Rumours About Sick Leave: Has My Privacy Been Invaded?

When sickness becomes office gossip

If you phone in sick and later find your colleagues joking about the reason, it is a nasty thing to come back to. You did the sensible thing by telling your manager and asking for the details to stay between you, the manager and HR. Somewhere along the line that trust was broken. The question is what you can do about it, and whether your privacy has in fact been breached.

It's quite possible your privacy rights have been compromised. Health information is among the most sensitive personal data an employer holds, and UK law treats it that way. Under the UK GDPR and the Data Protection Act 2018, information about your health is classed as "special category" data. Sharing it without a proper lawful basis, and usually your explicit consent, is likely to be a breach unless one of the specific conditions in Article 9 of the UK GDPR applies.

You followed the procedure

On the facts as described, you did everything right. You rang in, you spoke to the duty manager, you gave the reason, and you asked for it to be kept confidential beyond HR. That request matters. Even without it, the employer would still have a duty to handle health information carefully. With it, there is no room for doubt about what you expected.

So when you return to work and discover that your colleagues know, two things have gone wrong. Someone has ignored a direct request, and the employer has very likely fallen short of its legal duties around personal data.

Why it matters legally

There are a few overlapping reasons an employer should not be passing your medical details round the office:

• Data protection law treats health data as special category information. To share it, the employer needs a lawful basis (for example, a legal obligation, your explicit consent, or protecting someone's vital interests) and, in most cases, a specific Article 9 condition as well.
• Most employers have their own confidentiality or sickness absence policy that sets out who should know what.
• Your employment contract or staff handbook may contain an express confidentiality term. If so, a leak could also be a breach of contract, which can be useful if you want to take legal advice later.
• The Human Rights Act 1998 includes the right to respect for private and family life. This applies most directly to public sector employers, though the underlying principles still tend to feed into how tribunals and courts view privacy at work.
• Depending on the illness or injury, the Equality Act 2010 may be relevant if the condition counts as a disability.

You do not need to quote all of this when raising a concern, but it helps to know the ground you are standing on.

Who is actually allowed to know?

Your line manager and HR need enough information to manage the absence, arrange any occupational health support, consider adjustments and work out whether the problem is related to the job. That is a legitimate reason to share. Beyond that group, the cause of your absence is not company news. Colleagues do not have a right to know why you were off, only that you were.

It is worth checking your staff handbook or intranet to see exactly how sickness information is supposed to be handled at your workplace. Most policies spell out that it is kept confidential and only shared on a need to know basis.

Workplace Privacy Checker

Describe what your employer is monitoring or asking for and find out whether it is lawful under UK privacy and data protection law.

Try our Workplace Privacy Checker free, here on this site →

A sensible first step

Before anything formal, it is usually worth an informal conversation with HR or a senior manager you trust. Explain what happened, that you asked for privacy, and that colleagues clearly know things they should not. Ask how the information leaked and what they plan to do about it.

In some cases this is enough. HR will look into it, speak to whoever let it slip, and apologise. In others, you may meet resistance, vague reassurances or a reluctance to name anyone, in which case you will need to push further. Either way, the informal conversation is a useful starting point and costs you nothing.

Keep a written record as you go. Note what you said, who you spoke to and when. Following up an in person chat with a short email ("just to confirm what we discussed today") is a simple way to create a trail. If things drag on or go nowhere, you will be glad you did.

If the informal route fails

If no one takes it seriously, or the response feels like a brush off, the next step is to raise a formal grievance. Your employer should have a written grievance procedure, and the exact steps and timescales will vary from one workplace to another, so check your own policy. If you are in a trade union, speak to your rep first. If not, HR can give you the form or point you to the policy.

In broad terms, a grievance should be put in writing, setting out what happened and what outcome you want. The employer should then arrange a meeting to hear your side, usually within a reasonable period, and you have the right to be accompanied by a colleague or union rep. After the meeting you should get a written decision, and if you are not satisfied, there is normally a right of appeal.

For free, impartial advice at any stage, Acas is a good place to start. Their helpline and website cover grievances, sickness absence and workplace disputes. Citizens Advice can also help if you want to talk it through with someone outside work.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Complaining to the ICO

If you believe your personal data has been mishandled and the employer will not put it right, you can complain to the Information Commissioner's Office. The ICO deals with breaches of data protection law and can investigate how your employer stored and shared your health information. It is usually best to give your employer a chance to fix things first, then go to the ICO if you are not happy with the response. Guidance and the complaint route are on the ICO website at ico.org.uk.

Could it go further?

Many situations like this are resolved in house with an apology and a reminder to staff about confidentiality. Few employers want the reputational damage of a formal data protection complaint or an employment tribunal claim, so they tend to take it seriously once pushed. That said, not every employer reacts well, and some will close ranks, which is why keeping records and knowing your options matters.

Tribunal or court claims are possible in some circumstances. Examples include discrimination, whistleblowing, constructive dismissal, or a breach of contract where confidentiality is an express term of your employment. Those are bigger steps and usually need proper legal advice. For a one off indiscretion, the realistic outcomes are an apology, disciplinary action against whoever spoke out of turn, and tighter handling of sickness information in future.

Protecting yourself going forward

There are a few small things you can do to keep your own position clear next time you need to disclose something sensitive. Put the request for confidentiality in writing, even a short text or email to your manager confirming what you told them and who you are happy for them to share it with. Keep a copy. If you are asked for medical details you do not think are needed, you can ask why, and what they will be used for.

Coming back from illness or injury is hard enough without walking into gossip. If the situation is making work difficult, speak to your GP or occupational health if your employer offers it. You are entitled to be treated with basic respect, and asking for that is not making a fuss.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Workplace Privacy Checker lets you describe what your employer is monitoring or asking for and find out whether it is lawful under UK privacy and data protection law. Try it now →