Yes — neurodivergence is special-category health data, so by default keep it confidential. Share it only with the employee's agreement and on a need-to-know basis, usually to arrange reasonable adjustments. For you as the employer, the point most managers miss is why this is the rule and how you can still pass on enough to do your job.
Why it is confidential by default
Information about an employee's neurodiversity — whether it is autism, ADHD, dyslexia, dyspraxia or another condition — is information about their health. Under the UK GDPR, data concerning health is special category data (Article 9), which the law singles out for extra protection because of its sensitivity. So keeping it confidential is a legal obligation, not a courtesy. The Information Commissioner's Office (the ICO, the UK data-protection regulator) is clear that you must have a lawful basis to process it, only share it with people who genuinely need to know, and keep it secure and separate from ordinary personnel records. None of that depends on a formal diagnosis: a self-identified or suspected neurodivergence is just as sensitive and just as protected.
How you can still share it — on a need-to-know basis
Confidentiality does not mean you can never tell anyone. Acas, the UK workplace-advice body, says you should keep what you discuss confidential unless the worker is happy for it to be shared. Where information is going to be shared, the employee should agree to it, and it helps to put what is agreed in writing. In practice you usually share it for one reason: to arrange reasonable adjustments. Once you know, or could reasonably be expected to know, that an employee is disabled within the meaning of the Equality Act 2010, the duty to make those adjustments is engaged (section 20) — and a line manager or HR may need to be told enough to deliver them. The test is always need-to-know: share the minimum, with named people, for a defined purpose.
When confidentiality cannot be absolute
Acas also flags the limited situations where you may not be able to keep it fully private:
- The signs are obvious — where the condition is visible or already apparent to colleagues.
- Colleagues need to give specific support — where a co-worker has to know in order to provide a particular kind of help safely or reliably.
- Genuine health-and-safety reasons — where withholding the information would create a real safety risk.
Even then, share only what is necessary, and tell the employee what you need to pass on and why before you do it. Sharing health information without a lawful basis — or more widely than needed — can be both a data-protection breach and a breach of the employee's trust.
Where the law comes from
Related
This page is general information, not clinical or legal advice.