Employee monitoring law in the UK

Is employee monitoring legal in the UK?

Yes, with conditions. The ICO's guidance on monitoring workers says plainly that data protection law does not prevent you from monitoring workers, but that you must do it in a way that is consistent with data protection law. In practice that means monitoring that is lawful, fair and transparent, has a defined purpose, collects no more than it needs and is kept secure and for no longer than necessary.

The ICO uses "monitoring workers" broadly. It covers anyone who carries out work on your behalf, on your premises or elsewhere, during or outside working hours. It covers systematic monitoring, such as productivity software running across a team, and occasional monitoring introduced for a specific need, such as a short investigation. Homeworking is included: the ICO is clear that monitoring someone who works from home is not "household" processing that falls outside the law.

The ICO also lists the kinds of technology it has in mind, and employee monitoring software sits squarely inside them: webcams and screenshots, keystroke monitoring, productivity tools that log how workers spend their time, and tracking of internet activity. If you are weighing up employee monitoring software such as Teramind, the law shapes every choice from which features you switch on to who can see the results.

The rest of this page is an overview. Each topic has its own detailed guide in this section, listed at the end. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.

The laws that apply to monitoring staff

Most of the detail comes from data protection law, but the ICO points to several other laws you should consider:

Employment law and your contracts sit alongside these. The ICO also points out that unfair monitoring can damage trust between you and your workers and affect their mental wellbeing, so the legal checks and good employee relations point the same way.

Choosing a lawful basis for monitoring

You must identify at least one lawful basis before you start, document it, and avoid switching later without good reason. The ICO says there is no one-size-fits-all answer, but it is clear about how each basis tends to fit monitoring:

The ICO warns that legitimate interests may not be the right basis if you monitor in ways workers would not understand or expect, or if some would object once it was explained. That is a practical test worth applying before you switch on any monitoring channel. A DPIA for employee monitoring helps you work through it.

Special category and criminal offence data

Monitoring often sweeps up sensitive information by accident. Special category data includes health, trade union membership, religious beliefs, sexual orientation and biometric data used for identification. If your monitoring will capture it, or is likely to, you must identify a special category condition as well as a lawful basis.

The ICO's example is a bank monitoring all email traffic to fight fraud: because that monitoring could pick up emails to union representatives or occupational health, the bank should identify a condition. The ICO also classes keystroke monitoring as behavioural biometric data where a worker can be identified from their unique manner and rhythm of typing.

If you are monitoring to detect crime, such as fraud or theft, you are also handling criminal offence data, which you may process only under official authority or a condition in Schedule 1 of the DPA 2018. This matters most for investigations and covert monitoring of employees.

The data protection principles in practice

The ICO's guidance turns the UK GDPR principles into specific expectations for employers:

• Purpose: be clear and document why you monitor. The ICO says you should not monitor workers "just in case".
• Least intrusive means: just because a form of monitoring is available does not make it the best way to achieve your aim.
• Data minimisation: collect only what the purpose needs, and review regularly to avoid function creep into new uses.
• Fairness: monitor only in ways workers would reasonably expect, and without unjustified adverse effects.
• Transparency: tell workers about monitoring in an accessible way, except in very exceptional covert cases.
• Accuracy: let workers see and challenge results, and allow for system errors and reasonable adjustments.
• Retention: keep a retention schedule and delete monitoring data when it is no longer needed.
• Security: restrict access to those who need it and train them to handle the information properly.
• Accountability: overall responsibility should sit at senior management level, with your DPO closely involved if you have one.

The ICO guidance on monitoring workers walks through each of these in more detail, with the ICO's own examples.

Workers' rights

Monitoring creates personal data, so workers keep their data protection rights over it:

• Right to be informed: workers must be told what is collected, why and how, normally through privacy information linked to your employee monitoring policy.
• Right of access: workers can make a subject access request (SAR) for monitoring data, including recordings, unless an exemption applies. The ICO suggests you consider how easily a system lets you retrieve someone's data before you choose it.
• Right to object: where you rely on legitimate interests or public task, a worker can object based on their particular situation. You can continue only if you can show compelling legitimate grounds, or the processing is for legal claims.
• Rectification and challenge: workers should be able to explain or challenge monitoring results, especially where they feed into performance reviews or disciplinary processes.

Using a third-party tool such as Teramind

The ICO is direct about software you buy: you remain the controller, responsible for deciding how and why monitoring happens, and you should not assume that a package you purchase is compliant with data protection law. A provider that works only on your written instructions is likely to be your processor, and you need a contract in place.

Where the provider hosts data outside the UK, the international transfer rules apply. The ICO's own example is a UK company using a US-hosted monitoring application, which it treats as a restricted transfer needing appropriate safeguards. Teramind can be run as Teramind Cloud, in your own private cloud on AWS or Azure, or on your own servers; see Teramind deployment options. Teramind says its cloud customers choose the United States or the European Union (Germany) by default, with other regions on request, while a private cloud can run in any region your AWS or Azure account supports. The hosting location is confirmed at quote so you can assess transfers properly.

Teramind provides privacy controls such as role-based access, scheduled recording windows, application and website exclusions, password-field settings, recording only when a rule is broken and an Audit dashboard that logs administrators' actions. Teramind's own responsible-use notice says its insights, alerts and scores are for decision support only and should not be the sole basis for employment decisions. Those controls help you put a lawful plan into practice; they do not make monitoring lawful on their own.

Our guides to UK employee monitoring law

This section breaks the law down by task:

• The ICO's guidance on monitoring workers explained: the October 2023 guidance, section by section, with its checklist.
• DPIAs for employee monitoring: when one is mandatory, what goes in it and how product settings feed it.
• Writing an employee monitoring policy: what to tell staff and how to keep policy and practice aligned.
• Covert monitoring of employees: the narrow circumstances where it may be justified.
• Monitoring employees working from home: higher privacy expectations and practical limits.
• Monitoring employees' personal devices: why BYOD needs a different approach.

The ICO's monitoring guidance is under review following the Data (Use and Access) Act, so check the ICO's website for updates before you finalise your approach.

How Forever Systems helps

We supply, set up and support Teramind, and we start with what you can justify rather than everything the software can do. We can help you:

1. Pin down the purpose and the questions you need answered, such as data leak risk, an investigation or hybrid working patterns
2. Choose the least intrusive Teramind plan, channels and agent type for that purpose
3. Give you the technical facts your DPIA, LIA and privacy information need: what is captured, where it is held, who can see it and for how long
4. Configure schedules, exclusions, role-based access and recording settings to match the decisions you have made
5. Review the set-up when your purpose, your systems or the guidance changes

We are not a law firm, and your own legal or data protection adviser should sign off your approach. What we bring is a clear account of what the software can capture and how to narrow it, which is the part of a DPIA that is hardest to write from the outside. Ask us for a quote. Contact us to talk it through.