GDPR-Compliant BGM Employee Survey

How do I run a BGM employee survey in compliance with GDPR — and what do I do with the results?

A BGM employee survey is a mandatory part of the analysis phase under the GKV guideline (§20b SGB V). It must be fully anonymous (Art. 9 GDPR), involve the works council (§87 BetrVG), and achieve at least 60% response rate for valid conclusions.

Comparison of Survey Instruments

Instrument	Questions	Validation	Minimum Size	GDPR Note	Cost
COPSOQ (Short Form)	30–87 questions	Internationally validated, reference database available	From 15 employees	Anonymous, document data flow (GKV requirement)	Free (university license)
SALSA	50 questions	German-Swiss validation, stress dimensions	From 20 employees	Anonymous, no inference to individuals	License-free
WHO-5 Well-Being Index	5 questions	WHO standard, clinically tested	From 10 employees (short format)	Fully anonymous, combinable	Free
Custom short questionnaire	10–15 questions	No external validation	Flexible	Describe data flows, involve co-determination bodies	In-house
Work Situation Analysis (health circle)	Moderated group format	Explicitly recommended by the GKV guideline	From 10 employees per group	No personally identifiable record, results summary anonymized	Moderation costs

Mandatory or Optional? Why the GKV Guideline Requires Employee Participation

The GKV Prevention Guideline (December 2025 edition) explicitly states in its analysis phase that standardized surveys of employees on work and health are among the suitable analysis instruments for identifying health risks and potential. Companies that cannot submit survey results when applying for health-insurance funding under §20b SGB V risk having their funding application rejected.

The rationale is pragmatic: health-insurer wellness reports and absence statistics only show what has already gone wrong — they don't explain why. A valid employee survey provides the causality: which stressors drive absences? Which departments need structural prevention measures first? Without this data, the steering committee is planning in the dark.

Participation is not an end in itself: employees who were involved during the analysis phase notice measures significantly more often during the implementation phase. Acceptance comes from involvement — that is the core logic of the GKV guideline, and also the often underestimated ROI of a survey.

GDPR Compliance: The 5 Minimum Requirements Before Sending

Health data falls under Art. 9 GDPR — a special category of personal data with heightened protection requirements. An employee survey on health, stress, and well-being is by definition processing of such data. Five requirements must be met before the survey is sent out (this section reflects requirements under German/EU data protection law):

Full anonymity: Do not store IP addresses or metadata that would allow identification. Choose external survey tools with servers located in Europe.
Communicate voluntariness explicitly: Participation is voluntary. This must be stated in the invitation and in the questionnaire itself — no indirect participation pressure from supervisors.
Data flow communication: The GKV guideline requires that data flows for web-based surveys be described — which data, where it goes, how long it is stored.
Scientific basis: Survey feedback must be based on scientific sources (GKV guideline, Chapter 7.2). Self-invented evaluation logic without validation is not eligible for funding.
Involve the works council: Before sending, not after. §87 BetrVG already applies at the design stage of the instrument.

Health Circles: When Surveys Aren't Enough

An employee survey delivers quantitative data — it shows how many people suffer from time pressure, not why, and not what specifically should be done. The GKV guideline therefore explicitly complements surveys with participation-oriented methods: health circles, work situation analyses, and future workshops.

A health circle is a moderated small group (6–10 people, from the same department) that analyzes concrete stressors and develops solution proposals over 3–6 sessions of 90 minutes each. The results feed directly into the steering committee's action plan as recommendations. According to the GKV guideline, health circles are advisable from 10 employees upward.

Important for GDPR compliance: the health circle's results summary is anonymized — no statements attributed by name, no examples that could identify individuals. Moderation is ideally handled by someone outside the company (occupational physician, external BGM consultant) to ensure psychological safety.

Involving the Works Council — What §87 BetrVG Requires

§87 (1) No. 1 of the German Works Constitution Act (BetrVG) gives the works council a co-determination right on matters of workplace order and employee conduct. An employee survey on working conditions and health behavior falls within this scope — especially when behavioral changes or organizational measures are derived from the results.

The GKV guideline explicitly requires that for web-based surveys, the relevant co-determination bodies be involved by those responsible for the company. In practice, this means: the works council receives the draft questionnaire for review, approves the procedure, and can request changes — before the first link is sent out.

In companies without a works council, the workforce should be involved through another participation format (e.g., a representative employee group in the steering committee). This is not a legal requirement but a recommendation from the GKV guideline for sustainable acceptance.

From Analysis to Action: The Prioritization Matrix

The most common mistake after a survey: results are presented internally, everyone is affected — and then nothing happens for months. Trust and willingness to participate decline permanently.

The steering committee interprets and evaluates the survey results along two axes: urgency (how widespread is the burden?) and feasibility (can the company actually do something about it?). The intersection produces the priorities for the action plan per GKV guideline Chapter 6.3.4.

Communicating results is mandatory: employees must know within 6–8 weeks of the survey's conclusion what happens with their answers — which measures were decided, which were not, and why. Silence after a survey is worse than no survey at all.

High + feasible: Immediate measures (0–3 months), e.g., flexible break times, eliminating noise hotspots
High + hard to implement: Medium-term structural measures (6–18 months), e.g., shift-model adjustments
Low + feasible: Quick wins with high visibility, e.g., fruit basket, walking group
Low + hard to implement: Park for later — reassess in the next BGM cycle

Quick check

What's your company's workplace-health maturity?

Your maturity level decides whether your measures qualify for the tax-free €600 budget. Answer in 3 minutes — no sign-up.

Start maturity check (3 min.)

Related measures & topics

Key takeaways

Note: This guide reflects German law. Employee surveys are a GKV requirement in the analysis phase — without a documented needs assessment, there is no §20b funding.
Art. 9 GDPR applies: full anonymity, describe data flows, no inference to individuals.
Involve the works council under §87 BetrVG before sending — not after.
A response rate below 60% makes results statistically unusable; use health circles as a complement.
Communicating results within 6–8 weeks is mandatory — otherwise participation in the next cycle drops permanently.

Frequently asked questions

From how many employees does a BGM employee survey make sense?+

The GKV guideline recommends health circles from 10 employees upward. For standardized surveys, the practical threshold is 15–20 employees — below that, statistical significance is too low, and anonymous evaluation by department becomes GDPR-critical.

Does the survey have to be conducted externally?+

Not strictly necessary, but recommended. External administration (e.g., by a health insurer or a survey provider) increases trust in anonymity and meets the GKV requirement that data flows be described and that the evaluation logic be based on scientific sources.

What counts as a sufficient response rate?+

For valid analysis, >60% is the minimum standard. Below 40%, representativeness is no longer given — the steering committee should then use health circles as a complementary instrument before deciding on measures.

May company management view the raw survey data?+

No — only anonymized aggregate data. Individual answers, even without names, must not be accessible to management or HR. This requirement must be technically ensured and documented in the records of processing activities (Art. 30 GDPR).

Does an employee survey count toward GKV funding under §20b SGB V?+

The survey itself is not a §20b service, but it is a prerequisite for a fundable needs assessment. Without a documented needs assessment — which includes a survey or a health circle — measures cannot be recognized as §20b-compliant.

Determine Your BGM Maturity Level and Structure the Analysis Phase

Our BGM maturity check shows you which phase your BGM is in and which analysis steps come next — including pointers to suitable survey instruments.

Check BGM Maturity Now All Guides

Sources

Last updated: 2026-06-24. Not legal or tax advice — have your specific case reviewed by a professional.

Health Data & GDPRWhich health data may HR analyze — and what does the GDPR prohibit?Building a BGM StructureHow do I build a BGM structure that is well organized and meets the prerequisites for a funding conversation with a German statutory health insurer (Krankenkasse)?BGM Results ReportWhat belongs in the BGM results report for executive leadership?