GDPR and Employee Monitoring: What Employers Actually Have to Do

Employee monitoring is lawful in the EU, but it is regulated. Activity data — time logs, screenshots, application and website records, location — is personal data, which means an employer needs a lawful basis for collecting it, has to assess the impact before starting, and has to tell employees in writing what is collected and why.

The practical questions are narrower than the regulation: which basis applies to you, whether you need a formal assessment, what has to be in the notice, and which monitoring features create the most exposure. This guide covers those four.

Key takeaways

• Consent is the weakest basis in an employment relationship, because the power imbalance makes it hard to argue it was freely given.
• Legitimate interest is the usual basis, and it requires a documented balancing test — not just an assertion.
• Systematic monitoring of employees generally requires a Data Protection Impact Assessment before it starts.
• The notice to employees has to state what is collected, why, who sees it, and how long it is kept.
• Software does not make a monitoring programme compliant. Configuration and documentation do.

> This article is general information, not legal advice. Data protection requirements vary by member state, by sector and by the specifics of what you monitor, and enforcement practice changes. Have your monitoring policy reviewed by a qualified data protection officer or an employment lawyer in your jurisdiction before you deploy anything.

Which Lawful Basis Applies to Employee Monitoring?

Every act of monitoring needs a lawful basis for processing, and the regulation provides six. In practice, employers rely on legitimate interest, occasionally on legal obligation or contractual necessity. Consent is available in theory and problematic in practice, because an employee who depends on the employer for their income is rarely in a position to refuse freely.

The practical consequence: if your monitoring rests on consent, it probably rests on nothing. Rebuilding it on legitimate interest means writing down the purpose, the alternatives you considered, and why the less intrusive options were insufficient — before the agent is installed, not afterwards.

Do You Need a Data Protection Impact Assessment?

For systematic monitoring of employees, generally yes. An assessment documents what you are collecting, why it is necessary, what the risks to employees are, and what you are doing to reduce them. It is the document a supervisory authority will ask for first if a complaint arrives.

A usable assessment answers five things in writing:

1. What is collected, feature by feature — not “activity data” but the actual list.
2. Why each item is necessary for the stated purpose. Anything that fails this test gets switched off.
3. What the risk to the employee is, including the risk of capturing personal content incidentally.
4. What reduces that risk — blurring, working-hours-only collection, role-restricted access, retention limits.
5. Who decided, and when it gets reviewed.

The assessment is not a one-off. It gets revisited when you turn on a new feature, change retention, or extend monitoring to a new group of people.

Which Monitoring Features Create the Most Risk

Not all monitoring is equally intrusive, and the regulation treats it accordingly. The more a feature captures content rather than metadata, the harder it is to justify.

Two rules do most of the work. Collect metadata rather than content wherever the purpose allows it — knowing that someone spent three hours in a design tool answers most management questions without capturing what was on screen. And switch off anything you cannot explain the necessity of in one sentence. At the low-intrusion end, clock-in and clock-out tracking answers the hours question without capturing content at all.

What You Have to Tell Employees

The notice has to be given before monitoring starts, in writing, in language an employee can actually understand. A clause buried in a handbook technically exists, but it is the kind of thing that does not survive scrutiny when a complaint is filed.

• What is collected, itemised by feature rather than described in general terms.
• Why, tied to a specific purpose rather than to “productivity” as a category.
• On what basis, named explicitly — usually legitimate interest.
• Who can access it, by role.
• How long it is kept, as a number, and what happens at the end of that period.
• What rights the employee has, including access to their own data and objection.
• Who to contact with a question or an objection.

Employees also have the right to ask what has been collected about them and to receive it. That request has to be answerable — which in practice means knowing where the data lives and being able to export it for one person.

Before You Switch Anything On

A short sequence, in order. Doing it out of order is what creates problems later.

1. Name the specific problem you are solving. “Visibility” is not a purpose; “verifying billable hours on client projects” is.
2. Check whether less intrusive means would work. This step is the one that gets skipped and the one a regulator asks about.
3. Pick and document the lawful basis, with the balancing test if it is legitimate interest.
4. Complete the impact assessment before deployment, not after.
5. Configure to the minimum that meets the purpose. Every feature switched on by default should be reviewed against step 1.
6. Write and deliver the notice, and record that it was delivered.
7. Set retention and access, and apply them technically rather than by policy alone.
8. Review annually, and whenever a setting changes.

Maximize productivity of your business.
Start Your 10-Day Trial

Where Software Helps, and Where It Does Not

No monitoring tool can make a monitoring programme lawful. The employer chooses the purpose, the basis, the retention period and who has access — and those choices are what compliance is made of. What software can do is make the defensible configuration easy and the indefensible one obvious.

Features worth having for that reason: collection limited to working hours, per-person and per-project toggles so monitoring runs only where it is needed, blurring so screen content is not captured legibly, role-based access, a stated retention period, and employee access to their own records. Monitask provides these, and records no keystrokes. It does not, and cannot, complete your impact assessment or write your notice.

If you are weighing up screenshot capture specifically, the configuration decisions are covered in more detail in our guide to screenshot monitoring. And it is worth knowing that employees increasingly check for themselves — guidance on detecting monitoring software is widely available, which is another argument for the notice being accurate.

Key Takeaways

Monitoring is lawful in the EU and it is documented. Use legitimate interest rather than consent, write the balancing test down, complete the impact assessment before deployment, and give employees a notice that itemises what is collected and for how long. Then configure the tool to the minimum that serves the purpose — because the strongest compliance argument is always that you did not collect the thing in the first place.

Reliable employee tracking software. Clear visibility and insights into how employees work. Even remotely.
Try Monitask free for 10 days