UK employers may monitor workers if the monitoring is lawful, fair and transparent under the UK GDPR and the Data Protection Act 2018. The Information Commissioner's Office (ICO) expects employers to tell workers what is monitored and why, to have a lawful basis, to use the least intrusive method that achieves the purpose, and to carry out a data protection impact assessment before any high-risk monitoring. Covert monitoring is for exceptional circumstances only.
Key takeaways
- Tell workers about any monitoring. Hidden monitoring is the rare exception.
- Consent is not usually a valid basis at work, because of the imbalance of power.
- Do a DPIA before monitoring that is likely to be high risk.
- People working from home have a greater expectation of privacy.
What does the ICO expect from employers?
The ICO published its guidance on monitoring workers in October 2023. Its announcement lists what an employer must do.
The ICO's seven expectations
- Make workers aware of the nature, extent and reasons for the monitoring
- Have a clearly defined purpose and use the least intrusive means to achieve it
- Have a lawful basis for processing workers' data
- Tell workers about the monitoring in a way that is easy to understand
- Keep only the information that is relevant to the purpose
- Carry out a data protection impact assessment for monitoring likely to be high risk
- Make the information available to workers who ask for it through a subject access request
The guidance applies to any arrangement where a person performs work for an organization, whatever the contract. That includes gig work.
How do UK workers feel about monitoring?
The ICO commissioned a survey alongside the guidance.
- 70%
of UK adults would find monitoring by an employer intrusive
ICO, 2023 - 19%
would feel comfortable taking a new job if they knew they would be monitored
ICO, 2023 - 57%
would feel uncomfortable taking that job
ICO, 2023
- Monitoring of personal devices83%
- Audio or video recording78%
- Screenshots or webcam footage77%
- Timekeeping and access monitoring47%
Source: ICO survey of 1,012 UK adults, carried out by Survation in August 2023.
The lesson for employers is practical. Recording hours and attendance meets far less resistance than capturing screens or cameras, so start with the lighter method and add more only where you can explain why.
Which lawful basis can you use?
Not consent, in most cases. The guidance says consent is not usually appropriate in the employment context. Workers may feel they have no real choice, so consent only works where they have a real choice and control over the monitoring.
Most employers rely on another basis under the UK GDPR, such as legitimate interests or a legal obligation, and record the reasoning. The bases are explained in employee monitoring under GDPR.
When do you need a DPIA?
Before any monitoring that is likely to cause high risk to workers or to other people. The ICO's examples of high-risk monitoring include:
- processing biometric data
- keystroke monitoring
- monitoring that could lead to financial loss, such as monitoring used for performance management
- profiling that uses special category data
The guidance recommends a DPIA even where no high risk is found, because it forces the decision to be written down.
Describe the monitoring
What is collected, from whom, when and by which tool.
State the purpose
One specific aim, such as accurate timesheets or protection of client data.
Test necessity
Ask whether a less intrusive method would achieve the same aim.
List the risks
Include the risk of capturing private information, above all at home.
Record the safeguards
Notice, limits on access, retention periods and a named owner.
Decide and review
Sign it off, then review it when the monitoring changes.
Can you monitor people who work from home?
Yes, with more care. The guidance says workers' expectations of privacy are significantly greater at home than in the workplace. The risk of capturing family or private life is higher, and that has to weigh in the assessment.
In practice: limit monitoring to working hours, avoid cameras unless there is a strong reason, and blur or skip screenshots where personal information is likely to appear.
When is covert monitoring allowed?
Rarely. The ICO says covert monitoring is unlikely to be justified in most usual circumstances.
Covert monitoring under the ICO guidance
- When
- Exceptional circumstances, such as suspected criminal activity or gross misconduct
- Who decides
- Senior management
- How long
- The shortest time possible
- Purpose
- Gathering evidence for a specific investigation
- End
- When the investigation ends
Everything else must be open. Apart from those very exceptional cases, employers must inform workers about any monitoring. See stealth vs transparent monitoring.
How do you keep monitoring proportionate?
| Method | Typical concern | A proportionate setup |
|---|---|---|
| Time and attendance | Low | Record working hours only, and show people their own record |
| Application and website tracking | Medium | Record the domain, not page content, and only in working hours |
| Screenshots | High | Longer random intervals, blur, short retention, access limited to the line manager |
| Webcam captures | High | Only where identity must be confirmed, with notice and blur |
| Personal devices | Highest | Avoid, or confine monitoring to a work application |
How does BirdsEye fit the ICO's expectations?
BirdsEye gives you settings that match the list above. It does not make a deployment compliant on its own.
- Awareness. The desktop agent shows each person the hours, screenshot interval, blur level and idle threshold applied to them.
- Least intrusive means. Website tracking records the domain only and can be switched off. Screenshots can be blurred lightly or heavily.
- Home working. Nothing is captured outside the working hours and days you set, including captures a manager requests.
- Relevant information only. Retention is yours to set, with separate periods for screenshots and webcam clips.
- Access. Managers see only their own teams, and employees can open their own activity and captures.
See security and privacy.
Frequently asked questions
Is it legal to monitor employees in the UK?
Yes, if the monitoring has a lawful basis, workers are told about it, and it is necessary and proportionate to a clear purpose. The ICO's guidance sets out what that means in practice.
Do UK employers need consent to monitor staff?
Usually not, and consent is rarely the right basis. The ICO says consent is not usually appropriate in employment because workers may feel unable to refuse. Employers normally rely on another lawful basis and give clear notice.
Can employees ask to see the data collected about them?
Yes. Personal information collected through monitoring must be made available to a worker who makes a subject access request.
Can an employer monitor secretly?
Only in exceptional circumstances, such as suspected criminal activity or gross misconduct. It should be approved by senior management, aimed at a specific investigation and kept as short as possible.