As remote and hybrid work continues to reshape the modern workplace, more UK employers are turning to employee monitoring software to maintain visibility, protect business data, and manage productivity. But with that shift comes an important question: is employee monitoring actually legal in the UK — and if so, where does the law draw the line?
The short answer is yes — employee monitoring is legal in the UK. However, it comes with clear legal obligations that every employer must understand and follow. Getting it wrong can lead to enforcement action, financial penalties, and serious damage to employee trust.
This guide breaks down the legal framework, what employers can and cannot do, and the practical steps needed to stay compliant in 2026.
The Legal Framework Governing Employee Monitoring in the UK
Employee monitoring does not exist in a legal vacuum. Several pieces of legislation apply simultaneously, and employers must ensure their practices are consistent with all of them.
UK GDPR and the Data Protection Act 2018 The primary legislation governing employee monitoring is the UK General Data Protection Regulation (UK GDPR), alongside the Data Protection Act 2018 (DPA 2018). Because employee monitoring almost always involves collecting personal data — whether that is login times, email usage, screenshots, or keystroke activity — it falls squarely under these regulations.
It is important to note that while the UK left the EU, it retained a version of GDPR that mirrors the original framework closely. EU GDPR no longer applies in the UK directly, but UK GDPR carries the same core principles and protections.
The Human Rights Act 1998 Article 8 of the Human Rights Act gives individuals the right to respect for their private and family life. This right does not disappear at the workplace door — and the ICO specifically notes that employees working from home have a higher expectation of privacy than those in a traditional office. Employers must take this into account, especially when deploying remote monitoring tools.
The Investigatory Powers Act 2016 This legislation governs the interception of electronic communications, including emails, instant messages, and phone calls. Monitoring of communications — even on company devices — must comply with this Act in addition to UK GDPR.
The Employment Rights Act 1996 Overly invasive or covert monitoring can give employees grounds for constructive dismissal claims under this Act, particularly if monitoring creates an environment of excessive control or erodes trust to the point where continuing employment becomes untenable.
What the ICO Says: Key Guidance for Employers
The Information Commissioner’s Office (ICO) — the UK’s data protection regulator — published updated guidance on monitoring workers in October 2023. This guidance remains the definitive reference for UK employers in 2026. The ICO’s position is clear: data protection law does not prevent employers from monitoring workers, but it must be done in a way that is compliant, proportionate, and transparent.
In 2026, UK regulators are placing increasing focus on transparency failures, excessive data collection, and undocumented monitoring decisions. Employers who cannot demonstrate a clear lawful basis and documented decision-making process face growing regulatory and reputational risk.
The Six Lawful Bases for Monitoring Under UK GDPR
For any monitoring to be legal, it must rest on one of six lawful bases under UK GDPR:
Consent: The employee has given clear, freely given consent. Note: In employment relationships, consent is rarely considered truly free because of the power imbalance between employer and employee. The ICO advises against relying on consent for routine monitoring.
Contract: The monitoring is necessary to fulfil the employer’s obligations under the employment contract.
Legal obligation: The monitoring is required to comply with a statutory or common law obligation.
Vital interests: The monitoring is necessary to protect someone’s life (rarely applicable to standard workplace monitoring).
Public task: Relevant only to public authorities performing official functions.
Legitimate interests: The employer has a genuine business reason for monitoring that is not overridden by the employee’s rights and freedoms. This is the most commonly used basis in practice, but it requires the employer to document a Legitimate Interests Assessment (LIA) showing the monitoring is necessary and proportionate.
What Employers Can Legally Monitor
When conducted transparently and proportionately, the following types of monitoring are generally lawful in the UK:
Email and internet activity: Monitoring use of company systems to prevent misuse, protect confidential data, or detect security threats
Time and attendance tracking: Recording login/logout times, hours worked, and breaks
Productivity and application usage: Tracking which apps or tools employees use during working hours
CCTV in the workplace: Permitted where clearly signposted and limited to security purposes, not used in private areas such as bathrooms or changing rooms
GPS tracking of company vehicles: Lawful when employees are informed in advance
Call recording: Permitted in regulated industries for compliance purposes, provided employees and callers are informed
What Employers Cannot Legally Do
Some forms of monitoring cross the legal line and expose employers to serious risk:
Covert monitoring without exceptional justification: The ICO states that covert monitoring (where employees are unaware it is happening) is unlikely to be justifiable in normal circumstances. It may only be used in exceptional cases, such as investigating suspected criminal activity or gross misconduct, and must be authorised by senior management, time-limited, and targeted.
Always-on webcam requirements: Requiring remote employees to keep their cameras running throughout the day is considered highly intrusive and disproportionate.
Keylogging and full screen recording: Capturing every keystroke or recording screens continuously can very rarely be justified under a proportionality test.
Accessing personal communications: Reading personal emails or private messages on personal devices is considered disproportionate without exceptional legal grounds.
Monitoring outside working hours: Tracking employees’ activity, location, or communications during personal time is generally unlawful.
Monitoring personal relationships: Employers cannot monitor employees’ personal relationships, as this directly violates their right to privacy.
The Employer’s Compliance Checklist
To use employee monitoring software lawfully in the UK, employers should follow these steps:
Establish a clear lawful basis Before deploying any monitoring tool, identify and document the specific lawful basis under UK GDPR. For most employers, this will be legitimate interest. Document a Legitimate Interests Assessment to show the monitoring is necessary and proportionate.
Conduct a Data Protection Impact Assessment (DPIA) The ICO recommends — and in many cases requires — a DPIA before implementing employee monitoring software, particularly for high-risk or large-scale monitoring. The DPIA must assess the nature and purpose of the monitoring, the risks to employees’ rights, and the measures taken to mitigate those risks. For remote workers, a DPIA is especially important given their higher privacy expectations at home.
Be fully transparent with employees Employees must be clearly informed — before monitoring begins — about what is being monitored, why it is being monitored, how the data will be used, who has access, and how long it will be retained. This information should be included in employment contracts, staff handbooks, IT use policies, and a formal privacy notice. Vague or buried disclosures are unlikely to satisfy the ICO’s transparency requirements.
Consult with employees ACAS recommends that employers consult with staff or their representatives before introducing new monitoring systems. This not only satisfies legal best practice but helps build the trust that makes monitoring more effective.
Apply data minimisation Only collect the data you actually need. The ICO warns specifically against “function creep” — the practice of collecting monitoring data for one stated purpose and then using it for another. Monitoring records should not be kept longer than necessary, and access should be restricted to authorised personnel only.
Handle Subject Access Requests (DSARs) Under Article 15 of the UK GDPR, employees have the right to request access to any personal data held about them — including monitoring records, activity logs, and screenshots. Employers must respond within one month. Failure to do so can trigger ICO investigations and court orders. Having a clear DSAR response process in place before deploying monitoring tools is essential.
Use appropriate employee monitoring software Choose software that supports compliance by design. Look for tools that offer transparent tracking (visible to employees), role-based access controls, data encryption, configurable data retention policies, and built-in support for GDPR, UK GDPR, and where relevant, HIPAA compliance.
Consequences of Non-Compliance
Employers who fail to follow these legal requirements face a range of serious consequences:
ICO investigations and fines: The ICO can impose significant financial penalties for data protection breaches, including those arising from unlawful employee monitoring
Employment tribunal claims: Employees can bring claims for constructive unfair dismissal if covert or excessive monitoring creates an intolerable working environment
Reputational damage: News of invasive workplace surveillance can seriously harm an employer’s ability to attract and retain talent
Civil litigation: Employees have the right to sue employers for breaches of privacy law
Monitoring Remote Workers: Extra Considerations
The rise of home working has created additional legal complexity. The ICO’s guidance is explicit: workers at home have a greater expectation of privacy than those in a physical workplace. The risks of capturing family members, personal conversations, or home environments during remote monitoring are real, and employers must account for them.
For remote teams, this means: - Avoiding always-on webcams or audio monitoring - Ensuring activity tracking does not capture personal device usage or off-hours activity - Conducting a DPIA specifically for remote monitoring activities - Being especially clear in privacy notices about what is and is not monitored when employees work from home
Final Thoughts
Employee monitoring software is a legitimate and valuable tool for UK businesses — but only when implemented within the legal boundaries set by UK GDPR, the Data Protection Act 2018, and the ICO’s guidance. The law is not designed to prevent monitoring; it is designed to ensure that monitoring is fair, transparent, and proportionate.
For employers, the message in 2026 is clear: document your decisions, inform your employees, and choose monitoring software that supports compliance rather than undermines it. Done correctly, workplace monitoring can improve productivity, strengthen data security, and build a culture of accountability — without compromising the trust that good employment relationships depend on.
Want to understand the ethical foundations behind these legal requirements? Read our full guide: Employee Monitoring Software — Ethical Guide 2026.