The Directive sets no minimum group size. Your pay gap report still needs one, and suppressing a single small group will not protect it.

Directive (EU) 2023/970 never says how small a group has to be before its pay figures stop being statistics and start being salaries. It names no number, sets no floor, and delegates the question in a single permissive sentence. Employers preparing their first report under Article 9 therefore have to make the decision themselves, document it, and defend it to a works council that will read the redactions before it reads the results.

Most of the compliance material circulating in the German mid-market gets the first half of this right and the second half wrong. It correctly identifies that small groups need protecting. It then describes a single threshold, applied once, to the group that fails it. That approach leaves the suppressed figure recoverable with arithmetic that any competent works council member can do on a phone.

This article sets out where the obligation actually comes from, which of your disclosures carry the real risk, why one suppression is never enough, and what the number six in German law does and does not mean.

Where the obligation actually comes from

The Directive does not require suppression. Article 12 does three things, and none of them is a redaction rule.

Article 12(1) provides that to the extent information provided under Articles 7, 9 and 10 involves the processing of personal data, it shall be provided in accordance with Regulation (EU) 2016/679. Article 12(2) is a purpose limitation: personal data processed under those articles shall not be used for any purpose other than the application of the principle of equal pay.

Article 12(3) is the provision everyone cites, and it is worth reading in full. Member States may decide that, where the disclosure of information pursuant to Articles 7, 9 and 10 would lead to the disclosure, either directly or indirectly, of the pay of an identifiable worker, only the workers' representatives, the labour inspectorate or the equality body shall have access to that information. Those representatives or that body then advise workers on a possible claim without disclosing actual pay levels. Monitoring under Article 29 remains unrestricted.

Read carefully, that is a routing rule addressed to Member States, not a suppression rule addressed to employers. It tells you who may see an identifying figure. It does not tell you which figures are identifying, and it does not oblige anyone to compute a threshold.

Two consequences follow. If your Member State exercises the option, you still need to know which cells are identifying, because otherwise you cannot route them correctly. If your Member State does not exercise it, the duty does not disappear. It falls back on the GDPR, which Article 12(1) applies in full: data minimisation under Article 5(1)(c), and data protection by design under Article 25. Germany has not yet published its transposition draft, so German employers are currently in the second case.

The practical effect is the same either way. The threshold is an employer decision. Nobody is going to hand you the number, and the fact that the Directive is silent is not a defence if a figure in your report resolves to one person's salary.

Four disclosure surfaces, four different exposures

The risk is not spread evenly across your reporting obligations. It is concentrated in one channel, and it is not the one most employers worry about.

Almost all real exposure sits in the third row. Point (g) is the only one of the seven metrics broken down by category of workers, and Article 4 requires those categories to be built from skills, effort, responsibility and working conditions. In a company of 400 people, several of those categories will contain fewer than ten employees. Article 9(9) then sends that breakdown to every one of those employees.

The time dimension makes it worse. Article 9(9) also requires the information from the previous four years to be supplied on request where it is available. A suppression decision is therefore not a one-off editorial judgement about a single document. It is a decision about a series.

The arithmetic that defeats a single suppression

Hiding the one category that fails your threshold, while publishing everything around it, is worse than publishing the figure openly. It marks which cell is sensitive and then leaves the means to reconstruct it.

The fix is complementary suppression, a standard technique in statistical disclosure control that is largely absent from HR reporting practice. When exactly one category is primary-suppressed and two or more categories exist, suppress a second one as well. The equation then has two unknowns and cannot be solved.

Choose the second category by a written, deterministic rule rather than by judgement. A defensible rule is: among the categories that passed the primary test, suppress the one with the smallest minority-sex headcount, breaking ties alphabetically. Deterministic means reproducible, and reproducible means you can explain in an Article 10 joint pay assessment why a particular cell is blank without appearing to have chosen it.

Explain the rule to the works council before the first report circulates. A second redaction that arrives unannounced looks like concealment. The same redaction, described in a methodology note agreed three months earlier, looks like competence.

Where the number six comes from, and what it does not mean

German employers do not have to invent a threshold from first principles, because German law already contains one. Section 12(3) of the Entgelttransparenzgesetz provides that the employer is not obliged to disclose the comparison pay where the comparison activity is performed by fewer than six employees of the other sex. That provision has been in force since 2017 and applies to employers with more than 200 employees in the establishment.

It was written for the individual right to information, which is the direct ancestor of Article 7 of the Directive. Its purpose was always data protection rather than statistics: below six, the average of the other sex in a comparison group starts to reveal individuals.

Three things follow, and the third is where most implementations go wrong.

It is a legal anchor. Six is a number that German works councils, labour courts and data protection authorities already recognise. Choosing it means you are not defending an arbitrary figure.

It applies to the minority sex, not the group total. A category of 30 people containing 4 women fails the test. Applying the threshold to the headcount of the category is a common and consequential error, because it lets the smallest and most identifying cells through.

It is not a statement about statistical reliability. Six observations per sex will not support a confidence interval you would want to put in front of a labour court. Suppression and significance are two separate questions, and a figure is not robust because it cleared the disclosure gate. Any material that implies otherwise is overselling the threshold.

One further caution. Do not push the threshold up into the grouping stage. Article 4 requires categories built from skills, effort, responsibility and working conditions. A rule that merges categories until each one holds six of each sex is grouping for statistical convenience rather than equal value, and it is precisely the kind of gap dilution that gets challenged in an Article 10 joint pay assessment. Group correctly first. Suppress at the point of disclosure.

What to settle before the first report

The sequence matters more than the individual decisions, because each step constrains the next.

1. Fix the threshold before you compute anything. Choosing it after seeing which categories fail is indefensible, and it will look that way in an Article 10 assessment. Write the number and its legal basis into a methodology note.
2. Apply it to the minority sex. A category passes only if both the female and the male headcount clear the threshold. Add a second floor on total category size for any output that shows ranges, minima, maxima or quartiles.
3. Add complementary suppression. Specify the selection rule in writing, make it deterministic, and test it against the case where exactly one category fails.
4. Decide the rule for the series, not the document. Article 9(9) requires four prior years on request. Either freeze the value groups across cycles or record, each time they change, what a reader could infer by comparing the two reports.
5. Apply one function to every output. PDF, spreadsheet export, works council pack, employee summary, both language versions. Divergence between formats is the most common route by which a correct threshold fails in practice.
6. Agree it with the works council in advance. Under Article 9(6) workers' representatives have access to the methodologies you apply, so they will see the rule regardless. Presenting it before the figures is a materially different conversation from justifying it afterwards.
7. Keep the internal view access-controlled and separate. The unsuppressed dataset still has to exist for the analysis itself. Restrict it to the HR role that needs it, and be able to show that boundary as a technical measure under Article 32 GDPR.

None of this is difficult, but all of it is much harder to retrofit. A suppression rule invented after the first report has circulated cannot be applied to the report that has already gone out, and Article 9(9) will keep that report in circulation for four more years.

The Directive's silence on minimum group size is not an oversight, and it is not a gap that a Member State will necessarily fill. It reflects a division of labour: the Directive defines what must be disclosed, and the GDPR governs how. That leaves employers holding a judgement that most reporting frameworks would have made for them, and the judgement has to be made once, in writing, before the first figure is computed.