What UK employers are allowed to monitor at work under data protection law: emails, internet use, CCTV, keystrokes, location and home workers, what they must tell you, and your rights if monitoring goes too far.
Employers can monitor workers, but only within limits set mainly by UK data protection law (UK GDPR and the Data Protection Act 2018), the Human Rights Act for public bodies, and employment law. The Information Commissioner's Office (ICO) has published detailed guidance for employers on monitoring workers. This guide explains the key points for employees.
The basic principle
Monitoring must be lawful, fair, transparent, and necessary and proportionate for a legitimate purpose. An employer must be able to justify why it monitors, and choose the least intrusive way to achieve its aim.
What employers commonly monitor?
- Emails and internet use on work systems, for security or to enforce policies.
- CCTV in workplaces, for security and safety.
- Phone calls, for example in call centres for training or quality.
- Vehicle tracking on company vehicles.
- Productivity and activity tools, including some that track keystrokes, screenshots or application use.
- Access and attendance systems, including, sometimes, biometrics such as fingerprints.
What employers must tell you?
Workers should normally be told:
- that monitoring is taking place;
- what is monitored, how and why;
- how the information will be used and how long it's kept;
- who can see it.
This is usually in a monitoring policy or privacy notice. Covert monitoring is only justified in exceptional circumstances, such as suspected criminal activity, and must be limited and time-bound.
Impact assessments
The ICO expects employers to carry out a data protection impact assessment (DPIA) before introducing monitoring likely to be high risk, such as keystroke logging, webcam monitoring or biometric systems. Employers should consider less intrusive alternatives and consult workers where appropriate.
Areas needing particular care
- Private spaces: monitoring in toilets or changing rooms is very unlikely to be justified.
- Home workers: monitoring at home risks capturing family life. Webcam monitoring in particular is highly intrusive.
- Personal devices and accounts: employers have much less justification for monitoring personal social media or devices.
- Biometric data: special category data requiring extra conditions; there should usually be an alternative for those who don't want to use it.
- Automated decisions: decisions with significant effects, such as dismissal, shouldn't be based solely on automated monitoring without meaningful human involvement.
How long data can be kept?
Monitoring data should be kept only as long as needed for its purpose. CCTV footage, for example, is often overwritten after a set number of days unless needed for an investigation. The employer's retention policy should say.
Monitoring and trust
The ICO notes that excessive monitoring can damage trust and wellbeing. Employers are encouraged to be open, involve staff and unions, and review monitoring regularly to check it's still needed.
Your rights
- Right of access: make a subject access request to see monitoring data about you. The employer usually has one month to respond.
- Right to object in some circumstances, if monitoring relies on legitimate interests.
- Right to complain to the employer and then the ICO.
What to do if you're concerned?
- Read the monitoring policy and privacy notice.
- Ask HR or the data protection officer to explain what's monitored and why.
- Raise concerns through a union rep or a formal grievance.
- Make a subject access request if you want to see the data.
- Complain to the ICO if your concerns aren't resolved.
Acas offers free advice on workplace issues, including grievances.
Frequently asked questions
Can my employer read my work emails?
Usually yes, for legitimate reasons and if you've been told. Avoid using work email for private matters.
Can I be disciplined using monitoring evidence?
Possibly, if the monitoring was lawful and proportionate and the process is fair.
Sources and further reading
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.