In short
Covert monitoring of employees means monitoring designed so workers do not know it is happening. The ICO says it is unlikely to be justified in most circumstances, and may be justified only exceptionally, such as suspected crime or gross misconduct, with senior management authorisation, a DPIA, a narrow target, a short timeframe and an end when the investigation ends.
Get a quote for Workplace investigation monitoring
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What counts as covert monitoring
The ICO defines covert monitoring as monitoring carried out in a way designed to ensure workers are unaware that it is taking place. The key word is unaware. It is about whether workers have been told, not whether there is an icon on their screen.
That distinction matters for monitoring software. Teramind offers a Stealth agent with no user interface. If your employee monitoring policy and privacy information tell staff what is monitored, why and when, using that agent is not covert monitoring: workers know it is happening even though they cannot see it. Using it on people who have not been told is covert monitoring, and the rules on this page apply. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.
The ICO's position
The ICO's guidance on monitoring workers is clear: it is unlikely you will be able to justify covert monitoring in most usual circumstances. It accepts there may be exceptional cases, giving the example of covert monitoring that is necessary to prevent or detect suspected criminal activity or gross misconduct.
It also says you should set out in your organisational policies the types of behaviour that are not acceptable and the circumstances in which covert monitoring might take place. That way, even covert monitoring happens within a framework workers have been told about in general terms.
Transparency remains the default. Apart from in very exceptional circumstances where covert monitoring is justified, the ICO says you must inform workers about any monitoring.
The ICO's conditions for covert monitoring
If you are considering covert monitoring, the ICO lists the factors to be aware of:
| Condition | What the ICO says |
|---|---|
| Authorisation | Covert monitoring should only be authorised by senior management |
| DPIA | You must carry out a DPIA |
| Grounds | You should be satisfied there are grounds for suspecting criminal activity or equivalent, such as gross misconduct, and that telling workers would prejudice prevention or detection |
| Targeting | Strictly target it at obtaining evidence within a set timeframe, as short as possible |
| End point | Do not continue after the investigation is complete |
| Private areas | Do not use covert audio or video in areas where workers would expect privacy, such as toilets or changing rooms |
| Private communications | In most circumstances, do not use it to capture communications workers would reasonably expect to be private, such as personal emails |
| Use of the information | Use it only for the intended purpose; disregard and destroy other information unless it reveals something no employer could reasonably ignore |
| People involved | Limit the investigation to those who really need to be involved, with clear rules on access and disclosure |
| Third parties | A private investigator must be under a contract requiring data protection compliance |
| Workers' rights | Rights still apply; a subject access request may require you to disclose monitoring information, assessed case by case |
The ICO adds that you should balance the interests of employer and worker and be able to justify every decision you make to carry out covert monitoring. Keep a written record of each decision, the evidence behind it and who approved it.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Criminal offence data and the wider legal picture
Investigating suspected crime means processing criminal offence data. The ICO says that if you monitor workers to detect criminal activity, you must identify a specific condition for processing in Schedule 1 of the DPA 2018, in addition to your lawful basis. If you find evidence you want to pass to the police, the ICO has separate guidance on sharing personal information with law enforcement.
Other laws apply too. Covert monitoring engages the right to respect for private life under Article 8 of the Human Rights Act 1998, and intercepting communications on your systems is governed by the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018. Take legal advice before you start: if monitoring is later found to be unjustified, the evidence it produced may be challenged and trust with staff damaged.
The Teramind Stealth agent and covert monitoring
Teramind's agent types handle visibility differently:
| Agent | Visibility | Availability |
|---|---|---|
| Revealed agent | Visible; the user signs in, clocks in and out and can stop monitoring | No restrictions |
| Stealth agent | No interface; monitoring starts automatically at logon | Only for customers Teramind has vetted |
| Standard agent | No interface; the user must acknowledge it during installation | Trial and unvetted accounts |
Teramind makes the Stealth agent available only after its own vetting process. Vetting is Teramind's check on the customer, not a legal authorisation for any particular use: if you use it covertly, the ICO's conditions above still apply in full. The Teramind agent page covers the agent types in more detail.
Is Workplace investigation monitoring the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Keeping a covert investigation inside the limits
If your legal advisers and senior management have authorised a covert investigation, the platform can be configured to match the ICO's conditions rather than working against them:
- Target narrowly: a dedicated monitoring profile applied only to the named people or computers under investigation, not a department.
- Limit channels: switch on only what the suspicion needs, for example file transfers and email metadata for a data theft concern, rather than everything.
- Protect private communications: keep email content off and exclude personal webmail, banking and health sites.
- Time-limit: schedule the profile to the authorised period and remove it when the investigation ends.
- Restrict access: role-based access so only the investigation team can view the results, with the Audit dashboard logging administrators' and privileged users' actions.
- Delete what is not needed: apply your retention decisions once the case closes.
Keeping a decision record
The ICO says you should be able to justify every decision you make to carry out covert monitoring. A written record, kept with your DPIA, is the simplest way to do that. It typically covers:
- The suspicion: what is suspected, the evidence that gives grounds for it, and why it amounts to criminal activity or gross misconduct.
- Why covert: why telling the worker would prejudice preventing or detecting it, and why open monitoring or other steps would not work.
- Authorisation: the senior manager who approved it, and when.
- Scope: the people, devices, channels and period covered, and what is deliberately excluded.
- Access: the named people who can see the results, and the rules on disclosure.
- Lawful basis and conditions: the lawful basis and the Schedule 1 condition for criminal offence data, with your DPO's advice where you have one.
- End and clean-up: when monitoring stopped, what was kept as evidence and what was destroyed.
Teramind's Audit dashboard, which records administrators' actions, can support the access part of that record.
Alternatives worth considering first
Covert monitoring is a last resort. Before you go there, consider whether a transparent approach would meet the need:
- Monitoring that staff have been told about, with behaviour rules that alert on the specific risk, such as large file copies to removable storage or uploads to personal cloud storage.
- Reviewing existing logs and records, which may already hold the evidence you need.
- Data loss prevention rules that block the risky action outright; see Teramind DLP.
- Insider threat detection software running openly, so risky behaviour is caught early.
Openly communicated monitoring can also act as a deterrent, which covert monitoring by definition cannot.
How Forever Systems helps
We supply, set up and support Teramind. Where a client's legal advisers have authorised a covert investigation, we can help configure a narrowly scoped, time-limited set-up and remove it afterwards. More often, we help organisations design transparent monitoring that makes covert monitoring unnecessary.
We do not advise on whether covert monitoring is justified in your case; that is a decision for you and your legal advisers. Contact us to discuss your situation. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
Is covert monitoring of employees legal in the UK?
It can be, but only in exceptional circumstances. The ICO says covert monitoring is unlikely to be justified in most cases, and may be justified where it is necessary to prevent or detect suspected criminal activity or gross misconduct, with senior management authorisation, a DPIA and a strictly targeted, time-limited scope. This is general information, not legal advice.
What is covert monitoring at work?
The ICO defines it as monitoring carried out in a way designed to ensure workers are unaware that it is taking place. Examples include hidden cameras or software that staff have not been told about. Monitoring with software that has no on-screen icon is not covert if staff have been told about it.
Can covert monitoring be used in disciplinary proceedings?
The ICO says information from covert monitoring must only be used for the purpose intended, such as the suspected misconduct being investigated, and other information should be disregarded and destroyed unless no employer could reasonably ignore it. Whether evidence can be relied on in a particular case is a question for your legal advisers, so take advice before you start and record why the monitoring was authorised and how it was limited.
Can employers secretly read employees' personal emails?
The ICO says that in most circumstances you should not use covert monitoring to capture communications that workers would reasonably expect to be private, such as personal emails. Monitoring of work email also needs a DPIA and a clear policy.
Is the Teramind Stealth agent covert monitoring?
Not in itself. The Stealth agent has no user interface, but if staff have been told about the monitoring in your policy, it is not covert. Using it on people who have not been told is covert monitoring, and the ICO's strict conditions apply. Teramind provides the Stealth agent only to customers it has vetted.
Still have a question about Workplace investigation monitoring?
Ask us and a member of our team will reply by email.