How Can HR Teams Cope With Pay Information Requests?

The transposition of the EU Pay Transparency Directive's (EUPTD) Article 7, the Right to Information, gives workers the ability to request the information of their pay and how it fits within their pay level. Once confidential salary structures are now subject to a formal disclosure process. HR teams must now be structurally prepared to answer it correctly the first time.

Operationalising Article 7 and the GDPR Paradox

The Right To Information imposes a strict minimum two-month statutory window in accordance with the Directive's legislation for responding to written employee requests. This alone can cause organisational chaos. However, there is an additional layer of intricacy that will cause further panic. The crossing over of GDPR with this article makes it genuinely difficult.

Disclosing average pay by sex satisfies the Directive requirement. However, the underlying data is personal data under GDPR and Article 12's fairness and transparency principles still apply to how it is processed and shared. This causes major complications for small group risk. In a category with only two or three employees of a given sex, publishing an "average" is not really an average. It is close enough to an individual figure that a colleague can reverse engineer someone's exact salary from it. An HR team can satisfy Article 7 to the letter and still breach GDPR in the same disclosure, simply because the underlying category was too small to anonymise meaningfully. Individual country legislation will take their own stance on whether disclosure or no disclosure is the correct way forward.

The Software Requirement: Automating Compliance with PayAlign

Manual or spreadsheet-based compensation management cannot hold both obligations at once. A manual process can calculate an average but it cannot reliably detect when that average is small enough to expose an individual. It also cannot prove under audit that data-minimisation principles were applied before disclosure. That gap sits at the exact intersection where Article 7 and GDPR liability overlap.

This is the layer PayAlign is built to automate:

• Centralised Article 7 intake - every request is logged, timestamped and tracked against its two-month deadline automatically
• GDPR data-minimisation controls - outputs are automatically suppressed or aggregated when a category is too small to anonymise. This eliminates the small group re-identification risk before disclosure
• Gender-neutral job architecture - roles are evaluated systematically against skills, effort, responsibility and working conditions which gives pay bands an objective, defensible foundation

Defending Pay Variances and Managing Category Disclosures

Aggregated disclosure is rarely the end of the process. Follow-up questions about employee placement are inevitable and compliant answers are a requirement. The burden of proof under the Directive sits squarely with the employer for these responses. Every pay delta needs a documented, objective, gender-neutral justification whether that is tenure, certified skills or measured performance outcomes ready before the question is asked rather than assembled defensively afterward.

Requirement	HR Action
Article 7 request intake	Replace email and verbal requests with a tracked, auditable portal
Two-month SLA	Log every request against its statutory deadline automatically
GDPR data minimisation	Suppress or aggregate outputs for categories too small to anonymise
Pay gap monitoring	Track category-level gaps continuously against the 5% threshold
Variance defence	Document objective, gender-neutral criteria behind every pay decision

Balance transparency and privacy without the manual risk

PayAlign helps EU HR teams automate Article 7 fulfilment, enforce GDPR-compliant data minimisation and defend every pay decision with objective, gender-neutral evidence. If you would like to see this in action, book a demo with our team.

Conclusion

Article 7 compliance was never a single-obligation problem and treating it that way is where most exposure originates. It requires an integrated strategy that satisfies statutory transparency while simultaneously protecting individual privacy under GDPR. All the while, executing on a two-month clock with no margin for manual error. HR leaders who deploy purpose-built compensation architecture now will be positioned to automate fulfilment, enforce data protection by design and protect pay equity, rather than reconstructing that capability under regulatory pressure the first time a request arrives.

Frequently Asked Questions

What is the small group risk under Article 7 disclosures?

The small group risk arises when a job category contains too few employees of a given sex for an "average" pay figure to remain genuinely anonymous. In these cases, disclosing the average allows a colleague to deduce an individual's near-exact salary, which satisfies Article 7 but can breach GDPR's data protection principles in the same disclosure.

Can an employer refuse to disclose average pay data to avoid a GDPR breach?

No. Article 7 creates a statutory right to the information, and GDPR does not override it. The correct response is to apply data-minimisation techniques, such as aggregating or suppressing outputs for categories that are too small to anonymise, rather than withholding the disclosure entirely.

What happens if a category's pay gap exceeds the 5% threshold?

Once an unexplained pay gap in a job category exceeds 5% and cannot be justified by objective, gender-neutral criteria, the employer must carry out a Joint Pay Assessment with worker representatives. Continuous monitoring is designed to catch and remediate these gaps before they reach that threshold.