ICO updates guidance on monitoring workers and AI

The Information Commissioner’s Office updated its guidance for employers on data protection and monitoring of workers, adding sharper UK GDPR reminders and flagging extra safeguards where monitoring involves automated decision‑making or AI.

On 20 July 2026 the ICO refreshed two pages in its employment/monitoring hub, emphasising that organisations must meet UK GDPR requirements, complete Data Protection Impact Assessments when monitoring risks are high, and apply heightened controls where decisions are made solely by automated processes. The regulator also warns that it will publish final, more detailed guidance on monitoring and AI in summer 2026.

The guidance reiterates familiar legal anchors: employers must establish a lawful basis for processing, document the purposes of monitoring, ensure processing is necessary and proportionate, and maintain transparency with staff. It places particular weight on DPIAs as a practical tool to identify and mitigate risks from surveillance and people‑analytics tools, and says DPIAs should be updated as systems change or new uses emerge.

Where monitoring tools include automated decision‑making or purely automated processes, the ICO sets out additional considerations employers must address. Those include ensuring appropriate human oversight, assessing the potential for unfair or discriminatory outcomes, and making sure workers can obtain meaningful information about the logic and consequences of automated processing. The regulator also points employers to a separate page explaining specific steps expected when using solely automated processes.

For HR and people‑analytics teams the message is procedural as much as technical. The ICO says employers should review contracts and data‑sharing arrangements with third‑party vendors, be explicit about retention periods and access controls, and consider targeted consultation with worker representatives when introducing intrusive monitoring. The guidance stresses that measures focused on productivity or conduct still require lawful, proportionate handling of workers’ personal data.

The update comes as UK regulators and courts increasingly scrutinise workplace surveillance and algorithmic decision‑making. Employers are investing in people analytics and automated screening tools even as governments in the UK and abroad tighten standards for transparency, fairness and accountability. The ICO’s move places the regulator alongside other data‑protection authorities that have signalled extra scrutiny of AI‑driven HR systems.

What the pages do not do is fill in every operational detail. The ICO has not set out a prescribed testing regime for bias, specific audit standards for algorithms, or a one‑size‑fits‑all timetable for completing DPIAs. It also does not publish model DPIA templates tailored to specific people‑analytics vendors, nor does it offer checklists that would absolve employers from case‑by‑case assessment. While the regulator promises fuller guidance on monitoring and AI in summer 2026, the update leaves some practical compliance questions — such as acceptable accuracy thresholds or independent certification routes for HR algorithms — open.

For HR leaders the updated guidance tightens the compliance perimeter: monitoring projects now require clearer documentation, more robust impact assessments and careful design of automated decision processes to preserve human oversight. With the ICO signalling a forthcoming, final set of guidelines this summer, employers should treat the refresh as a prompt to audit current monitoring programmes, tighten vendor contracts and engage legal and data‑protection colleagues ahead of the regulator’s fuller guidance.