Monitoring at work: your rights

Last checked: 23 Oct 2026

UK data protection law lets employers monitor workers, but only in ways that are necessary, fair and open. This page sets out what the data protection regulator's guidance says employers must and should do, and what you can do if you're monitored.

The regulator became the Information Commission on 30 September 2026; it was previously the Information Commissioner's Office (ICO), and its guidance is still at ico.org.uk. Its monitoring workers guidance is written for employers and says: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."

The guidance uses "must" for what the law requires and "should" for what the regulator expects employers to do to comply. This page keeps that difference. It covers anyone who does work for an organisation, whatever their contract, including people working from home.

What your employer must tell you

The regulator says: "Apart from in very exceptional circumstances where covert monitoring is justified, you must inform workers about any monitoring." In particular, employers:

must make sure you know how monitoring works and what information it collects about you
must be clear about why they're monitoring and write it down; they "should not monitor workers 'just in case'"
must choose the least intrusive way to achieve their aim
must keep their privacy information up to date and tell you when they change their monitoring
should ask for workers' or their representatives' views (for example a trade union) before starting, unless there's a good reason not to, and record why if they don't
should let you see, explain or challenge the results of monitoring, for example in a performance review or disciplinary process

A policy alone isn't enough: "Excessive monitoring set out in a policy does not make it lawful, just because it is documented." Monitoring data must not be kept longer than needed, and only people who need to see it should have access.

Acas, the workplace advice service, gives the same message in its guidance for employers on home working: employers "must tell employees about any monitoring arrangement and the reason for it, except in extremely limited circumstances – for example, if you suspect criminal activity." It says employers should consult employees and any representatives before introducing monitoring, and that employees "are entitled to some privacy at work, including when they are working from home." (We didn't check whether Acas's guidance applies in Northern Ireland.)

When secret monitoring can be allowed

The regulator calls this "covert monitoring". It says employers are unlikely to be able to justify it "in most usual circumstances", but it may be justified in exceptional cases, such as to prevent or detect suspected crime or gross misconduct. If an employer does it:

senior management should authorise it
the employer must do a written risk assessment first (see below)
there should be grounds for suspicion, and telling workers would have to undermine the investigation
it should be targeted, kept as short as possible and stopped when the investigation ends
it should not use hidden cameras or audio in places where people expect privacy, "such as toilets or changing rooms"
in most circumstances it should not capture private communications, "such as personal emails"

The regulator says employers should set out in their policies the circumstances in which covert monitoring might take place.

The risk assessment (DPIA)

A data protection impact assessment (DPIA) is a written check an employer does before it starts monitoring. It sets out why the monitoring is needed, the risks to workers and others, and how to reduce them. The regulator says an employer must do one before monitoring that's likely to be high risk, and gives these examples:

using workers' fingerprints, face scans or other biometric data
logging keystrokes
monitoring that could lead to someone losing money, such as performance management

The regulator also says a DPIA is required for monitoring emails and messages, video or audio recording, facial recognition, driver-behaviour monitoring and covert monitoring. It says employers should do one even when it isn't required. The DPIA process is also where employers can discuss plans with workers. If the risk can't be reduced, the employer must consult the regulator before going ahead.

Emails, messages and calls

The regulator's guidance covers work email accounts and "the chat functions in collaboration tools". It says:

employers must tell you the purpose of any monitoring of emails and messages
it would be hard to justify reading the content of messages if checking the traffic (who sent what, when) would be enough
employers must tell you in advance, for example in a policy, if they may look at content in exceptional circumstances, and must not look at content without a clear policy explaining when
even if personal use of work systems is banned, that "would not entirely justify accessing the content of personal messages"
for calls, it's "not usually proportionate" to record the content of every call, employers must tell you about call monitoring, and they "should not routinely monitor personal calls"

The guidance suggests employers consider whether some messages won't be monitored at all, such as emails to trade union representatives, and whether workers can mark emails as personal or private.

Keystrokes, screenshots and webcams

Software that records what you do on a computer can capture web browsing, emails and messages, documents, apps used, screenshots, webcam images and keystrokes. The regulator says this kind of monitoring "is likely to capture excessive amounts" of personal information, and:

"You are particularly unlikely to be able to justify capturing webcam shots or footage."
Keystroke logging counts as biometric data when it can identify you by the way you type.
If the employer can achieve its aim in a less intrusive way, it must do so.
Employers must tell workers about this monitoring, including how they use it to make decisions about them.

The regulator gives an example: an employer that switches on automatic webcam pictures because a few home workers started late is "likely to infringe data protection law", because it could check log-on times instead. On a work PC, see also Windows Recall, a Windows feature that saves snapshots of your screen.

Your own phone or laptop

The regulator says monitoring can be "particularly intrusive" when workers use their own devices, and: "You should ensure that when workers are using their own personal devices for work, you are not capturing their private use of their device." It also says privacy expectations "are likely to be higher at home than in the workplace".

For work vehicles that you're allowed to use privately, the regulator says employers "will rarely be able to justify monitoring during private use", and gives the example of a tracker the driver can switch off outside work.

Fingerprint and face scans

Using fingerprints, face scans or other body measurements to clock in or open doors is biometric data. The regulator says:

the employer must do a DPIA first
it should offer another way in, such as a swipe card or PIN, and not disadvantage people who use it; it's "likely to be very hard to justify" biometrics without one
it must tell you how the system works, what it collects and how it's used
if the system wrongly locks you out, a person must be able to review it
if you agreed to biometrics, you can withdraw that agreement and should be given an alternative without being disadvantaged

Work accounts for AI chat tools

The regulator's guidance doesn't mention AI chat tools by name. The makers' own help pages say what an organisation can see in a work account. For your personal AI accounts, see AI chatbots.

ChatGPT (work accounts managed by an organisation): OpenAI says the administrator "may be able to access, export, audit, retain, delete" data in the account, which may include your prompts, uploaded files, outputs and conversation history. It says personal and work accounts stay separate, and to use a personal account for activity you want kept outside the organisation's control.
Microsoft Copilot (work accounts): Microsoft's documentation for IT administrators says Microsoft 365 can keep "Audit records for Copilot prompts, responses, and referenced content", and that Copilot data "can be discovered, audited, and retained" with the organisation's compliance tools.

The regulator's guidance doesn't say how its monitoring rules apply to AI chat records. Its rules on emails and messages cover "the chat functions in collaboration tools".

Your rights

See what's been recorded. The regulator says employers "must make the personal information you collect through monitoring available to workers if they make a subject access request (SAR), unless an exemption applies". See how to make a subject access request.
Object. You can object to monitoring when your employer relies on its "legitimate interests" (a business reason it has weighed against your interests) or a public task, giving reasons based on your own situation. Since the Data (Use and Access) Act this also covers "recognised legitimate interests", such as preventing crime. It isn't an absolute right: the employer can carry on if it shows compelling reasons that outweigh yours, or needs the data for a legal claim. If it refuses, it must tell you that you can complain to the regulator. See how the right to object works.
Challenge the results. The regulator says employers should let you see and, if necessary, explain or challenge the results of monitoring.

The regulator's guidance for employers on subject access requests adds that:

you can ask verbally or in writing, and don't need to use any special words: "Please send me my HR file" counts
the employer usually has one month to reply, which can be extended by up to two months if the request is complex
a settlement or non-disclosure agreement can't take the right away
an employer can't refuse just because you're in a grievance or employment tribunal process
CCTV footage of you is covered even if other people are in it; the employer may blur or remove them
work chats on tools such as Teams or WhatsApp that the employer uses for business are covered
some things can be held back, such as other people's information, confidential references, legal advice and records of ongoing negotiations with you

How to complain

Complain to your employer first, saying it's a data protection complaint. Organisations must have a data protection complaints process, and must acknowledge your complaint within 30 days. The regulator has a template letter. A data protection complaint is separate from a workplace grievance, and the regulator says a grievance should be handled separately from a request for your data.
Keep a record of what you sent and when.
If you're not satisfied, complain to the regulator (helpline 0303 123 1113). It can't award compensation; see complaining about how your data is handled for timings and other routes.

Acas's guidance on workplace investigations says employers should make clear whether CCTV, vehicle trackers, computer records, phone calls and email records may be used in investigations, and that investigators must follow data protection law and respect the worker's right to privacy.

Sources

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing, or report a correction.