Employee monitoring at work: what employers must decide before tracking staff

Start with the decision—not the monitoring product

Write down the problem in operational terms. Are you protecting a secure area, investigating repeated stock loss, recording regulated calls, checking that deliveries reach customers, or trying to understand workload? A general wish to know whether people are working is not precise enough. The purpose determines what information is relevant and when collection should stop.

Then test whether a less intrusive measure could achieve the same result. Supervision, access controls, customer records, security alerts or ordinary performance conversations may answer the question without recording individual behaviour continuously. The ICO says employers must select the least intrusive effective means. Buying a feature-rich package does not justify using every feature.

Choose and document the lawful basis

Monitoring workers involves processing personal information, so the employer must identify a lawful basis before collection begins. Legitimate interests may be relevant for some private-sector uses, but it requires a real necessity-and-balancing exercise. A legal obligation can apply where a specific law requires particular records. The basis must match the purpose; it should not be selected after the system is already running.

Consent is usually a poor default in employment because the power imbalance can prevent a genuinely free choice. A contract clause is not a general permission slip either. The ICO gives the example of a video-surveillance clause for productivity: putting it in the contract does not make monitoring necessary where less intrusive ways could address performance.

Email content, messages, audio or footage may reveal health information, trade-union activity, religion or other special-category data. That can require an additional condition and tighter safeguards—not simply another sentence in the staff handbook.

Use a DPIA before high-risk monitoring

A data protection impact assessment is mandatory where processing is likely to create a high risk to people's rights and interests. The ICO identifies examples including keystroke monitoring, biometric data and monitoring that could contribute to financially significant performance decisions. It specifically says employers considering monitoring email or message content must complete a DPIA.

A useful DPIA records the purpose, information captured, people affected, lawful basis, retention, access, accuracy risks and alternatives. It should also examine customers, visitors, passengers and household members who might be caught. If a high risk remains and cannot be reduced, the employer must consult the ICO before going ahead.

Consulting employees or representatives before introduction helps expose practical problems. Acas recommends consultation and a clear policy. Consultation is not a vote on whether every control can exist, but it can reveal that location data continues after shifts, dashboards misread adjusted duties, or recording captures private conversations the employer never needed.

Related guide: employee record retention →

Match the method to the risk

Different tools create different levels of intrusion. A swipe-card record for a server room is not equivalent to continuous screenshots. Itemised call data may answer a security concern without listening to every conversation. Aggregated system statistics may identify a workload bottleneck without ranking named employees. A work-vehicle tracker should normally be capable of stopping during authorised private use.

Audio is especially intrusive. The ICO says audio capability should be switched off by default and used only in exceptional circumstances. Continuous audio and video recording of workers is unlikely to be justifiable in most settings. Home working also raises the expectation of privacy because monitoring can capture family life and private space.

Procurement does not transfer responsibility. The employer normally remains responsible for why and how information is processed, must understand the supplier's functions and check processor terms, retention, transfers, security and deletion. A vendor describing a product as compliant is not the employer's assessment.

Tell workers what happens—and keep practice aligned

Except in very limited covert-monitoring circumstances, workers must be told about monitoring. Explain what is collected, the purpose, the lawful basis, how it may affect decisions, who can see it, how long it is kept and how people can exercise their rights. Use a privacy notice and an accessible policy, then draw attention to material changes before they take effect.

Actual practice matters as much as written policy. If limited personal use of phones or email is routinely tolerated, an employer cannot assume that an unused prohibition creates a low expectation of privacy. Policies should describe the real arrangement, and managers should not browse content merely because the system makes it technically possible.

Do not let a dashboard make the employment decision

Monitoring evidence can be incomplete. Application time may omit calls, site visits, adjusted duties, training or work completed outside the measured system. Vehicle data may show a delay without showing road closure, a customer problem or a safety stop. Test accuracy, context and consistency, disclose the relevant case, and let the employee explain before using data in a performance, disciplinary or pay decision.

Solely automated decisions with legal or similarly significant effects engage additional rules. Meaningful human review means more than accepting a score: the reviewer needs authority and evidence to challenge the system. The ICO notes that its automated-decision guidance is under review following the Data (Use and Access) Act; that is not permission to ignore current duties while guidance is updated.

Related guide: workplace investigations → · Related guide: employee subject access requests →

Covert monitoring is an exceptional measure

Covert monitoring is unlikely to be justified in ordinary circumstances. The ICO gives suspected criminal activity or equivalent gross misconduct as examples where it may be possible, but only with a tightly controlled approach. Senior management should authorise it, a DPIA is required, and the employer should have reasonable grounds to believe notification would prejudice prevention or detection.

Target the suspected conduct, use the shortest workable period, restrict access and stop when the investigation ends. Do not place covert audio or video where people reasonably expect privacy. Unrelated information should generally be disregarded and destroyed, not retained for future fishing expeditions.

Employee monitoring checklist for employers

• Define the precise purpose and the decision the information will support.
• Check whether a reasonable, less intrusive method can achieve the same result.
• Record the lawful basis and any special-category condition required.
• Complete a DPIA where high risk is likely; document the decision if one is not required.
• Consult workers or representatives and record how concerns were addressed.
• Limit collection by person, place, time, data type and retention period.
• Give clear privacy information before monitoring starts or materially changes.
• Check supplier terms, security, access, deletion and any international transfers.
• Require meaningful human review before monitoring data affects employment decisions.
• Review the arrangement regularly and stop collecting information no longer needed.