A GDPR-compliant EAP keeps employee data in the EU, explains in plain language who can see what, sends employers anonymised reporting only, and gives Procurement a documentation set that survives audit. The documentation is the easy half. The hard half is whether an employee at 11pm, bothered about something they haven’t told anyone, believes the confidentiality promise enough to type it in. Traditional EAPs average around 5% utilisation, and in sectors like manufacturing and retail it drops to 2%. Kyan Health runs at 10% to 40%. Privacy architecture is a bigger part of that gap than most vendor decks admit.
Why GDPR compliance decides your EAP utilisation
GDPR compliance drives EAP utilisation because employees only use a mental health benefit they trust, and trust comes from understanding the privacy model rather than from being told it exists.
Here’s the part most vendors get backwards. They write the privacy story for Procurement, then assume employees will inherit the confidence. They don’t. Procurement reads a data processing agreement. An employee reads a screen, once, while deciding whether to admit they’re struggling.
Those are two different products, and most EAPs only ship the first one.
Think about what’s actually going through someone’s head. Will my manager find out? Does HR get a list? If I say the word “burnout,” does that land in a file somewhere with my name on it? A benefit can be live in every country you operate in and still sit at 2% because nobody answered those questions in words a person can hold in their head.
Dense policy language satisfies an audit requirement. It does nothing for the person at the point of decision. Kyan’s breakdown of the EAP utilisation problem covers why access on its own never produces trust, and what employees need to believe before they’ll use the service.
What actually makes an EAP GDPR-compliant
A GDPR-compliant EAP makes four things explicit and consistent: where data lives, who processes it, what the employer can see, and what happens to a request after it’s submitted.
Start with the legal weight. Mental health information is special category data under Article 9 of the GDPR, which sets a higher bar than ordinary personal data. Anxiety, grief, a marriage coming apart, a drinking problem. This is the most sensitive material an employer will ever sit adjacent to, and the correct posture is to sit as far from it as the service allows.
Kyan Health hosts data in the EU and passes no identifiable employee data to the employer. Employers see anonymised organisational reporting. They don’t see who booked, or why.
A platform diagram is worth very little if the vendor can’t map it onto the employee journey. Every entry point creates a different data interaction: the app, care navigation, a session with a licensed counsellor, the reporting layer. Ask a vendor to walk each one and say what’s collected, where it sits, and who touches it. Vagueness at that question is the answer.
For context on how the underlying model has changed, see traditional versus modern EAP design and what a modern EAP looks like in 2026.
One privacy model across every European entity
A modern EAP should run one privacy model across all European entities, with country-level documentation showing how it applies in each regulatory environment.
An employee in Munich and one in Madrid should get the same confidentiality explanation, in their own language, at the same point in the journey. Variation here isn’t a localisation detail. It’s what makes people suspect the promise is negotiable.
Two practical checks. First, confirm licensed counsellors are in-country wherever local practice requires it. Second, read the employee-facing copy against the contract and the Procurement response. If those three describe confidentiality differently, employees notice eventually, and the version they believe is the least reassuring one.
Then decide who owns review after signature. Structures shift, features ship, regulations move. Re-check when they do, not only at selection.
The documentation pack Procurement should ask for
Procurement should expect one reviewable set covering processing, sub-processors, hosting, confidentiality terms, employer reporting, and AI governance.
Ask for:
The data processing agreement, describing the controller and processor relationship
Sub-processor documentation naming every party and its role
Hosting detail stating where each category of data physically sits
Confidentiality terms spelling out what the employer can and cannot see
A reporting specification showing exactly what lands in the employer dashboard
AI governance covering purpose, boundaries, and human oversight
A defined process for notifying you when any of the above materially changes
The part that matters more than the list: These documents have to agree with each other. The contract, the privacy notice, the technical explanation, and the employee-facing copy should tell one story about where data lives and who sees it. When they don’t, a certification won’t rescue it, because a certificate attests to a process and not to the coherence of your evidence.
Accessibility counts too. Anything scattered across unrelated pages slows review and weakens your ability to defend the choice a year later. Kyan’s questions to ask an EAP provider works well as a supplier-conversation structure before contracts reach final review. Rather than build that list yourself, The EAP Buyer’s Guide collects 132 questions from real tenders, how often each gets asked, and what a weak answer sounds like. Free and vendor-neutral.
AI guardrails and the EU AI Act
AI in an EAP needs documented governance: a stated purpose for each feature, defined boundaries, transparent data handling, and a named point of human responsibility.
KAI is Kyan’s AI Care Guide. The role is navigation and triage, pointing people toward the right kind of support and staying available at hours when nothing else is. KAI doesn’t diagnose, and it doesn’t stand in for a licensed counsellor.
That distinction is worth stating plainly, because the EU AI Act draws sharp lines around systems that touch health, and because employees are right to be sceptical of mental health chatbots. A vendor implying that an AI feature diagnoses conditions or guarantees outcomes is telling you something about the rest of their governance.
Ask where AI appears in the employee journey, what data it touches, where that data is hosted, and who is accountable when it gets something wrong. Product copy, privacy documentation, and governance material should use identical boundaries. If marketing is bolder than the DPA, believe the DPA.
The same clarity helps adoption. People hesitate when they can’t tell what an AI feature does with what they typed. A defined role removes the guesswork. More on KAI’s role within Kyan.
How to evaluate GDPR-compliant EAP providers
Test privacy, employer visibility, documentation, reporting, and AI governance as one connected model rather than as separate procurement line items.
Open with the blunt question: can an employer identify who used the service, or why? Then check that answer against the contract, the privacy materials, and a live reporting demo. Most privacy stories come apart at the demo, because a dashboard shows you what the vendor actually built rather than what the deck promised.
Ask for a small, filtered cohort view. If a dashboard can slice down to a team of six, it can identify people, whatever the policy says.
Buyers shortlisting Lyra Health, Spring Health or Modern Health alongside Kyan Health should run all of them through the same test and compare answers side by side, not vendor by vendor. Kyan Health hosts data in the EU, shares no identifiable employee data with employers, and reaches a first appointment in under three days. Kyan’s 11 criteria for choosing an EAP provider and this provider landscape for global teams give you a wider frame. For reporting specifics, see what employers can actually see.
Frequently asked questions
What makes an EAP GDPR-compliant?
A GDPR-compliant EAP treats mental health information as special category data under Article 9, hosts it lawfully, documents every processor, and limits employer visibility to anonymised reporting. It should state where data sits, who handles it, and what reaches the employer, in language an employee can understand without legal help. Documentation and employee-facing copy must describe the same model.
Can my employer see if I used the EAP?
With a properly designed EAP, no. Kyan Health shares no identifiable employee data with employers. HR receives anonymised organisational reporting showing engagement patterns, not names, not reasons for contact. Confirm this in writing before you use any service, and check the wording in the contract rather than the marketing page, because those two sometimes disagree.
Does EAP data have to be hosted in the EU?
Not automatically, but EU hosting removes a category of risk and shortens review. GDPR permits transfers outside the EU under specific mechanisms, and each one adds documentation, scrutiny, and something that can change under you later. Kyan Health hosts data in the EU. If a vendor hosts elsewhere, ask which transfer mechanism applies and what happens if it’s invalidated.
What documentation should we request from an EAP vendor?
Request the data processing agreement, sub-processor list, hosting detail, employee confidentiality terms, a reporting specification, AI governance material, and evidence for any certification claimed. Then read them against each other. Contradictions between the contract, the privacy notice, and the employee-facing copy matter more than any single certificate, because they show the model isn’t settled internally.
How does the EU AI Act apply to an EAP?
The EU AI Act sets obligations around transparency, human oversight, and risk classification, and systems touching health draw closer scrutiny. For an EAP, that means each AI feature needs a documented purpose, defined boundaries, and named human accountability. Ask where AI appears in the employee journey, what data it processes, and how someone reaches a human at any point.
In summary
Two rooms have to be convinced. Procurement needs evidence the claims survive review. Employees need a reason to trust the platform with something they haven’t said out loud. Most vendors build for the first room and hope the second follows. It doesn’t, and low utilisation is what that looks like on a dashboard twelve months later. Kyan Health is a modern EAP built so the same privacy architecture answers both.
Running a tender? Start with the question set, or book a demo and put it to us.
