Why is medication a border risk?
Common psychiatric and neurological medications, including stimulants prescribed for ADHD, are controlled or prohibited substances in a number of jurisdictions, and a lawful prescription at home is not a defence at a border where the substance is banned. The case class is documented, including travellers detained in Japan over medications that are routine in the United States, and consular guidance states the prohibition plainly. Requirements vary by jurisdiction and change: some substances are banned outright, some require advance permits, some are limited by quantity or form. The risk is not exotic travel; it is an ordinary posting intersecting an unfamiliar penal code.
Why is this an employer problem?
The organisation chose the destination. Duty of care under travel risk management standards extends to threats that vary with personal risk factors, and arrest over a lawful prescription is squarely such a threat. But the obvious mitigation, asking travellers what they carry, walks the programme into a different exposure: a medication reveals a health condition, which makes the answer special category data under GDPR Article 9, prohibited by default and poorly served by consent in the employment relationship. The employer is caught between a risk it must address and a question it should not ask.
What does the traveller face in practice?
A private calculation with bad options. Declare the medication to the employer and disclose a diagnosis to the organisation that assigns roles and travel. Research the destination alone, against consular pages and regulations that assume legal fluency. Or travel with the medication undeclared and unresearched, which is where the documented detentions come from. Most travellers choose silence, for the same reason most neurodivergent employees never disclose at all: the career cost of the label outweighs the abstract risk of the border, until it does not.
Can the employer help without learning the diagnosis?
Yes, because the dangerous half of the problem is public information. Which substances are controlled where, what documentation a jurisdiction requires, what quantities are permitted: all of that is regulatory and consular material, holdable and maintainable without a single personal fact. An architecture that holds the legality layer permanently and lets the traveller's medication list meet it transiently gives the person a route-level answer while the employer never learns why the query mattered. The traveller gets the guidance; the organisation gets proof that assessment was available and used; the diagnosis stays home.
What should a programme do today?
Two questions locate the gap. Does your pre-travel process ask about medication? If yes, you are processing health data and the lawful basis deserves scrutiny. If no, travellers are managing a documented arrest risk alone, and the duty-of-care obligation is being discharged by silence. Neither position is stable; the resolution is architectural, not procedural.
The question to ask
If a traveller were detained tomorrow over a prescription, could your organisation show it made destination-level pharmaceutical guidance available without requiring disclosure? If the honest answer is no, the exposure runs in both directions, to the person at the border and to the programme that sent them.