Employee monitoring in the UK: what the law allows

Monitoring at work is lawful in the UK, but only when it is done for a clear purpose, in a way workers know about, and no more intrusively than necessary. AI has changed the picture: tools now score productivity, flag "risky" behaviour and summarise calls at a scale that older keystroke-logging rules never anticipated.

This guide sets out how UK law applies and what a defensible monitoring programme looks like.

The legal framework

Four sources matter:

• UK GDPR and the Data Protection Act 2018 — monitoring processes personal data, so it needs a lawful basis, transparency, and proportionality.
• The Human Rights Act 1998, Article 8 — the right to respect for private life applies at work; the European Court of Human Rights has repeatedly held that employees retain a reasonable expectation of privacy in the workplace.
• The Investigatory Powers (Interception by Businesses etc.) Regulations 2018 — govern interception of communications on your own systems.
• The implied term of trust and confidence — disproportionate surveillance can amount to a repudiatory breach, opening the door to constructive-dismissal claims.

Choosing a lawful basis

Consent is almost never the right basis in an employment relationship, because it cannot be freely given where there is a power imbalance. In practice employers rely on:

• Legitimate interests for most business monitoring, supported by a documented legitimate interests assessment weighing the purpose against the intrusion.
• Legal obligation where a regulator requires it — recorded lines in financial services being the standard example.

Monitoring that captures health information, trade-union activity or other special-category data needs an Article 9 condition too. Emotion or wellbeing analytics fall here quickly.

When a DPIA is mandatory

The ICO treats systematic monitoring of employees as high risk. A data protection impact assessment is required before you start where you are monitoring at scale, monitoring publicly accessible areas systematically, or using innovative technology — which includes most AI-driven monitoring. The DPIA should record the purpose, the necessity and proportionality analysis, the risks to workers and the measures that reduce them. Produce it before deployment; a retrospective DPIA is evidence of the wrong process.

Transparency is the usual failure point

Workers must know what is monitored, why, how long the data is kept, who sees it, and how decisions are made from it. That means:

• a monitoring policy in plain English, not a clause buried in a handbook
• specifics: which tools, which data, which locations, which hours
• an explanation of any automated scoring, and how to challenge it
• consultation with recognised unions or employee representatives where they exist

Covert monitoring is lawful only in exceptional circumstances — typically where there are grounds to suspect criminal activity or serious malpractice and telling people would prejudice the investigation. It should be authorised by senior management, tightly scoped, time-limited, and documented at the time.

Proportionality in practice

The test is not "can we?" but "is this the least intrusive way to achieve a specific purpose?" Some rules of thumb the ICO's guidance supports:

• Monitor the business need, not the person. Aggregate or anonymised data is preferable where it achieves the aim.
• Continuous always-on capture (screenshots, webcam, keystrokes) is rarely proportionate for ordinary office work.
• Private areas — bathrooms, changing rooms, rest areas — are effectively off limits.
• Home and hybrid working expands the intrusion: a tool that captures a home workspace is not equivalent to one in an office.
• Personal use of work devices needs a stated position; if you permit it, you cannot pretend the data is purely business data.

Where AI raises the stakes

Three features of AI monitoring cause most of the legal risk:

1. Inference. Productivity or sentiment scores infer things about a person that they never disclosed, which can amount to special-category or simply inaccurate data. Article 5 accuracy duties apply to inferences.
2. Automated decisions. If a score triggers a performance process, capability procedure or dismissal without meaningful human involvement, Article 22 UK GDPR restrictions apply — see our guide on automated decisions about staff.
3. Discrimination. Monitoring output that disadvantages disabled workers, carers or part-time workers can be indirect discrimination. Time-on-keyboard metrics are a recurring example, and a reasonable-adjustments duty applies.

A defensible monitoring programme

• Written purpose for each monitoring tool, tied to a specific business risk
• Legitimate interests assessment and DPIA completed before rollout
• Published monitoring policy, plus notice at the point of monitoring
• Consultation with representatives recorded
• Data minimisation: shortest useful retention, restricted access, audit log of who looked
• No decisions made on scores alone; human review with authority to disregard
• Route for workers to see their data, question it and request adjustments
• Annual review, and a fresh assessment whenever the tool changes

The bottom line

Employers get into trouble for surveillance that is broad, silent and automated. Narrow, disclosed and human-reviewed monitoring is usually defensible. If you cannot explain in one sentence why a specific data point is collected, stop collecting it.