Employee monitoring law · France
Consult the CSE first. Skipping it is the criminal offence of obstruction.
Consult the CSE and inform every employee first. Skipping the consultation is itself the offence.
- Region
- Europe
- Instruments
- 4 governing
- Employer duties
- 4 listed
- Last reviewed
- August 22, 2026
France · what the law requires
Consultation required
France permits monitoring on three cumulative conditions: it must be justified and proportionate to the aim, the CSE must be consulted in undertakings of 50 or more, and employees must be informed before it starts. The consultation is not optional courtesy. Failing to consult the CSE is the délit d'entrave, a criminal offence, and the CNIL has sanctioned employers on precisely that basis. Article L.1121-1 requires the least restrictive measure that achieves the purpose.
- CSE consultation before deploymentConsult, minute it, and keep the minutes. Deploying first makes the whole processing challengeable and exposes the employer to the obstruction offence.
- The least restrictive meansIf aggregate data answers the question, individual-level capture will not pass. Proportionality is assessed against what you could have done instead.
- Individual information beforehandEvery employee must be told before monitoring starts. Evidence gathered from an undisclosed device is generally inadmissible.
- DPIA and register entrySystematic monitoring goes in the record of processing activities and needs an impact assessment.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- GDPR: Regulation (EU) 2016/679. Sets the floor everywhere in the EEA: a lawful basis, purpose limitation, data minimisation, transparency and a DPIA where monitoring is high risk. National law below adds to this, never subtracts.
- Labour Code: proportionality: Code du travail art. L.1121-1. No restriction on individual rights unless justified by the task and proportionate to the aim. The least intrusive workable option is the required one.
- Labour Code: CSE consultation: Code du travail art. L.2312-38. The CSE must be consulted before any means or technique enabling monitoring of employee activity is introduced.
- CNIL guidance: Fiche pratique on monitoring employee activity. Consolidated conditions of lawfulness for a monitoring device, refreshed July 2026.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in France that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Consult the CSE and keep the minutes. This is the step enforcement asks about first.
- 2Write the proportionality analysis: what you considered, what you rejected, and why the chosen configuration is the least restrictive.
- 3Update the register of processing activities and complete the DPIA.
- If you get it wrongCNIL fines up to €20m or 4% of global turnover. The délit d'entrave for failing to consult the CSE is criminal, carrying a fine and exposure for the responsible officer.
Verify the claim
Every control above, on the page that describes it
- Capture policies scoped by teamGive the CSE a specific, bounded configuration to consult on
- Aggregate focus and capacity analytics that work with screenshot capture disabledPrefer the least intrusive setting that answers the question
- Notice and consent record carrying the policy version and date per personDemonstrate individual information was given, and when
- Hash-chained access logAnswer a CNIL request about who accessed what
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Europe
- BelgiumCBA 81 governs electronic monitoring and binds every private-sector employer.
- SpainDigital rights are written into the data protection act, and reps must be involved.
- FinlandA dedicated working-life privacy act, and a necessity test read very narrowly.
- PolandThe Labour Code lists the permitted purposes, and productivity is not one of them.
- United KingdomThe ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
- IrelandThe DPC accepts a legitimate business interest, and then tests proportionality hard.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.