In short
An employee monitoring policy tells workers what you monitor, why, how, who sees the results, how long data is kept and what rights they have. The ICO expects monitoring to be set out clearly, linked to privacy information, consulted on and kept up to date, and warns that a policy cannot justify monitoring that practice contradicts.
Get a quote for Employee monitoring policy support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why you need a monitoring policy
The ICO's guidance on monitoring workers says you must tell workers about monitoring, except in very exceptional cases where covert monitoring is justified, and that you must make sure workers know how and what personal information you collect. Where monitoring enforces your policies, the ICO says those policies should be clearly set out, regularly brought to workers' attention and should describe the nature, purpose and extent of the monitoring.
A written policy is the usual way to do that. It also helps you in other ways: it gives managers clear limits, gives staff a reference point if they have concerns, and gives you evidence of transparency if monitoring is ever challenged.
This page outlines what a UK policy typically covers. It is not a legal template; your HR and legal advisers should draft the final wording for your organisation. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.
Policy and privacy information: how they fit together
Two documents often do the job together:
- The monitoring or acceptable use policy sets the rules: what workers may and may not do with systems, and what monitoring checks those rules.
- Privacy information (often a section of your staff privacy notice) explains the data protection detail: purposes, lawful basis, what is collected, retention, sharing, transfers and rights.
The ICO's own example is an employer with acceptable use rules for the internet, set out in a policy that every affected worker can access, with privacy information in or linked from that policy explaining how the rules are monitored, how the information is used and what safeguards protect workers. Whatever the format, the ICO says the information must be accessible and easy to understand.
What to include
A practical outline for a policy covering monitoring software:
| Section | What it should say |
|---|---|
| Purpose | Why you monitor: for example security, data protection, regulatory duties or understanding workload. Avoid vague catch-alls |
| Scope | Which workers, devices, systems and locations are covered, including home working, and whether personal devices are in or out |
| What is monitored | Each type of monitoring in plain words: applications and websites, screen recording, email, files, keystrokes, location, AI tools |
| When | Working hours, schedules, and whether monitoring runs continuously or only when rules are triggered |
| How | The software used, whether it is visible on the device, and any automatic warnings or blocks |
| Who sees it | Which roles can access what, and how access is controlled and logged |
| How it is used | What decisions it can inform, and what it will not be used for |
| Retention | How long each type of data is kept and when it is deleted |
| Lawful basis and special category data | Your basis (often legitimate interests) and any special category condition |
| Workers' rights | Access requests, objection, challenging results and complaining to the ICO |
| Covert monitoring | The circumstances in which covert monitoring might take place, as the ICO suggests |
| Contacts and review | Who to ask, and when the policy is reviewed |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Acceptable use rules and the case for blocking
Monitoring is easier to justify when the rules it enforces are clear. Set out what acceptable use of email, the internet, messaging, AI tools, removable storage and printing looks like, and what is not allowed.
The ICO also points out that prevention can reduce the need to monitor. Its example is an employer blocking personal email, social media and entertainment sites to minimise unacceptable use rather than monitor for it, and it notes you can require workers to accept conditions before accessing the internet or applications. Teramind's behaviour rules can Warn, Notify or Block in real time, so a rule can stop a risky action and tell the user why, instead of quietly recording it for later. Teramind describes real-time warning messages as a way to educate users without immediate punitive action. The ICO makes a similar point about data loss: blocking suspicious traffic, with a route for the worker to ask for a review, can be an alternative to more detailed monitoring.
Policy versus practice
The ICO makes a point that catches many organisations out: workers base their expectations of privacy on practice as well as policy, and excessive monitoring set out in a policy is not made lawful just because it is written down.
Its example is an employer whose policy bans personal calls but which, in practice, overlooks a limited number. That employer cannot rely on the policy to justify monitoring. The same logic applies to personal web browsing or email on work devices: if limited personal use is tolerated, your monitoring should respect it, for example by excluding personal banking and health sites.
So the policy and the software configuration need to describe the same thing. When we set up Teramind, we can compare the configuration with your draft policy line by line, so that what staff are told matches what the platform does.
Is Employee monitoring policy support the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Describing each type of monitoring in plain words
Workers cannot understand monitoring described as "use of IT systems may be monitored". The ICO says privacy information must be accessible and easy to understand, so describe each channel you actually use. Examples of the level of detail that helps:
| Monitoring type | Points to explain to staff |
|---|---|
| Applications and websites | That application and website use is recorded with times, whether personal sites are excluded, and how the data is used (for example team workload reports) |
| Screen recording | Whether the screen is recorded continuously, viewed live, or saved only when a rule is broken, whether audio is recorded (the ICO expects it off by default), and who can watch recordings |
| Email and messaging | Whether only sender, recipient and time are recorded or content too, and the exceptional circumstances in which content may be read |
| Keystrokes | Whether typed text is captured, in which applications, and that password fields and personal sites are excluded where that is the case |
| Files and printing | Which file movements or print jobs are logged, such as copies to removable storage or uploads to personal cloud storage |
| Location | Whether location is recorded, at what level of detail (for example in-office or out-of-office only), and when |
| AI tools | Whether use of AI chat tools is recorded, including prompts and responses, and which tools are approved |
| Automatic actions | Which actions trigger a warning, a notification to a manager or a block |
The detail should come from your actual configuration, which is why we suggest finalising the policy and the set-up together. Our pages on monitoring emails at work and keystroke logging software explain what those channels record.
Consulting staff and keeping it current
The ICO says you should seek and document the views of workers or their representatives, such as trade unions, before introducing monitoring, unless there is a good reason not to, and do this as part of your DPIA. Consultation often improves the policy: staff can point out where monitoring would catch personal life or misjudge their work.
After launch, keep it alive:
- Remind staff of the policy regularly, for example at induction and annual training, and on the intranet.
- Update the policy and privacy information before you add a monitoring channel, team or purpose; the ICO says you must tell workers when you introduce changes.
- Review it alongside your employee monitoring DPIA at least when systems, purposes or the law change.
- Watch the ICO's guidance, which it says is under review following the Data (Use and Access) Act.
Teramind features that support transparency
Software cannot write your policy, but some features make it easier to live up to:
- Revealed agent: visible on the computer; users sign in and clock in and out, which suits contractors and anyone who should control when monitoring runs. See the Teramind agent.
- Warn and Notify actions: users see a message when they break a rule, so monitoring is not invisible in daily use.
- Schedules and exclusions: monitoring confined to the hours and applications the policy describes.
- Role-based access and the Audit dashboard: the access limits in your policy can be enforced, and administrators' actions are logged so they can be checked.
- Employees seeing their own data: Teramind's Employee access level can let staff view their own records where you allow it, which helps workers see and challenge results.
For the legal background behind each section, see employee monitoring law UK.
How Forever Systems helps
We supply, set up and support Teramind and can help the technical side of your policy:
- Give you an accurate plain-English description of what each Teramind channel captures, for your policy and privacy information
- Suggest configurations that match the limits you want to promise staff
- Configure warnings, blocks, schedules, exclusions and access controls to fit the final policy
- Check configuration against the policy before go-live and when either changes
Contact us to discuss your plans. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
What should an employee monitoring policy include?
It should explain what is monitored, why, when and how, which software is used, who can see the results, how they are used, how long data is kept, the lawful basis, workers' rights and who to contact. The ICO also suggests setting out when covert monitoring might take place. This is general information, not legal advice.
Do employers have to tell employees they are being monitored?
Yes, apart from very exceptional cases where covert monitoring is justified. The ICO says you must inform workers about monitoring in a way that is accessible and easy to understand, and tell them when you introduce changes.
Is there an employee monitoring policy template?
We do not publish a template, because a policy has to match your purposes and your actual configuration. The ICO's guidance on monitoring workers and its checklists are the best starting point; your HR or legal adviser can then draft wording, and we can describe the technical side accurately.
Does a monitoring policy make monitoring lawful?
Not on its own. The ICO says excessive monitoring is not made lawful by being documented, and that workers' expectations are shaped by practice as well as policy. You still need a lawful basis, a clear purpose, the least intrusive method and, where required, a DPIA.
Should we consult staff before introducing monitoring?
The ICO says you should seek and document the views of workers or their representatives before introducing monitoring, unless there is a good reason not to, and record that reason if you decide not to. It suggests doing this as part of your DPIA.
Still have a question about Employee monitoring policy support?
Ask us and a member of our team will reply by email.