WorkInsights Blog · Compliance and privacy
Is employee monitoring software legal? What to check before you roll it out
Employee monitoring software is legal in most jurisdictions when it runs on company-owned equipment for a genuine business purpose, but it is conditional rather than automatic. The recurring conditions are a lawful basis for the processing, clear advance notice to employees, collection proportionate to the stated purpose, access limited by role, and a defined retention period. This is a practical checklist, not legal advice.
Is employee monitoring legal?
In most jurisdictions, yes, with conditions. Employers are generally permitted to monitor company-owned equipment where there is a legitimate business purpose and employees have been told. The practical risk is rarely that monitoring is prohibited; it is that a specific implementation collects more than it can justify, was never properly disclosed, keeps data indefinitely, or is accessible to people with no business reason to see it.
What do most privacy regimes actually require?
A lawful basis for the processing, advance plain-language notice, necessity and proportionality against a stated purpose, data minimisation, role-based access with an audit trail, and a defined retention period. Under the GDPR, systematic monitoring of employees will often require a data protection impact assessment first, and several US states, including New York, Connecticut, and Delaware, require written notice of electronic monitoring. Enforcement is real: in December 2023 the French regulator CNIL fined Amazon France Logistique 32 million euros over an excessively intrusive monitoring system, including an indicator that tracked scanner inactivity so precisely that employees could be asked to justify every break.
Why does notice matter more than consent?
European data protection regulators have repeatedly warned that consent is rarely valid at work, because the imbalance of power between employer and employee makes it difficult to treat as freely given. Employers more commonly rely on legitimate interests or a legal obligation, which moves the burden onto demonstrating necessity, proportionality, and that a less intrusive option would not achieve the same purpose.
What changes with remote work and personal devices?
Home working blurs the boundary the justification rests on, so restricting collection to working hours removes most of the ambiguity. Personal devices raise the bar considerably, because a personal laptop mixes work and private activity and proportionality becomes hard to demonstrate. Screenshots and location are the two capabilities most likely to fail a proportionality test on personal hardware.
What does a defensible monitoring policy contain?
What is collected and explicitly what is not, the business purpose behind each category, who can access it by role, how long it is kept, how an employee can ask what is held about them, and which decisions the data will and will not inform. A useful test: would you be comfortable reading the policy aloud to the team it applies to?
Is it legal to monitor employees?
In most jurisdictions monitoring company-owned equipment for a legitimate business purpose is lawful, but it is conditional rather than automatic. The common conditions are a lawful basis for the processing, clear advance notice to employees, collection proportionate to the stated purpose, restricted access, and a defined retention period. Requirements differ by country and sometimes by state or province, so confirm your own position with qualified counsel.
Do employees have to consent to monitoring?
Notice matters more than consent in most employment settings. European data protection regulators have repeatedly warned that consent is rarely a valid basis at work because the power imbalance between employer and employee makes it hard to treat as freely given. Employers typically rely on legitimate interests or a legal obligation instead, which shifts the burden onto necessity, proportionality, and transparency.
Can you monitor an employee's personal device?
It is far harder to justify and in some places the employee can simply say no. Maine's 2026 employer surveillance law gives employees an express right to decline installation of monitoring software on their own personal device, and restricts audiovisual monitoring in an employee's home unless the role requires it. More generally, personal devices mix private and work activity, so proportionality and data minimisation are difficult to demonstrate. If people use their own equipment, the safer route is to narrow collection to work applications and working hours, or to issue company devices for the roles that genuinely require monitoring.
What should a monitoring policy contain?
At minimum: what is collected and what is not, the business purpose for each item, who can see it and in what role, how long it is kept, how employees can ask what is held about them, and what decisions the data will and will not be used for. Write it so you would be comfortable reading it aloud to the team it applies to.