Employee monitoring vs candidate social media checks
They are different activities under different guidance. Looking at a candidate's public profiles is pre-employment vetting under the ICO's draft guidance: you need a specific, documented risk in the role, you tell the candidate, and you destroy the raw results as soon as reasonably practicable. Looking at an employee's social media is monitoring a worker, covered by the ICO's separate monitoring guidance, which turns on an ongoing relationship and what workers would reasonably expect.
That guidance has no specific rules on workers' personal social media, so its general rules apply: a clear purpose, the least intrusive means, a DPIA where the risk is high, telling workers, and covert monitoring only in exceptional circumstances. FCA guidance says a regulated firm generally need not monitor the private social media of staff subject to FIT. In our experience, most problems with existing staff arrive as a complaint, and the right tool for those is your disciplinary or grievance procedure, backed by a clear social media policy.
Two activities, two sets of guidance
The ICO describes pre-employment vetting as an employer making its own enquiries from third parties about a candidate's background, and calls it particularly intrusive. That guidance is a draft whose consultation has closed, and the ICO says it is under review following the Data (Use and Access) Act 2025. Our main social media screening page covers it.
Employment practices and data protection: monitoring workers is the ICO's guidance for people already working for you, whatever their contract. It is not marked as a draft, but it is also under review following the 2025 Act. We read every chapter for anything on workers' social media: the only mention is an example of an employer blocking social media sites at work instead of monitoring for misuse. Its general principles decide the question.
The two compared
The candidate column summarises our main page; the employee column comes from the ICO's monitoring guidance.
| Question | Candidate (pre-employment vetting) | Existing employee (monitoring) |
|---|---|---|
| Main ICO guidance | Recruitment and selection guidance (draft), pre-employment vetting chapter | Employment practices and data protection: monitoring workers |
| What justifies it | A specific risk in the role, identified and documented before anyone looks | A clear purpose, using the least intrusive means that achieves it |
| Relationship | One recruitment decision | An ongoing working relationship |
| What the person is told | Candidates must be told you will use social media | Workers must be told about monitoring, apart from very exceptional covert cases |
| DPIA | Required where the processing is likely to be high risk | Required before high risk monitoring; the ICO says you should do one even when it is not required |
| Covert checking | Not an option: the ICO says vetting must be transparent | Only in exceptional circumstances, such as suspected criminal activity or gross misconduct |
| What happens to results | Destroy as soon as reasonably practicable; keep the outcome and decision | Covert material: use only for its intended purpose and destroy the rest, with narrow exceptions |
What workers can reasonably expect
The ICO says you should only monitor workers in ways they would reasonably expect and not in ways that cause unjustified adverse effects. Legitimate interests may not be the most appropriate lawful basis if workers would not reasonably expect the monitoring, or some would object once it was explained. Expectations vary by job: the ICO contrasts a miner wearing a tracking device in a mine with an office worker, who would not expect one.
Workers base their expectations of privacy on practice as well as policy, the ICO says, and excessive monitoring does not become lawful because a policy describes it. The guidance also notes that Article 8 of the Human Rights Act 1998 concerns the right to respect for private and family life, and lists that Act among other laws to consider.
Our view: personal accounts sit at the private end of that scale. Routinely reading them is hard to square with what most workers would expect, and a policy line saying you might will not fix that.
DPIAs, transparency and covert checks
If you have a genuine reason to look at an employee's social media outside a specific complaint, our view is that you should treat it as monitoring and write down the purpose and why a less intrusive step would not do. The ICO says that if you proceed without a DPIA you should document your decision, and that you must tell workers before monitoring begins.
Covert checking is justified only in exceptional circumstances, such as suspected criminal activity or gross misconduct. Our answer on employee monitoring sets out the conditions.
FCA-regulated firms
FIT 1.3.20G says a firm generally need not monitor the private lives of staff subject to FIT, and need only look into a person's private life if there is a good reason, such as an allegation which, if true, would call their fitness into question. The FCA would not expect a firm to investigate trivial allegations or ones it reasonably considers implausible. A firm that does investigate should, where appropriate, ask the person for an explanation, and act fairly and in accordance with privacy, employment and other relevant law. FIT 1.3.21G applies this to social media, including messaging apps; our main page covers it.
When a post becomes a conduct matter
In our experience, most employers hear about an employee's posts because a colleague, customer or manager raises them. That is a conduct question for your procedures. Acas says misconduct is when an employee's behaviour breaks the organisation's rules, and that an employee could face disciplinary action for misconduct outside work, depending on how serious it is and whether it could affect the business. The employer should investigate thoroughly and be able to show the effect on the business.
Acas says bullying might happen on social media, giving humiliating, offensive or threatening comments or photos as an example. Even for apparent gross misconduct, the employer must still investigate and follow a fair disciplinary procedure; our answer on disciplinary procedure covers the steps. In Northern Ireland, the law sets statutory minimum disciplinary procedures (a letter, a meeting, a decision and an appeal), and the Labour Relations Agency has its own Code of Practice on disciplinary procedures.
Our view: keep the investigation to the posts raised and what they show about the allegation. Reviewing the rest of someone's online life is monitoring.
Why a clear social media policy matters
Acas's advice on social media in the workplace is archived and, Acas says, may not be up to date. Its Code of Practice on disciplinary and grievance procedures, which applies in Great Britain, gives the principle: rules should be in writing, specific and clear, employees should be involved in developing them where appropriate, and disciplinary rules should give examples of what the employer regards as gross misconduct.
In our experience a short policy people have actually read prevents more problems than any checking. It usually covers:
- what employees may say about the organisation, colleagues, clients and confidential matters
- that online bullying and harassment of colleagues are treated in the same way as at work
- whether and when the employer will look at posts, and who decides
- how a colleague or manager should raise a concern about a post
- which posts would count as misconduct or gross misconduct under the disciplinary rules
Sources
- Pre-employment vetting of candidates · ICO
- Employment practices and data protection: monitoring workers · ICO
- Data protection and monitoring workers · ICO
- FIT 1 General · FCA Handbook
- Disciplinary procedure: understanding the options · Acas
- Bullying at work: what bullying is · Acas
- Code of Practice on disciplinary and grievance procedures · Acas
- Social media in the workplace (archived) · Acas
- Disciplinary procedures · nidirect
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Can we keep checking a new starter's social media after we hire them?
Not on the strength of the recruitment check. The ICO says vetting information should be destroyed as soon as reasonably practicable, which will often mean once recruitment is over. Looking again later is monitoring a worker, which needs its own purpose, lawful basis and transparency under the ICO's monitoring guidance.
A colleague has complained about an employee's posts. Can we look at them?
Yes, as part of investigating the complaint under your grievance or disciplinary procedure. Acas says that for misconduct outside work the employer should carry out a thorough investigation and be able to show the effect on the business. Our view: keep to the posts raised and what they show about the allegation, and give the employee a chance to respond.
Can a social media policy give us the right to check employees' accounts?
Not by itself. The ICO says excessive monitoring set out in a policy does not become lawful just because it is documented, and that workers base their expectations of privacy on practice as well as policy. Any checking still needs a purpose, a lawful basis and transparency.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
Sector guides
Guides
- Manual search or social media screening software? How a documented manual search compares with a specialist social media screening service on records, accuracy, privacy, automated decisions and contracts.
- What can social media screening legitimately flag? Which social media findings can fairly reach a UK hiring decision, which must be filtered out, and an illustrative criteria list to adapt.
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
Related answers
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- What is a fair disciplinary procedure? In Great Britain, a fair disciplinary procedure follows the Acas Code of Practice: investigate to establish the facts, tell the employee about the problem in writing, hold a meeting where they can respond, allow them to be accompanied, decide and confirm the outcome in writing, and offer an appeal.
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.