Monitoring workers in the UK: the legal rules

Monitoring at work now goes well beyond CCTV and email filters. Employers use software that logs keystrokes and active time, scores productivity, analyses calls or flags unusual behaviour, often with AI doing the scoring. The UK has no single statute on workplace monitoring. Instead, the rules come from the UK GDPR and, for communications, the Investigatory Powers Act 2016 and its 2018 regulations for businesses. This page sets out what those texts say, taken from legislation.gov.uk, for employers and workers. For decisions made by software about workers, see automated decisions about workers under UK data law.

The short answer: monitoring that collects personal data must be lawful, fair, transparent and limited to what is necessary for a stated purpose. AI tools that systematically evaluate staff will often need a data protection impact assessment first. Workers can object to monitoring based on legitimate interests. Intercepting communications on a work system is lawful for business purposes only if the employer has made all reasonable efforts to tell users it may happen.

The principles: UK GDPR Article 5

Personal data must be processed lawfully, fairly and in a transparent manner; collected for specified, explicit and legitimate purposes and not used in a way incompatible with them; adequate, relevant and limited to what is necessary; and accurate (UK GDPR Article 5). Applied to monitoring, that means deciding in advance what the monitoring is for, collecting only what that purpose needs, telling workers, and not quietly reusing data gathered for security to score performance. Accuracy matters for AI: an activity score built on mouse movement is not an accurate measure of work that happens away from the keyboard.

Every processing operation also needs a legal basis under Article 6. Employers usually rely on legitimate interests or the employment contract rather than consent (UK GDPR Article 6).

Impact assessment before you switch it on: Article 35

Where processing, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms, the controller must carry out a data protection impact assessment before the processing. One is required in particular for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based, and for large scale processing of special category data such as biometrics used for identification or health data (UK GDPR Article 35). AI productivity scoring, emotion or voice analysis, and biometric clocking systems are the tools most likely to meet this test.

The right to object: Article 21

Where monitoring is based on legitimate interests, including the new recognised legitimate interests basis, a worker has the right to object on grounds relating to their particular situation. The employer must then stop unless it demonstrates compelling legitimate grounds that override the worker's interests, rights and freedoms, or needs the data for legal claims (UK GDPR Article 21).

Calls, email and messages: the 2018 interception regulations

Intercepting communications in transmission on a work telecoms system is lawful for an employer, as system controller, only in defined cases. These include establishing facts, checking compliance with regulatory practices, checking the standards people achieve or ought to achieve in their duties, preventing or detecting crime, investigating unauthorised use of the system, and keeping the system working (Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, regulation 3). In every case the interception must be solely for monitoring or recording communications relevant to the business, and the employer must have made all reasonable efforts to inform every person who may use the system that communications may be intercepted (regulation 4).

Working from home

None of these rules is limited to the employer's premises. Monitoring software on a laptop at home still processes personal data, and is more likely to capture family members, private messages or the inside of a home. That bears directly on whether the monitoring is necessary, limited to what is needed and fair. Webcam capture and screenshots taken at random are hard to justify on those tests without a specific reason.

Who enforces it

The UK regulator for data protection is now the Information Commission. The office of Information Commissioner was abolished and its functions transferred to the Commission on 30 September 2026 (S.I. 2026/1015). Complaints and guidance on employment monitoring come from the Commission.

Practical steps

• Employers: write down the purpose of each monitoring tool, the legal basis and why less intrusive options will not do. Run an impact assessment before AI scoring or biometrics go live, tell staff clearly what is collected and how it is used, and keep a person accountable for any decision based on the data.
• Workers: ask for the monitoring policy and the privacy notice, ask what the tool records and who sees it, and use the right of access to see what is held on you, see how to request the data AI systems hold on you. If monitoring relies on legitimate interests, you can object.

For the wider picture, see AI monitoring at work; for health and safety duties when monitoring data drives targets, see algorithmic management and health and safety; for the health and safety rule that checking software must not be used without users' knowledge, see display screen work; for the US, see employee monitoring laws in the US. This page is general information, not legal advice.