Under GDPR art. 9(2)(b), employers, pension funds, administrative bodies or institutions working for them may process health data insofar as necessary for the proper implementation of statutory provisions, pension schemes or collective labour agreements providing for entitlements dependent on the data subject's state of health (for example sick pay), or for helping employees or benefit claimants return to work, or supporting them, during sickness or incapacity for work. The Autoriteit Persoonsgegevens' policy rules 'De zieke werknemer' set out what an employer may and may not record (in principle not the diagnosis; medical assessment is for the company doctor or occupational health service). Confidentiality duties under art. 30(4) apply.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.