Can employers monitor their staff?
Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
Purpose, lawful basis and proportionality
The ICO's monitoring workers guidance says data protection law does not prevent monitoring, but employers must be clear about their purpose and select the least intrusive means to achieve it. Just because a form of monitoring is available does not mean it is the best way to achieve an aim.
Employers must identify a lawful basis. The ICO says consent is not usually appropriate at work because of the imbalance of power; depending on the purpose, legal obligation or legitimate interests may be more suitable, and legitimate interests needs a documented balancing test. If monitoring is likely to capture special category data, such as health information or emails to a union representative, a separate condition is also needed.
Impact assessments and consultation
A data protection impact assessment (DPIA) must be carried out before monitoring that is likely to be high risk. The ICO gives examples such as processing workers' biometric data and keystroke monitoring, and says employers should carry out a DPIA even where it is not strictly required. Employers should seek and document the views of workers or their representatives unless there is a good reason not to.
Telling workers and covert monitoring
Apart from very exceptional cases, employers must tell workers what monitoring takes place, why, and what information it collects, and keep that information up to date. Covert monitoring may be justified only in exceptional circumstances, such as suspected criminal activity or gross misconduct. The ICO says it should be authorised by senior management, preceded by a DPIA, strictly targeted and time-limited, and not used in areas such as toilets or changing rooms.
Home working and access rights
The ICO notes that workers' expectation of privacy is likely to be greater at home, which raises the risk of capturing family and private life. Information gathered through monitoring is covered by subject access requests, so employers should choose systems that make it retrievable. The ICO says this guidance is under review following the Data (Use and Access) Act 2025.
Sources
- Employment practices and data protection: monitoring workers · ICO
- Data protection and monitoring workers · ICO
- Employment information · ICO
General information for employers in Great Britain, not legal advice. Check the official sources for your situation.
What employers can do
- Write down the specific purpose of any monitoring and why less intrusive options will not work
- Identify and record your lawful basis, and a special category condition where needed
- Complete a DPIA before introducing new or intrusive monitoring tools
- Consult workers or their representatives and record their views
- Update privacy information and your monitoring policy before monitoring starts
- Set retention periods and limit access to monitoring data
Related answers
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- Do employers need a hybrid working policy? No law requires a standalone hybrid working policy, but Acas says employers should have one. It helps managers handle requests consistently under the statutory flexible working rules, explains how hybrid arrangements work, and links to health and safety, data protection and contract terms. Flexible working changes under the Employment Rights Act 2025 are expected in October 2027.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.