In short
An employee monitoring DPIA is a data protection impact assessment of planned monitoring. UK GDPR requires one before high-risk processing, and the ICO gives keystroke monitoring, biometric data and performance management as examples, and says email monitoring needs one. The ICO expects a DPIA for other monitoring too, with DPO advice and workers' views.
Get a quote for Employee monitoring DPIA support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a DPIA is
A DPIA is a structured assessment, carried out before you start, of the risks a project creates for people's data protection rights and how you will reduce them. Article 35 of UK GDPR requires one for processing likely to result in a high risk to individuals, and says it must contain at least:
- a systematic description of the processing and its purposes, including any legitimate interest you rely on;
- an assessment of whether the processing is necessary and proportionate to those purposes;
- an assessment of the risks to the rights and freedoms of the people affected; and
- the measures you will take to address those risks and show compliance.
For monitoring, "the people affected" is wider than staff. The ICO says you should also consider anyone else your monitoring captures, such as customers, members of the public or household members when workers are based at home. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.
When the ICO says a DPIA is mandatory
The ICO's guidance on monitoring workers says you must carry out a DPIA before monitoring that is likely to result in a high risk, and gives examples relevant to monitoring software:
| Type of monitoring | Why it is high risk | Where it appears in Teramind |
|---|---|---|
| Keystroke monitoring | Listed by the ICO as an example of high-risk processing; typing patterns can be behavioural biometric data | Keystrokes channel, from the UAM plan |
| Biometric data | Special category data where used to identify people; the ICO treats identifying typing rhythm as behavioural biometric data | Keystroke capture, and OMNI's worker authenticity model, which Teramind says learns typing and mouse patterns to spot someone else using an account |
| Monitoring that may result in financial loss | The ICO's example is performance management | Productivity dashboards and scores used in reviews |
| Profiling or special category data used to decide on access to services | Decisions with significant effects | Risk scores and AI insights if used to make decisions about people |
| Email and message monitoring | The ICO says you must complete a DPIA, as it is high risk and likely to capture special category data | Email, instant messaging and AI conversation channels |
| Video or audio monitoring | The ICO says you must complete a DPIA | Screen recording with the optional audio channel |
| Covert monitoring | The ICO says you must carry out a DPIA | Any monitoring workers are not told about |
The ICO publishes DPIA screening checklists to help you decide. A typical employee monitoring software deployment touches at least one of these areas, so plan on a DPIA unless you can show it is not needed, and document that decision.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Why do one even when it is not required
The ICO says you should carry out a DPIA even if there is no specific high risk, because it is a flexible and scalable tool that helps decision-making, and you should document your decision if you go ahead without one.
There are practical reasons too. A DPIA is where you settle the choices that make monitoring fair: which channels, which teams, which hours, who can see what and for how long. It gives you a ready answer when staff, unions or the ICO ask why you monitor in a particular way, and it helps you identify the right lawful basis. It is also where you record why a less intrusive option would not meet the need, which the ICO expects you to be able to explain.
How to run a DPIA for monitoring software
The ICO's DPIA guidance sets out the process in detail. For a monitoring software project, the work usually runs like this:
- Describe the purpose and scope: the problem you are solving, the teams and devices in scope, and what success looks like.
- Describe the processing: each monitoring channel, what it captures, when, where data is stored and who can access it. This is where product detail matters.
- Consult: seek the views of workers or their representatives unless there is a good reason not to, and record what you heard. Involve IT, HR and security.
- Assess necessity and proportionality: your lawful basis, any special category condition, why each channel is needed and why lighter options would not work.
- Identify risks: intrusion into private life, capture of special category data, inaccurate or unfair results, misuse by administrators, data breaches and international transfers.
- Choose measures: exclusions, schedules, access controls, retention, staff information, accuracy checks and a route for challenge.
- Sign off: record the outcome and your DPO's independent advice where you have one. If a high risk remains that you cannot reduce, you must consult the ICO before starting.
- Tell workers and review: provide privacy information before monitoring begins, and revisit the DPIA when anything changes.
Is Employee monitoring DPIA support the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Teramind settings feed your DPIA
A DPIA is only as good as its description of what the software actually does. These are the technical questions we help you answer, and the Teramind settings that relate to them:
| DPIA question | Teramind detail and settings |
|---|---|
| What is captured? | Channels switched on per monitoring profile: apps and websites, screen, email, files, keystrokes, printing, AI usage and others, depending on plan |
| Whose data and when? | Profiles by employee, department, computer or directory group; working-hours schedules; Revealed agent clock-in for those who should control their own monitoring |
| How is intrusion limited? | Application and website exclusions with blackout in recordings, private browsing suspension, password-field settings, live view only, or recording only when a rule is broken |
| Is sensitive content handled? | Email content can be switched off while keeping sender and recipient details; DLP content rules look for specific data patterns rather than relying on people reading everything |
| Who can see it? | Role-based access so viewers see only what their role needs; the Audit dashboard logs administrators' actions |
| Where is it stored? | Teramind Cloud, private cloud in your AWS or Azure, or on-premises; the hosting location is confirmed at quote for your transfer assessment |
| Is the output fair and accurate? | Productivity profiles that reflect real job roles, and Teramind's own note that engagement measures input activity, not productivity |
Some features deserve particular care. Teramind's OMNI insights include insider risk scoring, persona baseline drift (changes from a person's usual behaviour), a worker text toxicity score and a worker authenticity model built from typing and mouse patterns. These are forms of profiling, and the authenticity model may involve behavioural biometric data; if you plan to use them, assess them explicitly in the DPIA, keep a human in any decision, and consider the ICO's points on automated decision-making. Teramind's own responsible-use notice says its outputs are for decision support only, should not be the sole basis for any employment decision, and must not be used for solely automated decisions with legal or similarly significant effects.
Common monitoring risks and mitigations
These risk and mitigation pairings are common in monitoring DPIAs:
| Risk | Typical mitigation |
|---|---|
| Capturing personal life on work devices | Exclusions for personal banking, health and similar sites; schedules limited to working hours |
| Special category data in emails or chats | Content capture off by default; content rules targeted at specific data; restricted access to message content |
| Managers misusing the data | Access levels and role-based policies, training, and review of the Audit dashboard |
| Audio or webcam intrusion | Audio channel off, as the ICO expects by default; no webcam capture |
| Unfair productivity judgements | Role-specific productivity profiles, reasonable adjustments reflected, workers able to see and challenge results |
| Keeping data too long | A retention schedule agreed in the DPIA and applied in the platform |
| Function creep | A documented purpose, and a fresh assessment before data is used for anything new |
How Forever Systems helps
We are not lawyers and we do not write your DPIA for you, but we can make it much easier to complete accurately. We can:
- explain what each Teramind channel and setting captures, in writing, for your DPIA
- suggest less intrusive configurations for each purpose you are considering
- help you trial Teramind with a small group so you can see real outputs before you decide
- configure the platform to match the measures in your signed-off DPIA
- help you review settings when your DPIA is revisited
See the ICO guidance on monitoring workers for the wider framework, and Contact us to talk about your project. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
Do I need a DPIA for employee monitoring?
Often, yes. UK GDPR requires a DPIA for processing likely to be high risk, and the ICO's examples include keystroke monitoring, biometric data and performance management, and it says email and message monitoring and covert monitoring need one. Even where it is not mandatory, the ICO says you should do one. This is general information, not legal advice.
Who should carry out a monitoring DPIA?
The organisation doing the monitoring, as controller, is responsible. In practice HR, IT, security and the data protection lead work on it together. If you have a DPO you must seek and record their independent advice, and the ICO expects you to seek workers' or representatives' views.
When do I need to consult the ICO about monitoring?
If your DPIA identifies a high risk that you cannot reduce, you must consult the ICO before you start the monitoring. Reducing the risk, for example by narrowing scope or switching off intrusive channels, is usually the better route.
Is there an employee monitoring DPIA template?
The ICO publishes detailed DPIA guidance and screening checklists on its website, and its monitoring guidance ends with checklists you can work through. Use the ICO's current versions; we can then help you fill in the technical description of the monitoring software accurately.
Does keystroke logging need a DPIA?
Yes. The ICO lists keystroke monitoring as an example of high-risk processing that needs a DPIA, and classes it as behavioural biometric data where a worker is identifiable from their unique manner and rhythm of typing.
Still have a question about Employee monitoring DPIA support?
Ask us and a member of our team will reply by email.