ICO updates guidance on monitoring workers

The Information Commissioner’s Office updated its employment-focused guidance on monitoring workers to spell out how the UK GDPR and Data Protection Act 2018 apply to automated monitoring, profiling and algorithmic management.

Published on the ICO website this week, the refreshed guidance sets out where standard data-protection rules intersect with newer digital practices such as continuous surveillance, people analytics and recruitment algorithms. The regulator makes clear that employers must consider legal bases for processing, the heightened risks of profiling and the limits of consent where there is a power imbalance between employer and worker.

The guidance flags that consent is unlikely to be a valid legal basis for workplace monitoring in many employment relationships because of the inherent imbalance of power. Instead, employers should rely on other lawful bases and carry out data-protection impact assessments where monitoring is systematic or likely to result in high risk. It also emphasises transparency, data minimisation and purpose limitation when designing systems that collect employee data.

A substantial portion of the update addresses automated decision-making. The ICO outlines expectations for ‘‘human oversight’’ where decisions materially affect workers — including recruitment, shift allocation, performance management or disciplinary action. Employers are told to ensure decision-making processes allow for human intervention, meaningful explanations and routes for challenge, and to document how oversight is implemented in practice.

The guidance explicitly links monitoring and profiling concerns to the regulator’s broader artificial intelligence and biometrics strategy, signalling a consistent regulatory approach across the ICO’s work on algorithmic systems. That strategy, refreshed earlier this year, frames biometric and AI tools as high-priority areas for scrutiny and enforcement, increasing compliance expectations for organisations that deploy people-analytics platforms or automated hiring tools.

For HR and talent-technology teams, the immediate takeaway is heightened compliance risk for any use of automated profiling or algorithmic management. The ICO’s position on consent and its emphasis on oversight mean employers using off-the-shelf recruitment algorithms or bespoke performance-monitoring systems may need to revisit legal bases, update privacy notices, and run fresh impact assessments. Those using third-party vendors should also seek contractual assurances and evidence of vendor-side auditing and governance.

The guidance is pragmatic in places, but it stops short of granular prescriptions. It does not provide a checklist for what counts as ‘‘meaningful’’ human oversight, nor does it set out bright-line thresholds for when a processing activity is ‘‘high risk’’ beyond the established data-protection impact-assessment criteria. Employers will therefore have to interpret the principles in light of their own systems and risks, or seek legal advice if they want firm operational steps.

The ICO also does not publish model audit templates, benchmark bias-mitigation tests or a timetable for enforcement priorities within this update, leaving uncertainty for organisations seeking concrete compliance playbooks. That absence enhances the role of HR, legal and procurement teams to press vendors for evidence of technical validation, explainability, and regular bias testing.

The update arrives as public-sector and private employers alike embrace AI-driven tools to automate administrative tasks and decision points in workforce management. For HR leaders, the ICO’s guidance tightens the regulatory frame: it is no longer enough to adopt algorithmic tools for efficiency without documenting oversight, reassessing lawful bases, and strengthening transparency. Expect employers to face increasing pressure to demonstrate how they balance automation with human judgement and employee safeguards as algorithmic management moves from experiment to commonplace practice.