Employee Monitoring and Privacy Guide

Security teams need visibility of what staff do with corporate data, but monitoring people is regulated processing of personal data, and getting it wrong creates legal exposure and destroys the trust an insider risk programme depends on. Data loss prevention, user and entity behaviour analytics, email scanning, endpoint agents and leaver reviews all capture information about identifiable workers. In the UK and EU that processing needs a lawful basis, a documented necessity case and usually a DPIA; in the US, federal wiretap law and state notice statutes set the floor. This guide explains how to design monitoring that is lawful, proportionate and still useful for detection, with a focus on the UK ICO guidance, the Article 29 Working Party opinion on data processing at work, GDPR Article 88, the US ECPA and the New York and Connecticut notice laws. It is written for security, insider risk, HR and privacy practitioners who have to agree a monitoring design together.

Key takeaways

Start from a defined purpose, not a tool. The ICO expects a clearly documented purpose and the least intrusive means of achieving it; "just in case" monitoring fails both tests.
Consent is rarely the right lawful basis. Because of the power imbalance between employer and worker, legitimate interests backed by a written assessment, or a specific legal obligation, is usually the basis that holds up.
High-risk monitoring needs a DPIA before it starts. The ICO names biometrics, keystroke monitoring, monitoring that affects pay or performance, and profiling as examples, and covert monitoring always needs one.
US law is mostly about notice. ECPA allows interception with one party's prior consent, and New York and Connecticut require written notice and posting, with Connecticut's notice duties expanded from 1 October 2026.
Departing employees are the highest-value monitoring use case. Targeted, time-boxed review of a leaver's data movements is more defensible and more effective than blanket surveillance, and it must be paired with revoking credentials, keys and tokens.

What counts as employee monitoring

Monitoring is any systematic collection of information about workers' activity or communications by means other than direct observation. For a security team that includes far more than CCTV:

Network and email: secure web gateway logs, TLS inspection, email DLP, journaling and eDiscovery searches.
Endpoint: EDR telemetry, endpoint DLP (USB, print, clipboard, upload), application usage, screenshots and keystroke logging.
Identity and SaaS: sign-in logs, conditional access events, file access and sharing audit logs in Microsoft 365 or Google Workspace, and UEBA risk scores built from them. See the UEBA Guide.
Communications: call recording, chat and collaboration archives, often required in regulated financial services.
Physical and location: badge access, time and attendance (including biometrics), vehicle telematics and dashcams.
AI tools: prompt logging and AI usage monitoring, which can capture unusually personal content. See the AI Usage Monitoring Guide.

The ICO's guidance treats the security purpose as legitimate in principle. The questions regulators ask are whether the specific method is necessary for a defined purpose, whether a less intrusive method would work, and whether workers were told.

The legal frameworks that apply

Jurisdiction	Instrument	What it requires of monitoring
UK	UK GDPR and Data Protection Act 2018; ICO "Employment practices and data protection: monitoring workers" (October 2023)	Lawful basis, special category condition where health, union or biometric data may be captured, DPIA for high-risk monitoring, transparency, retention limits, subject access to monitoring data. Uses "must" for legal requirements and "should" for expected good practice.
EU	GDPR Article 88	Member States may set more specific rules for employee data by law or collective agreement, which must include suitable and specific measures to protect dignity, legitimate interests and fundamental rights, with particular regard to transparency, intra-group transfers and monitoring systems at the workplace. Check the national employment data law in each country you operate in.
EU	Article 29 Working Party Opinion 2/2017 (WP249) on data processing at work	Proportionality and necessity before any monitoring, prevention over detection, no systematic monitoring of all traffic, limits on home working and BYOD monitoring, DPIA before mobile device management.
EU	AI Act Article 5(1)(f)	Prohibits AI systems that infer the emotions of a natural person in the workplace, except for medical or safety reasons, from 2 February 2025.
US federal	Electronic Communications Privacy Act, 18 U.S.C. 2511	Prohibits intentional interception of wire, oral or electronic communications, with exceptions including interception where one party has given prior consent (2511(2)(d)) and provider activity necessary to render service or protect the provider's rights or property (2511(2)(a)(i)).
New York	Civil Rights Law section 52-c	Prior written notice on hiring to employees subject to monitoring of telephone, email or internet access or usage, acknowledged in writing or electronically, and a notice posted in a conspicuous place. Civil penalties up to $500, $1,000 and $3,000 for first, second and subsequent offences, enforced by the Attorney General.
Connecticut	General Statutes section 31-48d, as amended by Public Act 26-73	Prior written notice of the types of electronic monitoring, posted conspicuously. From 1 October 2026 the notice must identify the worksite locations where monitoring occurs and be posted at each, and new hires must receive notice before starting that describes prohibited activities that may be monitored without further notice. Penalties up to $500, $1,000 and $3,000 imposed by the Labor Commissioner.

Other US states have their own rules, and California's privacy law covers employee personal information. Treat the table as a starting map, not a complete list, and confirm current text with counsel. See the US State Privacy Laws Guide and the UK GDPR and Data Protection Act 2018 Guide.

Choosing a lawful basis and running the DPIA

Lawful basis under UK and EU GDPR

Consent: the ICO says it is usually inappropriate in employment because of the power imbalance; where used, it must be genuinely optional and withdrawable without detriment.
Contract: rarely suitable, since monitoring is usually for business improvement rather than necessary to perform the employment contract.
Legal obligation: only where a specific legal provision or clear authoritative guidance requires the monitoring, for example communications recording rules for regulated firms. A clause in the employment contract is not enough.
Legitimate interests: the usual basis for security monitoring. Document a legitimate interests assessment with the three-part test (purpose, necessity, balancing) and record why workers would reasonably expect the monitoring.
Special category data: monitoring that captures, or is likely to capture, health, trade union or biometric data needs an Article 9 condition as well, including incidental capture such as emails to a union representative or a health provider. Criminal offence data needs a Schedule 1 DPA 2018 condition.

DPIA triggers and content

The ICO says a DPIA must be completed before high-risk monitoring and recommends one even where not strictly required, recording the decision if you do not. Its examples of high-risk monitoring include biometric processing, keystroke monitoring, monitoring that affects pay or performance, and profiling. A monitoring DPIA should cover:

The specific threat or business problem, with evidence (incident history, audit findings, regulatory duty).
Each data source, the fields collected and whether content or only metadata is captured.
Less intrusive alternatives considered and why they were rejected, for example blocking a category of sites instead of logging all browsing.
Who can see raw data, alerts and investigation files, and how access is logged.
Retention periods for telemetry, alerts and closed cases.
Worker consultation: the ICO expects you to seek and document workers' or representatives' views unless there is a good reason not to.
Residual risk and sign-off. If high risk cannot be reduced, the UK GDPR requires prior consultation with the ICO.

See the DPIA Guide for the method and the DPIA Template for a working form.

Proportionality by monitoring method

The ICO guidance and WP249 converge on a clear hierarchy: metadata before content, targeted before blanket, prevention before detection. The table summarises how regulators view common security monitoring methods.

Method	Regulator view	Proportionate design
Email and messaging	ICO prefers network or traffic data over content; content access only under a clear pre-published policy for exceptional cases	DLP rules on attachments and classification labels; content review only on a triggered alert, by a small named team
Web traffic and TLS inspection	WP249 says systematic monitoring of all online activity through TLS inspection or DLP should be avoided	Block risky categories, bypass inspection for banking and health sites, log category and volume rather than full URLs where possible
Endpoint DLP	Acceptable when targeted at defined data and channels	Policies scoped to labelled or classified data and to USB, upload and print channels; just-in-time user notifications. See the Endpoint DLP Guide.
Keystroke logging and screenshots	ICO: high risk, likely to capture excessive and special category data, keystroke data can be behavioural biometric data; WP249: should not be deployed for home working	Avoid for general use; consider only in a covert investigation that meets the conditions below
Webcam capture	ICO: rarely justifiable	Do not use for productivity or presence checks
Call recording	ICO: recording content usually disproportionate unless required; callers must be told	Itemised call records where content is not needed; record only where a legal duty applies
Biometric time and attendance	Special category data, DPIA required, a genuine non-biometric alternative such as a PIN where explicit consent is relied on	Offer badge or PIN alternatives without disadvantage. See the Illinois BIPA and Biometric Privacy Guide for US exposure.
Vehicle telematics	ICO: monitoring private use rarely justified; WP249: employees should be able to pause tracking on private trips	Privacy switch, no out-of-hours tracking, no reuse for performance scoring without a new basis
Emotion or sentiment AI	EU AI Act Article 5(1)(f) prohibits workplace emotion inference except for medical or safety reasons	Exclude emotion scoring features from collaboration and contact centre tools used in the EU

The ICO's enforcement against Serco Leisure in February 2024 shows where the line sits: it ordered Serco Leisure, Serco Jersey and seven associated leisure trusts to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees at 38 sites, finding the biometric processing unlawful.

Remote work, BYOD and covert monitoring

Home working: the ICO notes that privacy expectations are higher at home and the risk of capturing family life is greater, and that Article 8 of the Human Rights Act 1998 is relevant. WP249 says keystroke logging, screen capture, webcam use and application logging should not be deployed on home workers. Rely on identity, endpoint and data controls rather than watching the screen.
BYOD: WP249 expects employers to separate private and business use and not to access areas presumed private, such as personal photo folders. Use app protection policies or a managed work profile, so corporate monitoring stops at the container boundary. Mobile device management needs a DPIA, and location features should be limited.
Covert monitoring: the ICO says it is generally unjustifiable but may be justified exceptionally to prevent or detect suspected criminal activity or gross misconduct. It requires a DPIA, senior management authorisation, limits on time and scope, an end once the investigation ends, and never covert audio or video in private areas such as toilets or changing rooms. Connecticut's statute has a parallel exception to prior notice where the employer has reasonable grounds to believe an employee is breaking the law, violating the legal rights of the employer or other employees, or creating a hostile work environment, and monitoring may produce evidence.
Customer-driven monitoring: the ICO is explicit that a customer's demand alone does not justify monitoring your staff; you remain the controller.

Departing employee monitoring

Leavers are the period of highest data exfiltration risk and the strongest proportionality case for targeted monitoring, because the purpose is specific and the window is short. A defensible design:

Trigger: start on an HR event (resignation, notice served, redundancy consultation), not on manager suspicion alone. Feed the event from the HR system into the insider risk or DLP tool automatically.
Scope: limit review to data movement indicators: bulk downloads from SharePoint, Google Drive or source repositories, uploads to personal cloud storage, USB transfers, forwarding to personal email and printing volume. ATT&CK describes the adversary behaviours as T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service and T1052.001 Exfiltration over USB.
Look-back and duration: define both in policy, for example the notice period plus a fixed look-back, and end monitoring when the leaver's access ends.
Human review: alerts go to a small trained team, and no adverse decision is taken solely on an automated score. Under Article 22, the ICO expects meaningful human involvement with real authority to disagree.
Revoke, do not just watch: monitoring finds misuse; revocation prevents it. Disable accounts, revoke sessions and OAuth grants, and rotate any keys, secrets and certificates the person could reach. The Coupang breach is the cautionary case: a former engineer used a token signing key that was never rotated after he left to harvest data for about seven months.

See the Employee Offboarding Security Guide and the Insider Data Theft Guide.

Where identity fits

Most useful insider signals already sit in identity logs: sign-ins from new devices, consent grants to unfamiliar OAuth apps, privilege elevation and access to repositories outside a person's role (ATT&CK T1078 Valid Accounts covers misuse of legitimate credentials). Monitoring identity events rather than screen content is usually both more effective and less intrusive. It also extends naturally to the service accounts, API keys and tokens staff create, which do not leave when they do. See the Insider Threat and Identity Guide.

Implementing a monitoring programme

Govern: set up a monitoring working group of security, HR, legal, privacy and (where present) works council or union representatives. Agree written purposes and a list of prohibited uses, such as productivity scoring from security telemetry.
Inventory: list every tool that already monitors staff, including features switched on by default in collaboration suites. Many organisations discover monitoring they never assessed.
Assess: complete the legitimate interests assessment and DPIA per method; record national Article 88 rules and US state notice duties per site.
Notify: publish an acceptable use and monitoring notice in plain language; in New York collect acknowledgement at hire; in Connecticut list worksite locations and post the notice at each from 1 October 2026.
Pilot: run DLP and UEBA policies in audit or simulation mode for a pilot group, review false positives and over-collection, then tighten scope before enforcement.
Operate: restrict access to raw telemetry with role-based access and log every query of monitoring data; protect those logs from tampering.
Review and roll back: re-evaluate the policy at least annually, as WP249 recommends, and keep a documented rollback path: disable a policy, purge data collected beyond scope and notify affected staff if a method is withdrawn as disproportionate.

Small versus large organisations

A small organisation can usually meet its security goals with identity logs, SaaS audit logs and a few DLP rules on labelled data, with a single DPIA covering them. A large or multinational organisation needs per-country assessments, works council agreements in several EU states, and a central register of monitoring tools. In both cases, buying an insider risk platform does not decide the design: its default features often exceed what your DPIA supports. See the Insider Threat Programme Guide.

Detection and measurement

Log the monitoring itself: who queried which worker's data, when and under which case reference. Then measure whether the programme is both effective and proportionate:

Coverage of assessments: percentage of monitoring tools with a current DPIA and legitimate interests assessment (target 100 percent).
Alert precision: share of DLP or UEBA alerts that lead to a confirmed policy breach after human review.
Leaver coverage: percentage of leavers whose data movement review and credential revocation completed by their last day.
Access to monitoring data: number of people with raw telemetry access and number of queries without a case reference (target zero).
Retention compliance: percentage of monitoring data stores purged on schedule.
Worker challenges: subject access requests and objections relating to monitoring, and their outcomes, as an early signal of trust problems.

Common failure patterns

Turning on every feature: deploying an insider risk suite with screenshots, keystroke capture and sentiment scoring enabled because they came in the licence, with no DPIA covering them.
Relying on consent forms: asking staff to sign a monitoring consent and treating that as the lawful basis, which the ICO says is usually inappropriate in employment.
Function creep: reusing security telemetry or access control data to score productivity or attendance; the ICO says this needs a new lawful basis.
Biometric shortcuts: fingerprint or face recognition for attendance without a genuine alternative, as in the Serco Leisure enforcement.
Monitoring instead of revoking: watching a leaver's activity while their keys, tokens and service account credentials stay valid, as in the Coupang breach.
Notice that does not match practice: a generic acceptable use clause that does not mention the methods in use, or a US notice that omits locations Connecticut now requires.

Framework mapping

Framework	Reference	Relevance to employee monitoring
NIST CSF 2.0	DE.CM-03	Personnel activity and technology usage are monitored to find potentially adverse events
NIST CSF 2.0	GV.OC-03	Legal, regulatory and contractual requirements, including privacy and civil liberties obligations, are understood and managed
NIST SP 800-53 Rev. 5	PT-2, PT-3, PT-5	Authority to process, processing purposes and privacy notice
NIST SP 800-53 Rev. 5	RA-8	Privacy impact assessments
NIST SP 800-53 Rev. 5	AU-6, AU-9, AU-11	Review of audit records, protection of audit information and retention
NIST SP 800-53 Rev. 5	PS-4, PS-6	Personnel termination and access agreements
ISO/IEC 27001:2022 Annex A	A.5.34, A.8.16	Privacy and protection of PII; monitoring activities
MITRE ATT&CK	T1078, T1213, T1530, T1567, T1052.001	Insider misuse of valid accounts and common exfiltration paths that targeted monitoring should cover

Practitioner checklist

Write down each monitoring purpose and the specific threat it addresses before choosing tools.
Inventory every tool and default feature that collects data about staff activity.
Complete a legitimate interests assessment and a DPIA for each high-risk method, and consult worker representatives.
Prefer metadata, labelled-data DLP and identity signals over content capture, keystrokes, screenshots and webcams.
Publish a plain-language monitoring notice; collect acknowledgement in New York and list worksite locations in Connecticut.
Define covert monitoring conditions: suspected crime or gross misconduct, senior sign-off, DPIA, time limit, no private areas.
Trigger time-boxed leaver monitoring from HR events and pair it with revocation of accounts, sessions, tokens and keys.
Restrict and log access to monitoring data, and keep a human in the loop for any adverse decision.
Set retention periods for telemetry and case files and verify purges.
Review the programme annually and after any new tool or feature is enabled.

Standards and references

Related NHI Mgmt Group resources: Insider Threat Programme Guide · AI and Privacy Guide · US State Privacy Laws Guide · DPIA Guide · AI Usage Monitoring Guide. This guide summarises employee monitoring law and regulatory guidance in the UK, EU and selected US jurisdictions and is not legal advice.

Employee Monitoring and Privacy Guide: Lawful, Proportionate Workplace Monitoring