Employers can monitor workers for legitimate reasons, but workplace monitoring is not automatically justified because equipment or systems belong to the employer. Data-protection principles still require a lawful, fair, transparent and proportionate approach.
Use this guide to separate the facts, the legal route and the practical remedy. Workplace disputes often involve more than one right, so keep each strand distinct.
Key points
- Identify the exact decision, event or omission before choosing a legal label.
- Ask who made the decision and which employer policy, contract term or statutory rule is relied on.
- Preserve contemporaneous evidence and the employer’s reasons before memories and records change.
- Protect Acas and tribunal time limits even while an internal process is continuing.
Diagnosis
First: what exactly happened?
Work out which route fits the facts before deciding what to ask the employer to do. Similar workplace problems can use different legal tests.
| What happened? | What to check |
|---|---|
| You discovered monitoring you were not told about | Check transparency, purpose, lawful basis and whether covert monitoring was justified. |
| Productivity software is scoring or profiling you | Ask what data is used, how scores are generated and whether decisions are automated or materially influenced by monitoring. |
| CCTV, audio, location or device data is being used in discipline | Ask for the relevant data and challenge accuracy, context and proportionality. |
| Personal messages/accounts are involved | Separate employer-system monitoring from access to genuinely private devices or accounts. |
Who is responsible?
The employer is responsible for its own employment decisions and processes, even where HR, payroll, occupational health, an external investigator or software supplier is involved. Identify the actual decision-maker and the legal entity that employs you.
Managers and HR may administer a process, but outsourcing advice or relying on a policy does not transfer away the employer’s legal responsibility.
Transparency first
Workers should normally understand what monitoring occurs, why, how information is used, who receives it and how long it is kept. Covert monitoring needs much stronger justification.
Proportionality and alternatives
A legitimate aim does not make every method proportionate. Consider whether a less intrusive method could achieve the same purpose and whether monitoring extends beyond what is necessary.
Using monitoring in decisions
Monitoring data can be incomplete or misleading. A productivity score may not capture disability, training, system outages, authorised breaks or the quality of work. Challenge the inference as well as the raw data.
Access and correction
A SAR can obtain personal data generated by monitoring, subject to exemptions and third-party rights. Factual inaccuracies may engage rectification rights.
Monitoring is a data-protection issue as well as a workplace issue.
Employers can have legitimate reasons to monitor workers, but they still need a lawful, fair and transparent basis for processing personal information. The more intrusive the monitoring, the stronger the justification and safeguards generally need to be.
Ask what is being monitored and why.
Identify the system, data captured, purpose, retention period, access controls and whether the monitoring is continuous, targeted or triggered. Different considerations can apply to CCTV, email, internet use, location tracking, productivity tools and biometric systems.
Monitoring data can fall within a SAR.
The ICO confirms that personal information collected through worker monitoring must be made available in response to a SAR unless an exemption applies. Large monitoring datasets and third-party information can make retrieval and disclosure more complex, but that does not remove the right.
Keep employment and data routes distinct.
An argument that monitoring was unfair under employment law is not identical to an argument that personal data was processed unlawfully. The employer, Acas/tribunal and ICO can therefore have different roles in the same factual situation.
Use employment and data-protection routes together where appropriate.
A monitoring dispute may create both an employment issue, for example disciplinary reliance on surveillance, and a data-protection issue. A subject access request can help obtain personal data, but it is not a general disclosure request for every internal document. A grievance can challenge fairness or policy compliance while a data-protection complaint challenges the processing itself.
Evidence.
Preserve the monitoring notice/policy version in force, screenshots of the tool, disciplinary material relying on it, your requests for explanation, and any privacy/DPIA information disclosed by the employer.
Transparency should normally come before monitoring.
Workers should generally be told about monitoring in a clear privacy notice or policy explaining purposes, categories of data, lawful basis, recipients, retention and rights. If monitoring materially changes, an old generic IT policy may not adequately explain the new processing.
The ICO’s current employment-monitoring guidance is under review following the Data (Use and Access) Act. That makes it particularly important to check the live ICO guidance rather than relying on an old copied checklist.
Necessity and proportionality should be tested against the stated purpose.
Ask what problem the monitoring is intended to solve, what data is collected, who can access it, how long it is retained and whether a less intrusive method could achieve the same purpose. Intrusive or high-risk monitoring may require a data protection impact assessment. Covert monitoring is particularly difficult to justify and should not be treated as a routine management tool.
| Monitoring claim | Useful question |
|---|---|
| “It is for security.” | What specific security risk, what data is necessary and how is unrelated personal data minimised? |
| “The software is standard.” | What settings are enabled, what profiling occurs and who reviews the output? |
| “Staff were told in the handbook.” | Was the notice sufficiently clear about the actual monitoring now carried out? |
| “The system flagged poor performance.” | Was a significant decision made solely by automated means and what human review occurred? |
An employer’s ability to monitor is not unlimited by ownership of the equipment.
Monitoring workers can involve email, internet use, location, CCTV, audio, keystrokes, productivity tools, vehicle telematics or biometric systems. The fact that the employer owns the laptop, phone or premises does not remove UK GDPR and Data Protection Act obligations. The employer still needs a lawful, fair and transparent processing basis and must comply with data-protection principles.
What can you realistically ask for?
Choose a remedy that matches the problem. Internal processes can often correct a decision or record; statutory compensation and tribunal remedies depend on the legal claim.
- Greater transparency or changed monitoring practice
- Access to personal data
- Correction/restriction where appropriate
- Internal challenge to decisions based on flawed monitoring
- ICO complaint where data-protection concerns remain
Evidence worth keeping
Preserve the original record where possible. A short, dated evidence set is usually more useful than an unstructured dump of documents.
Common employer responses - and what they do not necessarily prove
| Employer says | ConsumerWise view |
|---|---|
| “It is our equipment, so we can monitor anything.” | Ownership does not disapply data-protection duties. |
| “You consented in the handbook.” | Employment consent is not always the appropriate lawful basis, and a broad handbook clause does not answer fairness/proportionality. |
| “The software score is objective.” | Automated or metric-based outputs can still be inaccurate, context-free or discriminatory. |
| “Covert monitoring is always allowed if misconduct is suspected.” | Covert monitoring is exceptional and requires strong justification and tight limits. |
What to say next
Keep the next response short and issue-led. State the decision you challenge, the evidence or rule you rely on, the specific answer you still need and the remedy you want. If the employer relies on a policy or business reason, ask it to identify the relevant provision and explain how it applies to your facts.
Important overlaps and exceptions
- Monitoring can overlap with disciplinary, discrimination and performance-management disputes.
- Biometric or special-category data can require additional safeguards.
- Automated decision-making rules may apply where decisions are made solely by automated means with significant effects.
What to do
A practical next-step plan
- Write down the event or decision, the date, who made it and the practical impact.
- Identify the legal or contractual right that may apply instead of relying only on the word “unfair”.
- Collect the smallest evidence set that proves the key facts and the employer’s stated reason.
- Use the relevant internal request, grievance, appeal or complaint route and ask for a specific remedy.
- Check Acas and tribunal limitation separately. Do not let a slow internal process cause an external deadline to expire.
Escalation and time limits
Internal procedures can be important, but they do not normally stop an employment tribunal time limit. As at 11 September 2026, most claims whose limitation period starts before 1 October 2026 still use the existing three-month-minus-one-day framework. For most relevant time limits starting on or after 1 October 2026, the period increases to six months minus one day.
Acas early conciliation can affect calculation of the deadline if Acas is notified in time. Some claims use different limits, and interim relief in qualifying dismissal cases can require action within only 7 days. Always check the specific claim rather than applying a general period mechanically.
Official sources
Check the current source material.
- ICO: Data protection and monitoring workers ↗
- ICO: Employment information ↗
- ICO: Subject access requests ↗
- ICO: Monitoring workers ↗
ConsumerWise provides general information rather than individual legal advice. Check current rules, dates and eligibility against the official source before acting.