UK Employee & Workplace Monitoring Laws: The 2026 Employer Compliance Guide

The following guide should be regarded as general only and not as legal advice; if you require advice that is specific to your situation, you should obtain professional data protection advice in the UK.

Is it legal for computers to be monitored at work in the UK?

In the UK and most parts of the world, employers can monitor their employees, provided they do so in accordance with applicable data protection and employment laws.

The UK GDPR and the DPA 2018 impose strict limits on monitoring workers. While the ICO has noted that companies have legitimate interests in monitoring productivity and protecting sensitive assets, employees also have a legitimate expectation of privacy, even when using company property.

Choosing a Lawful Basis

You need a legitimate basis under Article 6 before monitoring can take place.

• Legitimate interests (Article 6(1)(f)): This is the most flexible option for most employers, as the Information Commissioner’s Office says it can apply in a wide range of circumstances, such as security and performance management. 
• Under legal obligation (Article 6(1)(c)): apply it in cases where a statute or regulator mandates monitoring, for example, in some rules concerning record-keeping in the financial services sector.
• Consent: This is generally invalid because of the power imbalance between the employer and the employee. The ICO applied this argument in the Serco case referred to below.

Legitimate Interests Assessments and DPIAs

If an employer wants to monitor on the grounds of Legitimate Interests, it must prepare a written Legitimate Interests Assessment (LIA) to establish the purpose, necessity, and proportionality of the monitoring. A Data Protection Impact Assessment (DPIA) should be carried out in cases where the monitoring poses a high risk, for example where monitoring is carried out in accordance with Article 35 (systematic tracking or automated profiling) and the ICO recommends that such monitoring should be accompanied by a DPIA.

Keeping Humans in the Loop

You must not discipline or dismiss employees just on the basis of their automated monitoring scores. The Data (Use and Access) Act 2025 has amended the UK’s rules regarding automated decision-making. Although it permits more automated decisions than before, stricter safeguards remain, especially where special category data is concerned. These safeguards require that workers be informed, have the right to challenge decisions, and receive proper human review. Ensure that all three of these elements are included in your procedure.

The UK Legal Framework for Workplace Monitoring

To fully understand workplace monitoring standards, organizations have to align their practices across four intersecting statutory and common law frameworks:

1. UK GDPR and the Data Protection Act 2018

The primary laws governing employee monitoring are the UK GDPR and the Data Protection Act 2018. Together they require employers to follow seven data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.

2. The Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 brings updates to UK data protection laws while still imposing strict restrictions on the use of employee data. The Act emphasises clear governance, responsibility and practical data use. It provides employers with clarity and helps to ensure fair monitoring practices.

3. Human Rights Act 1998 and Employment Law

Article 8 of the Human Rights Act 1998 includes provisions relating to private life which offer protection in this regard. Although the Act imposes direct duties on public authorities, courts consider it when interpreting employers’ obligations.

The European Court of Human Rights has said that communications made by employees can be covered by privacy rights in the course of work, as in Copland v United Kingdom (2007) and Bărbulescu v Romania (2017). Furthermore, intrusive surveillance may breach the implied duty of trust and confidence, which can in turn form the basis of a claim of constructive dismissal.

Monitoring Emails and Communications

The Regulations which prescribe the monitoring of emails and messages are the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping) Regulations 2018, and under those regulations interception may only occur in order to establish business facts, in order to comply with regulatory requirements or in order to prevent the improper use of the network. Employers must ensure employees are informed before monitoring them.

The TUC’s 2018 “I’ll be watching you” report found that 56% of workers believed they were being tracked, rising to 69% among employees in large organisations. The ICO discovered that 70% of the general public would find it excessive to have their behaviour monitored, and the ICO’s consultation with workforce representatives helped to alleviate this annoyance by introducing behaviour monitoring.

Monitoring Methods by Risk Level

The ICO emphasizes that monitoring should always be the least intrusive means of achieving a legitimate business purpose. When evaluating the use of any tool, its risk profile must be assessed in light of the UK GDPR requirements:

What Happens If You Get It Wrong

Deploying workplace surveillance without strong data protection governance exposes UK organizations to significant financial, operational, and legal risks:

• For a serious breach of the UK GDPR and the Data Protection Act 2018, the ICO may impose financial fines amounting to up to 17.5 million or 4% of the company’s global annual revenue, whichever of the two is higher.
• Regarding the notices asking for the cessation of monitoring: in February 2024, the ICO issued notices to Serco Leisure and seven trusts associated with it, requesting that they stop using facial recognition and fingerprint scanning to record attendance. The ICO determined that these seven trusts had violated the law since they had been processing the biometric data of over 2,000 staff at 38 leisure centres, data which the ICO said could be substituted by less intrusive methods. The notices also required them to delete the optional data. See the ICO’s statement.
• Excessive, secret, or unreasonable surveillance breaches the duty of implied mutual trust and confidence owed to the employee, meaning the employee is entitled to resign and take legal action for constructive unfair dismissal.
• The number of Subject Access Requests (SARs) resulting from challenges to disciplinary actions or grievances tends to cause poorly managed or unminimized records to come under legal scrutiny (as stated in Article 15).

How to Monitor Employees without Violating Privacy

Employers may carry out monitoring of their workers in a legal and ethical manner by carrying out a documented Data Protection Impact Assessment (DPIA), by avoiding the use of intrusive surveillance techniques such as keystroke loggers, by using smart trigger-based tracking, by setting up working hour schedules, and by keeping the company completely transparent.

By complying with these business principles, organizations protect the business while observing human rights and preserving ethical employee monitoring standards:

Avoid Aggressive Surveillance Features

• Do not use software that captures keystrokes, runs a continuous webcam feed, or picks up ambient audio.
• Two-thirds of workers opposed webcam tracking according to a survey carried out by the TUC/Britain Thinks in 2018.
• Make use of tools which are based on policy and focused on specific applications, leveraging access to applications, the monitoring of application usage and web category filtering, as well as endpoint DLP.

Use Trigger-Based Data Capture

• Avoid continuous screen recording (for example, a great deal of Special Category Data could be accessed when viewing, such as on medical portals during lunch hour).
• A different possibility would be to generate screenshot prompts only in those situations where users are carrying out high-risk activities, such as when they are copying data to external or unauthorised removable media or when they are opening applications that are part of the shadow IT.

Protect Special Category Data

• Any monitoring that results in the collection of health, religious or other sensitive data, even if this only happens by accident, must comply with the Article 9 condition set out in the UK GDPR.
• Providers should have modified the tool in order to reduce the amount of sensitive data collected by avoiding the use of non-work portals, private email and private messaging.
• Modern employee monitoring tools allow administrators to set up tracking schedules which cause all the monitoring features to turn off outside of working hours, on weekends, and during the agreed shift breaks.

Monitoring Remote and Hybrid Workers

When employers are keeping an eye on employees who are working from home in the UK, they should take into account the greater confidentiality requirements. The home environment tends to blur the line between their professional obligations and their private life since family members may be seen on the webcams and their personal lives can be seen on the screens when taking breaks.
To sustain compliance among decentralized teams, organizations must observe strict operational boundaries:

• Don’t monitor personal devices or home networks: Ensure that the monitoring tool is restricted to devices that belong to the company and must not be capable of tracking traffic on home Wi-Fi or on personal BYOD devices.
• Avoid providing GPS tracking information: Use categories rather than GPS tracking: Instead of employing intrusive GPS tracking, use tools that maintain privacy by categorising your activity into broad categories, such as Office, Remote, or Hybrid, based on network IP and default gateway data.
• Enforce tracking schedules: When the boundary between work and home becomes blurred, particularly when employees are working from home, there should be an automatic switch-off during times outside of contracted work hours, during the lunch break and on weekends.

By combining non-invasive workforce intelligence with well-defined working boundaries, companies can legally keep an eye on their off-site teams through the use of special remote employee monitoring software without damaging worker trust.

How to Write an Acceptable Use Policy for Employee Monitoring

In order for businesses to produce a UK GDPR-compliant ICO acceptable use policy (AUP), they should state a clear business purpose for monitoring, identify the data which is to be collected and recorded, set out the limits of personal use, specify the rights of the data subject, and obtain written acknowledgement from the employee.

The transparency requirements under Articles 13 and 14 of the UK GDPR are legal. An effective and transparent AUP serves as the basis of a good security culture. In order to be compliant with the ICO, an Acceptable Use Policy must have:

• Clear Purpose & Scope: Clearly lay out what you want to achieve, such as tracking software usage, protecting proprietary information, or monitoring time spent on billable tasks.
• Make clear exactly which metrics the software is recording – this should include the times during which the software is active and during which it is idle, the URLs of the websites visited, and any external connections made through USB, etc.;  and also specify which ones it is not recording (for example, personal passwords and keystrokes).
• Regarding personal use and time tracking: clarify the limits concerning personal use (for example, reading the news during your lunch break) and explain how monitoring your schedule protects the privacy of your time outside of work hours.
• Regarding data access and Subject Access Requests: provide details on (a) who is allowed to view the logs (for example, only IT and HR staff, pursuant to RBAC) and (b) the way in which employees can make use of their Subject Access Request (SAR) to obtain their data.

Employers may adopt the free Workplace Monitoring Policy Template available from CurrentWare in order to establish guidelines and prevent breaches of the privacy framework in the UK.

Monitoring Employee AI Usage Under UK GDPR

The use of generative AI and covert AI in the workplace creates new data security risks under the UK GDPR. According to the IBM Cost of a Data Breach Report, shadow AI was involved in 20% of data breaches and increased the average cost of a breach by $670,000.

Employers who are monitoring their employees’ prompts, tracking keywords or reading text from screenshots should make sure that these activities are included in their DPIA, incorporating measures such as redaction and granting access on a role-by-role basis to reduce exposure. Solutions specifically designed for this purpose, such as CurrentWare’s AI Usage Insights, can provide visibility regarding AI adoption without putting workers’ confidentiality at risk.

What makes Employee Monitoring Software UK GDPR-Compliant?

It is not possible for monitoring software alone to make an organization compliant; it is the way in which the software is designed and used that results in compliance. Look for tools that offer:

• To achieve data minimization: You should watch over the applications that are being used, the websites that are visited, the amount of time spent being active or idle, and even the position of the mouse, but you should not monitor keystrokes or continuously record the screen.
• Evidence collection on a proportional basis: Instead of collecting data continuously, take screenshots when a policy violation is triggered.
• For schedule tracking, the process should pause automatically when you are not working or during breaks.
• For access control and redaction: use role-based access to ensure only authorised HR or IT staff can see the data, while automatically redacting any sensitive information.
• Retention controls: Automatic deletion of logs and screenshots after a defined period, so data is not kept longer than necessary.
• Deployment Choice: You have the option of using a cloud deployment with transfer protection or going with self-hosting if you want full control.

How CurrentWare Supports Privacy-First Monitoring

This approach can be seen in the CurrentWare suite of core modules from $5 to $6 USD per user/month:

• BrowseReporter offers workforce analytics and the monitoring of schedule adherence without logging any keystrokes. Screenshots are only enabled when required and can be linked to triggers in order to provide context for audits.
• BrowseControl enables administrators to block shadow IT and malicious domains before disciplinary monitoring, reducing the need for reactive measures.
• Access Patrol provides the most detailed control for USB and Bluetooth devices; when a file is copied to a portable device, it creates a secure shadow copy, forming a record of the file transfer.
• EnPowerManager keeps a record of the times when people log on and log off for the purpose of attendance.

Conclusion

Employers have the legal right to monitor employees in the UK, providing it is necessary, proportionate and open. As well as a genuine legitimate interest under UK GDPR and the Data Protection Act 2018, employers must conduct a DPIA before high-risk monitoring commences and have an explicit acceptable use policy. Minimise intrusion by avoiding keystroke logging or continuous recording, turning off monitoring out of hours, and setting retention periods.