychosocial risks arise from poor work design, organisation and management, and from a poor social context of work. The page lists ten typical conditions: excessive workloads, conflicting demands and lack of role clarity, lack of involvement in decisions affecting the worker, lack of influence over how the job is done, poorly managed organisational change, job insecurity, ineffective communication, lack of support from management or colleagues, psychological and sexual harassment, and dealing with difficult customers, patients or pupils.

  • Stress, anxiety and depression are the second most common work-related health problem affecting European workers.
  • Nearly 45% of workers report facing risk factors that can adversely affect their mental health.
  • According to the Agency's 2022 OSH Pulse survey, 27% of workers experience stress, anxiety or depression caused or made worse by work. The 2025 round, cited by the campaign, gives 29%, alongside 37% reporting overall fatigue.
  • Among the factors found most detrimental to health are unsocial working hours and work intensity.
  • The ESENER survey shows psychosocial risks are seen as harder to manage than “traditional” ones, and that micro and small companies tend to underestimate them.

The page presses one point that is not statistical but structural: when psychosocial risk is treated as an organisational issue rather than an individual fault, it can be tackled in the same structured way used for other safety and health risks.

The legal framework the source invokes

Here the page is explicit: managing work-related psychosocial risks is not just a moral obligation and a good investment, it is “a legal imperative set out in Framework Directive 89/391/EEC”, supported by the social partners' framework agreements on work-related stress and on harassment and violence at work. Employers have a legal responsibility to ensure workplace risks are properly assessed and controlled, and involving workers in that process is described as a success factor, not a courtesy.

Directive 89/391/EEC is a directive: it binds Member States as to the result and has been transposed into national law. In Italy the transposition is Legislative Decree 81/2008, whose Article 28 expressly includes work-related stress among the risks to be assessed in the risk assessment document. The obligation has existed since 2008 and the campaign does not change it: what changes is attention, not scope.

From here on this is my reading, not content of the source

The EU-OSHA page does not mention the data protection regulation, does not deal with the collection or assessment of health data, does not mention the data protection officer, and does not claim that companies are measuring their employees' wellbeing. What follows is the writer's reasoning about a possible consequence, and should be read as such.

Why it can land on the desk of whoever handles data

To be assessed, psychosocial risk has to be measured. And the most common instrument for measuring it is a questionnaire to workers. The moment that questionnaire allows a person to be identified, and asks about that person's psychological state, health data is being processed — and consent collected on a company form will rarely do, because in an employment relationship consent is almost always questionable. The campaign does not say this: it is the consequence produced when the campaign works and organisations start measuring.

  • Aggregation is not automatic. If a department has six people, the figure “aggregated by department” identifies everyone who works there.
  • The anonymous questionnaire that is not anonymous: department, age band, seniority and gender together identify a person in almost any firm under two hundred staff.
  • A form administered through the company's own tool carries the identity of the respondent, whatever the screen says.
  • Individual results kept after processing: the assessment serves the risk document, not the personnel file.

One question to ask the client

In the past year, have you given employees a questionnaire on climate, wellbeing or stress? If the answer is yes, ask to see the form and the information notice. It takes two minutes to ask, and when the answer is yes it almost always opens a chapter that is not in the record of processing activities.

The campaign is launched on 13 October in Brussels and runs for 2026-2028, within the EU strategic framework on health and safety at work 2021-2027. It looks in particular at new and overlooked occupational groups, sectors and areas: which are also the ones where no procedure exists yet, making them interesting for advisers and uncomfortable for those advised.

Official source:EU-OSHA — Psychosocial risks and mental health at work (thematic page)Official source:EU-OSHA — Healthy Workplaces Campaign “Together for mental health at work” 2026-2028

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min