Can my employer monitor me at work?

If a camera, tracker or screen-monitoring tool is watching you at work, you have a right to know what is collected and why. After your shift, save the policy or message, note what you saw and when, and ask in writing for the purpose, records and retention period. If monitoring has led to discipline or dismissal, get advice now: the claim clock may already be running.

Is workplace monitoring legal?

There is no single “employee privacy act”. The main rules are the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Article 8 of the European Convention on Human Rights protects private life and correspondence. It binds public authorities directly and also informs how courts apply the law to private employers. Employment contracts carry a separate duty of mutual trust and confidence.

Data protection rights belong to anyone whose personal information is processed, including employees, agency and casual workers, and self-employed contractors. An employer cannot evade them by calling you a contractor. An ordinary unfair-dismissal claim is different. That employment right belongs to employees and depends on qualifying service.

Privacy does not disappear on a work account. In Bărbulescu v Romania (2017), the European Court of Human Rights found a privacy violation after an employer read work messages without adequate notice of the nature and extent of monitoring. In López Ribalda v Spain (2019), covert cameras focused on supermarket tills after suspected theft were held proportionate. Neither case gives every employer a blanket licence to read messages or hide cameras; context and safeguards decide the result.

What must an employer justify?

Almost every monitoring tool processes personal information: CCTV, email logs, GPS, clock-in records, call recordings. The employer must identify a lawful basis before it starts, collect only what is necessary, keep the data secure, set a retention period and explain the monitoring to workers. A software supplier does not take those duties off the employer’s hands.

There are seven Article 6 lawful bases. A legal obligation can justify monitoring drivers’ hours; legitimate interests may justify proportionate security checks, subject to a purpose, necessity and balancing test. Since February 2026 there is also a narrower recognised legitimate interest basis for specified aims such as preventing or investigating crime. It is not a free pass for ordinary productivity surveillance.

Signing a monitoring policy does not usually amount to valid consent. Workers rarely have a free choice. Nor does putting a clause in an employment contract make surveillance contractually necessary. In February 2024 the ICO ordered Serco Leisure and associated trusts to stop using facial and fingerprint scans to clock staff in at 38 sites. They had not shown why cards or fobs would not do, and staff had no clear alternative.

Monitoring likely to reveal health information, trade union membership or biometric data used to identify someone needs an additional Article 9 condition. Criminal-offence data has separate protections. Some conditions also require a Data Protection Act Schedule 1 condition and an appropriate policy document. A trawl through everyone’s email may capture union or occupational-health correspondence even if that was not the plan.

There are additional rules for intercepting calls or emails in transmission. The 2000 lawful-business-practice regulations and 2018 interception-by-businesses regulations permit specified business purposes subject to conditions, including reasonable efforts to inform users. They do not replace data protection requirements. Simply reading an already stored message is not necessarily interception in transmission, though privacy law still applies.

Five questions to ask about any monitoring

Ask what the employer wants to achieve. “Investigating shortages at a specific till” says more than “improving productivity”.

Would a less intrusive method do the job? Check log-on times rather than use a home webcam.

Ask for the lawful basis. If monitoring is likely to capture sensitive or criminal-offence information, what extra condition applies?

Check whether the employer has assessed the risk. A data protection impact assessment (DPIA) is required before monitoring likely to present a high risk, including keystroke logging, biometric identification and email-content monitoring. Where high risk cannot be reduced, the employer must consult the ICO before starting.

Have workers been told? They need clear information about what is collected, why, who sees it and how long it is kept, unless an exceptional covert investigation is justified.

What the rules mean method by method

The ICO sets out guidance for each monitoring method. The table below summarises its expectations.

Can my employer monitor me secretly?

Only exceptionally. The ICO says an employer may justify covert monitoring to prevent or detect suspected crime or comparable gross misconduct, where warning people would undermine the investigation. A DPIA is required. Senior managers should authorise a targeted, short investigation. The employer should stop when it ends and discard irrelevant material. Secret monitoring of everyone “just in case” does not meet that test.

If you discover hidden monitoring, write down where the device was, what it could capture, the dates and what the employer had previously told staff. Do not assume discovery alone starts the clock for an employment claim. The deadline depends on the claim and the act complained of.

What about monitoring at home?

Privacy expectations are higher at home. A camera might catch children or a partner; a screenshot might show personal messages. For start-time checks, the ICO says system log-ons and an opportunity to explain discrepancies may achieve the aim without webcam images. Keystroke logging and intrusive device monitoring call for a DPIA. Home working alone does not automatically make every monitoring activity high risk.

Read the policy against your remote-work agreement. Ask whether monitoring switches off outside working hours and on personal devices. Moving from office CCTV to screen capture at home needs its own justification and new privacy information, not a stretched interpretation of an old CCTV notice.

Can I see what data my employer holds on me?

Yes. A subject access request (SAR) can cover your personal information in CCTV footage, call recordings, work emails, GPS records and productivity scores, subject to exemptions and the rights of other people in the material. You do not need a special form or wording. An email asking for your personal information is enough.

1. Make the request. Ask HR or the privacy contact for the records you want and give useful dates and locations. You may ask for all your personal information, but a focused request can help them find it.
2. Mark the deadline. The usual limit is one calendar month from receipt, or from necessary identity checks. Complex or multiple requests can take two further months if the employer explains the extension within the first month.
3. Challenge an unjustified pause. The clock stops only while the employer awaits clarification reasonably needed to identify the information requested. Since February 2026 its searches need to be reasonable and proportionate, not exhaustive.
4. Read the response. Third-party details may be redacted and an exemption may apply, but an employer cannot reject a request just because the results would embarrass it. The request is normally free; a fee or refusal for a manifestly unfounded or excessive request requires justification.

What can I do if monitoring feels intrusive?

Ask what the employer records, why, for how long, under which lawful basis and whether there is a DPIA. Explain the effect on you. If a screenshot tool records private messages during your lunch break, say so. Where the employer relies on legitimate interests, recognised legitimate interests or public task, you can object on grounds relating to your particular situation. It must consider your objection, although overriding grounds or a legal claim may allow processing to continue. The right to object is not a general veto.

If the response is unsatisfactory, raise a grievance and use the employer’s data protection complaints route. Since 19 June 2026 organisations must provide one, acknowledge complaints within 30 days, investigate and give an outcome without undue delay. You can then complain to the ICO. It can order unlawful processing to stop and impose fines. The highest UK GDPR tier is £17.5 million or 4% of worldwide annual turnover, whichever is higher; another tier is £8.7 million or 2%. You may also seek compensation in court for proven loss or distress caused by a data protection breach.

If monitoring ends in discrimination, detriment or dismissal, get advice on the specific claim promptly. In Great Britain most employment tribunal claims now have a six-month limit, in force from 1 October 2026; Northern Ireland generally remains at three months. The clock usually runs from the act or end of employment, not the day you discover monitoring. Early conciliation can affect the deadline; Scotland’s six-month rule for breach-of-contract tribunal claims starts on 9 November 2026. Our tribunal procedure guide covers bringing a claim. A data protection complaint or SAR does not itself stop a tribunal deadline.

You do not have to challenge this alone. If you are in retail, hospitality, transport or a warehouse, contact your union, such as Unite or GMB; care and health workers can contact UNISON. Ask a workplace representative to help request the policy or raise a grievance. Acas can explain early conciliation, but do not wait for a reply if a tribunal deadline is ticking. Citizens Advice and a local law centre can help you understand your options. For discriminatory monitoring or a discriminatory outcome, contact the Equality and Human Rights Commission as well as getting advice. If the issue is unlawful data use, complain to the ICO.

Can monitoring be used to discipline or dismiss me?

It can. But a lawful monitoring policy is not a substitute for a fair investigation. If a manager mistakes an idle-screen alert for proof of absence, ask for the underlying records and explain the discrepancy. A tribunal may consider how evidence was obtained, whether the allegation was put to you and whether the employer followed the Acas disciplinary code. Unlawfully obtained evidence is not automatically excluded or an automatic win on unfair dismissal.

Seriously intrusive surveillance may damage mutual trust and confidence. We recommend taking advice before you resign and claim constructive dismissal. In Great Britain an ordinary unfair-dismissal claim currently needs two years’ service. The planned reduction to six months applies to dismissals from 1 January 2027, subject to the remaining legislative process; Northern Ireland’s ordinary qualifying period is one year. Discrimination claims and some automatically unfair dismissal claims do not need the ordinary qualifying period.

What is in force, and what comes next?

The Employment Rights Act 2025 has not rewritten the rules on workplace surveillance. The Data (Use and Access) Act 2025 changed some data protection procedures. Employment reform changes claim deadlines and, if it comes into force as planned, unfair-dismissal eligibility.

1. 5 Feb 2026Data reforms in force

   Seven lawful bases, reasonable and proportionate SAR searches and a pause for necessary clarification; higher PECR fine limits.

2. 19 Jun 2026Complaints duty in force

   Organisations must provide a route for data protection complaints and acknowledge them within 30 days.

3. 1 Oct 2026Most GB tribunal claim limits increased

   Generally six months instead of three. Scottish breach-of-contract tribunal claims change on 9 November 2026; Northern Ireland is unaffected.

4. 1 Jan 2027 (scheduled)Unfair dismissal qualifying period

   Planned reduction from two years to six months for dismissals from this date, with the compensatory award cap removed. Future dates remain subject to parliamentary processes.