Employee monitoring law · United Kingdom
The ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
Complete a DPIA, choose a lawful basis and tell people. The ICO expects all three before you start.
- Region
- Europe
- Instruments
- 3 governing
- Employer duties
- 4 listed
- Last reviewed
- August 22, 2026
United Kingdom · what the law requires
Notice and proportionality
The UK has no separate monitoring statute; UK GDPR and the DPA 2018 apply, interpreted through the ICO's Employment practices guidance on monitoring workers, published October 2023. It requires a lawful basis identified in advance, a DPIA for high-risk monitoring, the ICO names keystroke monitoring and monitoring that could lead to financial loss such as performance management, transparency in the privacy information, and it notes that homeworkers have a higher expectation of privacy.
- A lawful basis chosen before deploymentUsually legitimate interests, which requires a documented balancing test. Consent is rarely appropriate given the imbalance in the employment relationship.
- A DPIA for high-risk monitoringThe ICO names keystroke monitoring and monitoring used in performance management. Its position is to do one even where you conclude it is not strictly mandatory.
- Transparency in the privacy informationWorkers need readily accessible detail on what is monitored, the lawful basis and the retention period.
- Homeworkers expect more privacyThe ICO says so explicitly. A configuration defensible in an office may not be defensible at a kitchen table.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- UK GDPR and Data Protection Act 2018: UK GDPR arts. 5, 6, 35; DPA 2018. Lawful basis, transparency, minimisation, and the DPIA obligation for high-risk processing.
- ICO guidance on monitoring workers: Employment practices and data protection, October 2023. The operative regulator guidance: lawful bases, DPIA triggers, transparency expectations and the treatment of homeworkers.
- Human Rights Act 1998: Art. 8 ECHR as applied. Private life at work: the backdrop to the proportionality analysis in tribunal claims.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in United Kingdom that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Complete and keep the DPIA, and the legitimate interests assessment behind your lawful basis.
- 2Update the worker privacy information to describe the monitoring specifically.
- 3Set a separate, more conservative position for homeworkers if you monitor them.
- If you get it wrongICO fines up to £17.5m or 4% of global turnover, plus employment tribunal exposure where monitoring underpins a dismissal.
Verify the claim
Every control above, on the page that describes it
- Per-app deny-lists and capture policies scoped to working hours and teamEvidence the balancing test with a bounded scope
- Employee self-view of everything collectedGive workers the transparency the ICO expects
- Configurable retention and deletionHold retention to the period you published
- Read-only v1 REST API with scoped keysAnswer a subject access request about monitoring data
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Europe
- IrelandThe DPC accepts a legitimate business interest, and then tests proportionality hard.
- SwedenCo-determination negotiation before any significant change, including this one.
- NorwayControl measures need discussion with employee representatives and periodic review.
- DenmarkSix weeks' notice under the collective agreement framework, and a strict purpose test.
- GermanyThe works council holds a veto, and a productivity dashboard is enough to trigger it.
- AustriaA works council veto with no workaround, and no council means individual consent.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.