Employee monitoring under the GDPR: what EU employers may do

The GDPR does not ban employee monitoring, and it has no article written only for it. Monitoring is processing of personal data, so the general rules apply: a legal basis, a clear purpose, no more data than needed, honest information to staff, and an impact assessment when the risk is high. On top of that, each EU country may add its own employment rules. This page sets out those rules and the practical lines that the EU data protection authorities drew in their opinion on data processing at work. For the UK version, see UK employee monitoring rules.

Is employee monitoring legal under the GDPR?

It can be, when it passes the tests below. Article 5 says personal data must be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, and be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed" (GDPR, Article 5(1)). Under Article 5(2) the employer must also be able to show that it complies. A tool that records everything just in case fails the necessity test from the start.

Legal basis: consent almost never works

Article 6(1) lists six legal bases. Consent is the one employers often reach for, and the weakest at work. Recital 43 says consent should not be a valid legal ground where there is a clear imbalance between the person and the organisation (GDPR, Recital 43). The Article 29 Working Party, the group of EU data protection authorities that came before today's European Data Protection Board, put it plainly in its Opinion 2/2017 on data processing at work: employees can almost never give, refuse or withdraw consent freely, because they depend on their employer (WP29 Opinion 2/2017 (WP249), section 6.2).

That leaves mainly legitimate interests (Article 6(1)(f)), a legal obligation (6(1)(c)) or, for some processing, the contract (6(1)(b)). The opinion says legitimate interests can sometimes be used, but only when the processing is strictly necessary for a legitimate purpose and passes proportionality and subsidiarity (could a less intrusive way do the job?). It recommends a proportionality test before any monitoring tool is switched on.

When monitoring rests on legitimate interests, staff have a right to object on grounds relating to their particular situation. The employer must then stop unless it shows compelling legitimate grounds that override the worker's interests (GDPR, Article 21(1)).

National employment rules: Article 88

Article 88 lets each Member State, by law or collective agreement, set more specific rules on employee data, and says those rules must include safeguards for dignity, legitimate interests and fundamental rights, "with particular regard to the transparency of processing" and "monitoring systems at the work place" (GDPR, Article 88). So the GDPR is the floor, and a German, French or Italian employer may face extra national rules, for example on works council involvement. In case C-34/21 (30 March 2023), about teachers streamed by videoconference without their consent, the Court of Justice ruled that a national rule which does not meet Article 88(2) is not a valid "more specific rule" and must be disregarded unless it is a legal basis that complies with Article 6(3) (CJEU, C-34/21). We cover that ruling in more depth in GDPR duties for employers using AI.

What the authorities called disproportionate

Opinion 2/2017 was written under the old Data Protection Directive, but it looks ahead to the GDPR and works through real tools. Its main lines:

• Keystroke, mouse and screen tracking at home: software that logs keystrokes and mouse movements, captures screens or switches on webcams on remote workers is described as disproportionate, and the employer is very unlikely to have a legitimate interest basis for, for example, recording keystrokes and mouse movements (section 5.4.1).
• Reading all web traffic: in its example of a device that decrypts and inspects encrypted traffic, monitoring every online activity of staff is a disproportionate response. The employer should try less invasive means first, avoid permanent logging, and leave out traffic such as private webmail, online banking and health sites (section 5.3).
• Blocking beats watching: if a website can be blocked, block it rather than monitor all communications. Prevention should carry much more weight than detection (sections 5.3 and 6.4).
• Video analytics: automated monitoring of facial expressions or of deviations from set movement patterns would be disproportionate and generally unlawful, and employers should refrain from facial recognition (section 5.6).
• Fitness wearables: health data from devices given to staff should be visible only to the employee, not the employer; explicit consent is highly unlikely to be valid here (section 5.4.4).
• Personal devices (BYOD): private parts of a device, such as a photo folder, should in principle not be accessed, and staff should be able to shield private communications from work monitoring (sections 5.4.2 and 6.1).
• Door and attendance logs: an access log for a server room can be justified, but using the exact entry and exit times for performance evaluation cannot (section 5.5).
• Company vehicles: the opinion repeats an earlier WP29 line that vehicle trackers are not staff trackers, and suggests not recording location outside working hours unless, for example, the vehicle leaves a wide predefined area (section 5.7).

Impact assessment before you switch it on

Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk, "in particular using new technologies". It must describe the processing and its purposes, assess necessity and proportionality, assess the risks to the people concerned and set out the safeguards (GDPR, Article 35(1) and (7)). National authorities publish lists of processing that always needs one (Article 35(4)), so check your own country's list. The WP29 opinion recommends a DPIA before introducing any monitoring technology, and specifically before mobile device management tools are deployed (sections 5.3 and 5.4.3).

Telling staff

Hidden monitoring is hard to square with Article 5's transparency principle and with the information duty in Article 13. The opinion asks for effective information on what is monitored, why, in what circumstances, and how staff can avoid their data being captured. Policies must be clear and easy to find, and it recommends involving a representative sample of employees in writing and reviewing them, and reviewing a monitoring policy at least once a year (sections 5.3 and 6.3).

Keep less, for less time

Minimise what is recorded and what is shown to managers, set a retention period, and delete data that is no longer needed (WP249, section 6.4; GDPR, Article 5(1)(c) and (e)). A location system can, for example, store positions without displaying them, and open them only when a vehicle is reported stolen.

What happens if an employer gets it wrong

Breaches of the basic principles (Articles 5, 6, 7 and 9), of data subject rights (Articles 12 to 22) and of national rules adopted under Chapter IX, which includes Article 88, sit in the higher fine band: up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher (GDPR, Article 83(5)). Workers can also complain to their national data protection authority.

A short checklist

• Write down the specific risk the monitoring is meant to address.
• Pick the least intrusive option: blocking, filtering or access control before recording.
• Choose a legal basis other than consent and run the balancing test.
• Do a DPIA and check national law and any works council or collective agreement rules.
• Tell staff in plain words, keep private spaces private, set a retention period.
• Review the setup at least once a year.

For AI tools that score or rank workers, see AI monitoring at work; for US state rules, see employee monitoring laws in the US; for algorithmic management on platforms, see the EU Platform Work Directive.

This page is general information based on the GDPR text, Article 29 Working Party Opinion 2/2017 and the Court of Justice ruling in C-34/21, as checked on 6 November 2026. National rules differ. It is not legal advice.