In short
The ICO's guidance on monitoring workers, published in October 2023, explains how UK GDPR applies when employers monitor staff. It expects a clear purpose, a lawful basis, the least intrusive method, transparency, accuracy, limited retention and security, with a DPIA for high-risk monitoring. The ICO says it is under review after the Data (Use and Access) Act.
Get a quote for Employee monitoring configuration
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the guidance is
"Employment practices and data protection: monitoring workers" is the ICO's guidance for employers on monitoring people who work for them. It was published on 3 October 2023 and sits within the ICO's wider set of employment guidance. It has two main parts: "Data protection and monitoring workers", which covers the general rules, and a part on specific data protection considerations for different ways or methods of monitoring.
It covers all workers, whatever their contract, and both systematic monitoring (for example, productivity software running across a team) and occasional monitoring (for example, monitoring brought in for a specific investigation). It also covers homeworking, which the ICO says is not personal or household processing.
The ICO's website currently carries a notice that, due to changes made by the Data (Use and Access) Act, the guidance is under review and may be subject to change. The principles below come from UK GDPR itself and are unlikely to disappear, but check the ICO's site for the current version before you rely on any detail. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.
Must, should and could
Like other ICO guidance, it uses three words deliberately, and it pays to read them closely:
| Word | What it means | Example from the guidance |
|---|---|---|
| Must | A legal requirement | You must identify a lawful basis; you must carry out a DPIA before high-risk monitoring |
| Should | What the ICO expects you to do to comply, unless there is a good reason not to | You should seek and document workers' views before introducing monitoring |
| Could | An option or good practice | You could use signage or the intranet to keep workers aware that monitoring is happening |
If you depart from a "should", record why. That record is part of showing accountability.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
The core expectations
These are the points from the guidance that shape almost every monitoring project:
- Be clear about your purpose. Document why you monitor and what you will do with the information. Do not monitor "just in case".
- Use the least intrusive means. The ICO's example: an employer that uses webcam images to check remote workers' start times is likely to be acting disproportionately, when checking log-on times and letting workers explain discrepancies would do the same job.
- Identify a lawful basis. Consent is not usually appropriate for workers; legitimate interests is the most flexible, tested with a legitimate interests assessment.
- Consider special category data. If monitoring could capture health, union or other sensitive information, identify a special category condition as well.
- Be fair. Monitor only in ways workers would reasonably expect. The ICO's example is time-in-system reports that ignore reasonable adjustments, which it calls unfair and inadequate.
- Be transparent. Tell workers about monitoring unless very exceptional covert monitoring is justified.
- Be accountable. Put responsibility at the highest senior management level, involve your DPO, and brief the people who run the monitoring.
The employee monitoring law UK overview covers lawful bases and the other laws the ICO mentions in more depth.
What the ICO says about specific monitoring methods
The guidance has a separate part on particular methods. For the kinds of monitoring that software like Teramind performs, the key points are:
| Method | What the ICO expects |
|---|---|
| Emails and messages | You must complete a DPIA. Monitoring content is hard to justify if network data (information about messages) would meet your purpose; tell workers in advance if content may be checked in exceptional circumstances, and do not access content without a clear policy. Consider lines you will not monitor, such as emails to trade union representatives |
| Device activity | Document why you need it and what less intrusive means you considered. You must inform workers and must consider discussing it with them or their representatives. Aggregated reports could identify trends without identifying individuals |
| Personal devices | Device monitoring can be particularly intrusive on workers' own devices, and you should make sure you do not capture their private use |
| Keystrokes | An example of high-risk processing that needs a DPIA, and behavioural biometric data where a worker is identifiable from their typing rhythm |
| Webcams and screen captures | Particularly unlikely to be able to justify webcam shots or footage. Screen captures are among the device monitoring the ICO says is likely to collect excessive personal information |
| Audio | Any capability to record audio should be switched off by default; continuous audio and video recording is unlikely to be justified in most circumstances |
| Data loss prevention | Choose the least invasive solution and complete a DPIA; blocking suspicious traffic, with a way for workers to ask for a review, is an alternative to more detailed monitoring |
| Working from home | Privacy expectations are higher at home, and the risk of capturing family and private life is greater; factor this into the DPIA |
| Monitoring a customer asks for | You cannot justify monitoring workers solely because a customer makes it a condition of business; the decision, and the duty to inform workers, stays with you |
Our feature pages show how each of these applies in practice: monitoring emails at work, keystroke logging software and screen monitoring software for employees.
Is Employee monitoring configuration the right fit for you?
We will check it against your systems and requirements and recommend the right option.
DPIAs, consultation and the ICO
The guidance says you must carry out a DPIA before any monitoring likely to result in a high risk to workers or others. Its examples of high-risk processing include processing workers' biometric data, keystroke monitoring, monitoring that may result in financial loss (such as performance management) and using profiling or special category data to decide on access to services.
It then goes further than the legal minimum: you should carry out a DPIA even where there is no specific high risk, and document your reasons if you decide not to. You must seek your DPO's advice where you have one, consult the ICO if a high risk remains that you cannot reduce, and tell workers about the monitoring before it begins. The ICO also says you should seek and document the views of workers or their representatives, such as trade unions, unless there is a good reason not to.
The employee monitoring DPIA guide covers how to run one for monitoring software.
Accuracy, retention and security
Three expectations are easy to underestimate when software does the recording:
- Accuracy: systems can malfunction (the ICO mentions a clock resetting to the wrong time zone), information can be misread or falsified, and analytics tools can make incorrect inferences. Workers should be able to see, explain and challenge results, especially in performance reviews and disciplinary processes.
- Retention: keep monitoring data only as long as your purpose needs. You must have a retention schedule and delete in line with it, and you should be able to justify each period.
- Security: restrict access to those who need it, train them, and do not assume a commercial tool has the right protection built in.
Workers' rights and third parties
Workers can make a subject access request for monitoring data, so the ICO suggests you consider how easily a system lets you retrieve one person's information before you choose it. Where you rely on legitimate interests or public task, workers can object, and you must be able to show compelling grounds to continue.
On third-party tools, the guidance says you are responsible for how and why monitoring happens, and you should not assume that a package you buy is compliant. A supplier acting on your instructions is likely to be a processor and needs a written contract. If the tool hosts data outside the UK, international transfer rules apply; the ICO's example is a US-hosted monitoring app, which is a restricted transfer needing appropriate safeguards. Where AI or automated decision-making is involved, the ICO says further considerations apply.
The ICO's checklist, summarised
The guidance ends with a checklist for employers. In summary, before monitoring you should be able to say that you have:
- Checked that monitoring is necessary for the purpose and that no less intrusive way exists
- Decided whether a DPIA is needed and either completed one or documented why not
- Considered seeking workers' and representatives' views, and done so or recorded why not
- Identified a lawful basis and, where needed, a special category condition
- Documented what personal information the monitoring processes
- Put an appropriate policy document in place where one is required
- Included specific monitoring information in your privacy information, readily accessible to workers
- Considered the effect on data minimisation, security and DPO obligations
- Built data protection into the design of the monitoring, including external suppliers and features built into collaboration tools
- Considered the international transfer rules where necessary
Turning the guidance into Teramind settings
We supply, set up and support Teramind, and much of our work is turning decisions like these into configuration:
| ICO expectation | How we can reflect it in Teramind |
|---|---|
| Least intrusive means | Start with the Starter plan or a narrow set of channels; use team-level dashboards before individual detail |
| Data minimisation | Monitoring profiles per department or group, application and website exclusions, live view only or recording only when a rule is broken |
| Transparency | The visible Revealed agent where it suits, and Warn or Notify rule actions that tell users when they cross a line |
| Security and access | Access levels and role-based policies so managers see only their own departments, with the Audit dashboard logging administrators' logins, configuration changes and access to sensitive reports |
| Home and private life | Working-hours schedules, the option not to monitor private browsing windows, and exclusion of personal sites |
| Audio and webcams | Audio channel left off; Teramind does not record webcam video, and its camera usage channel only reports when a camera is in use |
| Transfers | Choice of Teramind Cloud, private cloud or on-premises, with the hosting location confirmed at quote |
Contact us to discuss your plans. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
What is the ICO guidance on monitoring workers?
It is "Employment practices and data protection: monitoring workers", the ICO's guidance for employers on monitoring staff under UK GDPR and the Data Protection Act 2018. Published in October 2023, it covers lawful basis, fairness, transparency, DPIAs, covert monitoring, workers' rights and third-party tools.
Is the ICO monitoring workers guidance still current?
It is still published, but the ICO says that due to changes made by the Data (Use and Access) Act the guidance is under review and may change. Check the ICO's website for the current version and any update before you finalise a DPIA or policy.
Is the ICO guidance legally binding?
The guidance itself is not law, but it explains how the ICO interprets UK GDPR and the Data Protection Act 2018, which are binding. Where it says "must", it is describing a legal requirement; "should" describes what the ICO expects unless you have a good reason to do otherwise.
Does the ICO guidance cover people working from home?
Yes. The ICO says homeworking is not personal or household processing, so the guidance applies. It adds that workers' privacy expectations are likely to be significantly greater at home and the risk of capturing family life is higher.
What does the ICO say about webcam monitoring?
The ICO says you are particularly unlikely to be able to justify capturing webcam shots or footage. Its example of an employer using automatic webcam images to check remote workers' start times is described as likely to infringe data protection law, because checking log-on times would achieve the same purpose.
Still have a question about Employee monitoring configuration?
Ask us and a member of our team will reply by email.