Keystroke logging software: what it does and when it is lawful

What is keystroke logging?

Keystroke logging, often shortened to keylogging, means recording the keys pressed on a keyboard. In a workplace monitoring product the agent on the computer captures the typed text along with its context: which application or website it went into, which user typed it and when. The result can be searched, used to trigger alerts, or replayed alongside a screen recording.

Keystroke logging is not the same as counting keystrokes. Many monitoring tools, Teramind included, measure whether the keyboard and mouse are in use to work out active and idle time. That records activity, not what was typed. Logging keystroke content goes much further, because it can capture messages, searches, personal details and anything else a person types.

The term also has a darker meaning. Criminals use hidden keyloggers as malware to steal passwords and card numbers. Workplace keystroke logging uses similar techniques for a different purpose, but it is still capturing some of the most sensitive things people type, which is why the legal bar is high.

Typical legitimate uses include:

• Detecting sensitive data, such as customer account numbers or personal data, being typed into places it should not go, including web forms, chat tools and AI assistants
• Investigating suspected fraud or misconduct in a specific system, such as a payments platform
• Oversight of privileged administrators on critical servers, where commands and typed input matter
• Spotting abusive or threatening messages typed into work communication tools, where policy and law allow

What Teramind's keystroke channel records

In Teramind, keystroke capture starts on the UAM plan; it is not part of Starter. Once enabled, the keystroke channel captures typed text with its application or website context. Teramind's plan guide notes that it also captures clipboard copy and paste activity, while inspecting clipboard content in rules needs the DLP plan; its pricing page lists clipboard under DLP, so we confirm what your plan covers at quote.

• Keystrokes dashboard: statistics on typed words and phrases, special commands such as copy and paste, and special keys.
• Search: full-text search across captured activity, from the UAM plan.
• Activity rules: alerts or actions when particular words, phrases or patterns are typed, from the UAM plan.
• Content-sharing rules: on the DLP plan, keystroke content is inspected for sensitive data, so a rule can warn or block when, for example, a payment card number is typed into a chat window. See Teramind DLP.

Coverage differs by platform, so check it against your estate:

The Teramind agent page covers the wider platform differences.

Controls that limit keystroke capture

If you can justify keystroke logging, the next job is to capture as little as possible. Teramind's monitoring profiles give you several ways to do that:

• Allowlists: record keystrokes only in listed applications or websites, such as a finance system or a customer database, and nothing else.
• Exclusions: stop recording in named applications and websites, on pages containing specific text, or for particular IP addresses.
• Password fields: separate settings control whether keystrokes in password fields are captured in desktop applications and in browsers.
• Clipboard: switch clipboard monitoring on or off, and exclude specific applications.
• Private browsing: suspend monitoring in private windows.
• Schedules and profiles: capture keystrokes only in working hours, and only for the roles or departments covered by your DPIA.

One caveat is worth knowing. Teramind's documentation explains that password-field detection relies on the field being visibly masked or named as a password field; if a site does neither, typed characters are treated as normal text and captured even with password capture switched off. For that reason we recommend excluding personal banking, health and similar sites outright rather than relying on password detection alone, and restricting keystroke capture to the systems you actually need to watch.

What the ICO says about keystroke monitoring

The ICO's guidance, Employment practices and data protection: monitoring workers, names keystroke monitoring specifically:

• It lists keystroke monitoring among the methods its guidance covers, alongside tracking internet activity.
• It gives keystroke monitoring of workers as an example of high-risk processing, and you must carry out a data protection impact assessment before any processing likely to result in high risk.
• It warns that monitoring can capture special category data incidentally, such as emails between a worker and a healthcare provider or trade union representative, and typed text can include exactly that; if it is likely, you need a special category condition as well as a lawful basis.
• It points out that some workers use personal devices for work and that workplace and private information are not always easy to separate; see monitoring employees' personal devices.
• As with all monitoring, you must have a lawful basis, be clear about your purpose, use the least intrusive means and tell workers, normally in your monitoring policy.

The ICO also says its guidance is under review following the Data (Use and Access) Act, so check for updates before you finalise a DPIA. This is general information, not legal advice; take legal advice for your situation.

When keystroke logging is and is not proportionate

There is no fixed list, but the ICO's principles point in a clear direction.

More likely to be proportionate:

• Capture limited to specific high-risk systems or roles, such as payment processing or privileged server administration
• Automated content rules that look for sensitive data patterns, where people only review the matches, not everything typed
• A time-limited investigation of a specific concern, authorised and documented
• Regulated activities where you can show why lighter measures do not meet the risk

Less likely to be proportionate:

• Recording everything everyone types, all day, by default
• Using keystrokes to measure productivity, when active and idle time or application use would answer the question
• Capturing typing on personal devices or outside working hours
• Collecting it "just in case", which the ICO specifically warns against

Often a less intrusive feature achieves the aim. Activity rules on files and email, screen recording only around rule breaches, or DLP content rules on the clipboard and uploads may meet the same risk without logging every word. Teramind's productivity measures count keyboard and mouse input to judge activity; they do not need the content of what is typed.

How we help

We supply, set up and support Teramind, and keystroke capture is one of the areas where careful configuration matters most. We can help you:

1. Work out whether the risk you are addressing actually needs keystroke content, or whether file, email, screen or DLP rules would do
2. Give you the technical facts for your DPIA: what is captured, where it is stored, who can see it and how long it is kept
3. Configure allowlists, exclusions, password-field and clipboard settings and schedules to match the DPIA
4. Set up role-based access so only the right people can search keystrokes, with the Audit dashboard logging their use
5. Review the set-up as your systems and the law change

Ask us for a quote. The Teramind pricing and plans page shows which plans include keystrokes.