UK employee monitoring laws: FAQs for employers (2026)

Employee monitoring is legal in the UK when it is lawful, transparent, and proportionate. Employers must have a lawful basis under the UK GDPR and the Data Protection Act 2018, tell staff what is monitored and why, and keep the monitoring no wider than the business need. The Human Rights Act 1998 also gives workers a right to a private life, which is stronger at home than in the office. This guide answers the questions UK employers ask most about workplace monitoring. It is general information, not legal advice, so check the position that applies to your organisation with a qualified adviser before you act.

UK employee monitoring law at a glance

UK workplace monitoring sits under the UK GDPR, the Data Protection Act 2018, and the Human Rights Act 1998, with the Investigatory Powers Act 2016 covering the interception of calls and messages. The Information Commissioner's Office (ICO) is the regulator and publishes the main guidance for employers. The six data protection principles. Any monitoring that collects personal data must follow the six principles set out in the UK GDPR:

1. Lawful, fair, and transparent: staff must know they are monitored and why.
2. Purpose limitation: the data must serve a specific, legitimate aim such as security or productivity.
3. Data minimisation: collection must be relevant and not excessive.
4. Accuracy: the information must be correct and kept up to date.
5. Storage limitation: data cannot be kept for longer than necessary.
6. Integrity and confidentiality: collected data must be held securely.

What employers should have in place. The ICO expects employers running most monitoring to:

• Complete a data protection impact assessment (DPIA) before starting high-risk monitoring, such as behaviour analysis, location tracking, or content inspection.
• Set out the rules in writing in a handbook, contract or acceptable use policy, and share them with staff.
• Answer subject access requests, because employees have the right to request and see the personal data held about them.

Covert monitoring is the exception. Secret monitoring is unlawful in almost all normal circumstances. It is only justified where there is a genuine suspicion of criminal activity or gross misconduct, and telling the worker would defeat the investigation. And even then, it must be time-limited, targeted, and signed off by senior management.

Employee monitoring basics

Is employee monitoring legal in the UK?

Yes. Under UK law, employee monitoring is legal when the employer has a lawful basis, is transparent about it, and keeps it proportionate. The main rules come from the UK GDPR and the Data Protection Act 2018, which require monitoring to be lawful, fair, and limited to what the business genuinely needs. Workers also keep a right to respect for their private life under the Human Rights Act 1998.

Do employers have to tell staff they are being monitored?

Yes, in almost all cases. GOV.UK states that employers must explain the amount of monitoring clearly in the staff handbook or contract. Being open about monitoring is both a legal requirement and the practical way to keep it fair. The only exception is narrow covert monitoring, covered below.

Do employers need employee consent to monitor?

Usually not. The Information Commissioner's Office says consent is not usually appropriate in the employment context because of the imbalance of power between an employer and its workers. Most employers instead rely on "legitimate interests" as their lawful basis, supported by a data protection impact assessment and clear notice to staff. Consent that a worker cannot freely refuse is not valid, so it is rarely the right foundation for monitoring. Source: ICO guidance on monitoring workers, as cited in this article.

Is a written monitoring policy required?

Yes, in practice. A clear monitoring policy is how an employer shows the monitoring is lawful, fair, and understood. A good policy sets out what is monitored, why, how the information is used and who can see it, and it forms part of the handbook or contract. Employers should share the policy, confirm staff have read it, and update it when the monitoring changes.

Can employers monitor staff during breaks?

Sometimes, but it must be justified. Under UK law, monitoring during breaks is only reasonable where there is a specific, legitimate reason, such as protecting security or investigating suspected wrongdoing. Blanket monitoring of workers on their breaks is hard to justify as proportionate, so the safer approach is to limit monitoring to working activity and company systems.

Can employers monitor secretly?

Only in rare, tightly controlled cases. The ICO treats covert monitoring as unlawful in almost all normal circumstances. It can be justified only where there is a genuine suspicion of criminal activity or gross misconduct, and telling the worker would prevent the investigation. Covert monitoring must be targeted, kept to the shortest time possible, stopped once the investigation ends, and authorised at a senior level.

Monitoring company devices

Can employers monitor company computers?

Yes. Because the employer owns the equipment, monitoring company computers is permitted where it is for a legitimate business reason, and staff have been told. Employers should still keep it proportionate and set out acceptable use in a written policy that employees have seen. Ownership of the device does not remove the need for transparency and a lawful basis.

Can employers monitor company phones?

Yes. Under UK law, an employer can monitor a company-owned phone, including call records and location, where there is a legitimate business purpose and staff are informed. Recording or intercepting the content of calls is governed separately by the interception rules covered in the legislation section below, and the same transparency and proportionality tests apply.

Can employers monitor a company device outside work hours?

It depends on the justification. Because the employer owns the device, some monitoring can continue outside working hours, but it must still be necessary and proportionate. Continuous monitoring of a worker's own time raises the privacy stakes, so employers should limit out-of-hours monitoring to what a clear business need supports and say so in the policy.

Monitoring personal devices (BYOD)

Can employers monitor an employee's personal device?

Only in limited circumstances. Under UK law, an employer may monitor a personal device where it holds work data or is used for work, and only within a clear "bring your own device" (BYOD) policy that staff have agreed to. Monitoring beyond defined work applications is likely to be seen as disproportionate. A worker's personal device and personal life should otherwise stay out of the employer's reach.

Can employers monitor an employee's personal computer?

Only where work is involved, and a policy exists. The same test applies as for any personal device: monitoring a personal computer is only reasonable where it contains work-related information or is covered by a clear BYOD policy the employee is aware of. Even then, employers should be careful about how and when they monitor and keep it limited to work activity.

Can employers require monitoring software on a personal device?

No, not by force. An employer cannot compel a worker to install monitoring software on a personal device. Where monitoring is genuinely necessary, it is better handled through work-issued equipment, containerised work environments or application-level controls. If an employer insists on monitoring a personal device without agreement, the worker can challenge it.

Screen, calls, and message content

Can employers monitor screen content and keystrokes?

Yes, but it carries a high legal risk. Continuous keystroke logging and live screen capture are treated as high-risk monitoring in the UK. Employers are expected to justify the necessity, limit the scope and duration, and show that less intrusive options were considered first. Because of this, many organisations use non-invasive monitoring that measures active time, app and website categories, and attendance without recording screen content or the text of keystrokes.

Can employers monitor or record phone calls?

Yes, on business systems, with limits. Employers can monitor or record calls on their own telecommunications systems for defined business purposes, such as keeping records, meeting regulatory standards, or preventing crime. This is governed by the interception rules under the Investigatory Powers Act 2016 framework, and employers must tell users of the system that calls may be intercepted. Recording call content without a lawful basis or notice is not permitted.

Can employers monitor work email?

Yes, with a legitimate reason and notice. Employers can monitor email on company systems where there is a genuine business purpose and staff have been told, for example, to protect data or check acceptable use. The policy should explain when and why email is monitored, how the information is used, and who it may be shared with. Monitoring should focus on work communications rather than the content of clearly personal messages.

Can employers read private messages and personal email?

Rarely, and with caution. Even on a company device, workers keep some expectation of privacy, so opening genuinely private messages or personal email is difficult to justify and risks breaching data protection and human rights law. Employers should make clear in advance that personal use of work systems is limited and monitored at the level of usage rather than content. Reading the substance of private correspondence should be avoided unless a serious, specific investigation makes it necessary.

Video and CCTV monitoring

Can employers use CCTV or video monitoring at work?

Yes, where it is justified and signposted. Video monitoring is allowed for a legitimate business purpose, but staff must be aware of it, and signs should show where cameras operate. GOV.UK states that employers are , and cameras are not permitted in private areas such as toilets and changing rooms. Employers should weigh whether cameras are a proportionate answer to the problem or whether a less intrusive option would work. Source: GOV.UK guidance on being monitored at work

Can employers monitor staff through a device webcam?

Only with a strong justification. On a company device during working hours, limited webcam monitoring may be possible where it is necessary, and staff are told. Still, it is intrusive and hard to justify for routine productivity checks. On a worker's own device, the employer needs the worker's agreement. Continuous or covert webcam monitoring is very difficult to defend as proportionate.

Can employers monitor staff through a webcam outside work hours?

No. An employer has no right to monitor a worker through a webcam outside working hours, and doing so on a personal device would be a serious intrusion into private life. This kind of monitoring risks breaching both data protection law and the right to respect for private life under the Human Rights Act 1998.

GPS and location tracking

Can employers track employee location with GPS?

Yes, within limits. Location tracking is allowed when it is necessary and proportionate, for example to protect staff, manage fleet vehicles, or meet a genuine operational need, and when workers have been told. Tracking should be limited to working time and company assets wherever possible. Constant tracking of an individual, especially outside work, is intrusive and needs a strong, specific justification.

Can employers track a company car with GPS?

Yes. Because the vehicle belongs to the company, an employer can track a company car for legitimate reasons such as security, logistics, or duty of care. Staff should still be told that tracking is in place, and any personal-use arrangement (such as a "privacy mode" outside working hours) should be set out clearly.

Can employers track an employee's location outside work hours?

Only with a clear reason or agreement. Tracking a worker's location outside working hours is a significant intrusion, so it needs either a genuine, specific justification or the worker's agreement. For most employers, the proportionate approach is to switch off tracking outside working time or when a vehicle is being used privately.

Internet and social media monitoring

Can employers monitor internet and social media use?

Yes, during work and on company systems. Employers can check how staff use the internet and social media on company systems and time where there is a legitimate reason and a clear policy, for example to protect security or enforce acceptable use. Staff must be told in advance, and the policy should explain the extent of the monitoring. Monitoring should focus on work systems rather than reaching into a worker's private accounts.

Can employers monitor social media outside work hours?

Very limited. An employer generally has no right to monitor a worker's personal social media activity in their own time. Looking into private accounts outside work is intrusive and hard to justify, and it can breach data protection and privacy law. Any action an employer takes about off-duty conduct should rest on information that came to light lawfully, not on covert monitoring of private profiles.

Can employers keep the data collected on internet activity?

Yes, if they follow the data protection principles. An employer can retain monitoring data where it is relevant, held securely, and kept no longer than necessary. It cannot be shared or published without a lawful basis, and workers can ask to see it. Storage limitation and data minimisation mean old or excessive monitoring records should be deleted rather than stockpiled.

Employer rights and obligations

Which UK laws set employers' monitoring obligations?

UK monitoring is governed mainly by the UK GDPR and the Data Protection Act 2018, alongside the Human Rights Act 1998 and, for intercepting communications, the Investigatory Powers Act 2016. The Employment Rights Act 1996 governs employment rights more broadly, such as unfair dismissal, but it is not the law that regulates monitoring itself. Employers should treat the data protection framework and the ICO's guidance as the core rulebook for monitoring.

What are the penalties for unlawful monitoring?

They range from regulatory action to tribunal claims. The ICO can investigate and take enforcement action, including fines, where monitoring breaches data protection law. Workers can also bring employment tribunal claims, and mishandled monitoring often causes reputational damage and loss of trust before any formal penalty. The safest position is to document the lawful basis, complete a DPIA where needed, and keep monitoring transparent and proportionate.

Can employers use monitoring evidence against an employee?

Yes, if it was collected lawfully. Evidence gathered through lawful, proportionate monitoring can be used in disciplinary proceedings or, where appropriate, shared with the authorities. Evidence obtained through unlawful or covert monitoring that fails the tests above is far weaker and can expose the employer to its own liability. The value of monitoring evidence depends on the monitoring having been lawful in the first place.

Employee privacy rights

What privacy rights do UK employees have at work?

Employees keep meaningful privacy rights even when monitored. Under the UK GDPR and the Data Protection Act 2018, workers' personal data must be handled lawfully, fairly, and securely, and under the Human Rights Act 1998, they have a right to respect for their private and family life. That right is stronger at home than in the workplace, which matters for homeworkers. Employers must balance monitoring against these rights rather than override them.

Can employees see the data collected about them?

Yes, through a subject access request. Any UK worker can make a subject access request to see the personal data an employer holds about them, including information gathered through monitoring. The employer must respond within the statutory time limit and provide the data unless a specific exemption applies. This right is one reason to keep monitoring records accurate, relevant, and no larger than necessary.

Can employees challenge or take action over unlawful monitoring?

Yes. Where monitoring breaches data protection or human rights law, workers can complain to the ICO and may bring a claim, for example, at an employment tribunal. Employees can also raise concerns internally or through their union. This is why a documented lawful basis, a DPIA, and clear notice matter so much: they are the employer's defence if monitoring is challenged.

Key UK monitoring laws

What is the UK GDPR?

The UK GDPR is the United Kingdom's version of the General Data Protection Regulation, retained and adapted after Brexit. It sets the rules for handling personal data, including data collected through monitoring, and requires a lawful basis, transparency, and the six data protection principles. It works together with the Data Protection Act 2018, and the ICO enforces both.

What is the Data Protection Act 2018?

The Data Protection Act 2018 is the UK law that sits alongside the UK GDPR and replaced the Data Protection Act 1998. It sets out how personal data must be handled and gives people rights over their data, including the right of access. For monitoring, it means any personal data an employer collects must be processed lawfully, fairly, securely, and no more than necessary.

How does the Investigatory Powers Act 2016 apply, and what about RIPA?

The interception of calls and messages is governed by the Investigatory Powers Act 2016 and its business-monitoring regulations. For workplace monitoring, employers rely on the 2018 regulations that allow businesses to intercept communications on their own systems for defined purposes, such as record-keeping and preventing crime, provided users are told. The older Regulation of Investigatory Powers Act 2000 (RIPA) has largely been superseded by this framework, so the modern reference point for intercepting communications is the Investigatory Powers Act regime.

Does the UK have GDPR after Brexit?

Yes, in the form of the UK GDPR. The EU GDPR stopped applying directly after Brexit, but the UK kept an equivalent regime, the UK GDPR, working with the Data Protection Act 2018. For employers, this means the core data protection duties around monitoring did not disappear after Brexit; they continue under UK law.

Monitoring and workplace safety

Can monitoring be used to prevent harassment and discrimination?

Yes, where it is proportionate. Employers can use monitoring to help prevent or investigate harassment and discrimination, since keeping a safe and lawful workplace is a legitimate aim. As with all monitoring, it must be justified, transparent, and no wider than necessary, and it should not itself intrude on privacy more than the problem requires.

Can monitoring be used to detect criminal activity?

Yes, carefully and in cooperation with the authorities. Detecting crime is a recognised legitimate reason to monitor, and it is one of the few grounds that can justify covert monitoring. Even then, monitoring must be targeted and proportionate, and serious suspicions should be handled with the relevant authorities rather than through open-ended monitoring of staff.

Can monitoring track personal relationships between employees?

No. Monitoring workers' personal relationships is not a legitimate purpose and intrudes on private life. It is very difficult to justify under data protection and human rights law, and it can lead to complaints and claims. Monitoring should stay focused on work activity, security, and legitimate business needs, not on employees' private lives.

Monitoring across England, Scotland, Wales and Northern Ireland

Do the same monitoring rules apply across the UK?

Largely yes. Data protection law (the UK GDPR and the Data Protection Act 2018) and the Human Rights Act 1998 apply across England, Scotland, Wales and Northern Ireland, so the core monitoring rules are the same throughout the UK. Northern Ireland has some additional equality law considerations, so employers there should check whether any local requirements apply on top of the UK-wide framework. In every nation of the UK, the same tests apply: a lawful basis, transparency, and proportionality.

Where to get authoritative guidance

Where can employers get reliable guidance on monitoring?

Start with the regulator and official sources. The ICO publishes the main employer guidance on monitoring workers, GOV.UK sets out workers' rights in plain English, and Acas offers practical advice on workplace policies. Note that the ICO has said its monitoring guidance is under review following the Data (Use and Access) Act, so check for the latest version. Good practice is consistent across these sources: carry out an impact assessment, be clear about the purpose, set out policies staff understand, collect only what you need, keep it secure, and balance monitoring against workers' privacy. For additional support, you can consult WorkTime’s employee monitoring handbook, along with UK employee monitoring policy resources. These materials offer practical guidance on documenting monitoring practices, communicating them to employees, and developing internal policies. Any templates should be adapted to the organization’s monitoring activities and checked against current UK legal requirements.

The bottom line

Lawful employee monitoring in the UK is less about what technology can do and more about what an employer can justify. Transparency, proportionality, and a clear purpose are the standards that decide whether monitoring is compliant under the UK GDPR, the Data Protection Act 2018, and the Human Rights Act 1998. Get the lawful basis right, tell staff, complete a DPIA where the monitoring is high-risk, and keep records accurate and secure. At WorkTime, we build non-invasive employee monitoring software that helps organisations measure productivity, active time, and attendance without capturing screenshots, logging the content of keystrokes, or recording screens. Trusted by more than 9,500 organisations and offering over 80 productivity reports, it is designed to keep monitoring proportionate and transparent, which is exactly what UK law rewards. For a broader overview, see our guide to employee monitoring in the United Kingdom. If compliance is your priority, see how WorkTime supports non-invasive employee monitoring, GDPR-safe monitoring, and remote employee monitoring that respects employee privacy.

Disclaimer

The information in this article is for general understanding only and is not legal advice. For advice on your specific situation, consult a qualified legal professional.