1 in 3 UK organisations now actively monitor their employees' digital activity. Up from 1 in 5 in 2023.
Bossware, productivity tracking, location data, email monitoring, AI-powered performance tools. It is becoming standard practice. And the law around it is about to change.
In July 2026 the government launched a formal consultation on workplace monitoring technologies. The consultation closed on 30 September and the government is now reviewing responses ahead of new regulation.
What the law says right now
Workplace monitoring is already governed by UK GDPR. Employees are data subjects. Their personal data collected through monitoring tools must be:
- Processed with a lawful basis.
- Collected only for a specified, explicit and legitimate purpose.
- Proportionate. Just because a tool is available does not mean using it is justified.
- Transparent. Employees must be told they are being monitored and why.
Just because a tool is available does not mean using it is justified.
What most organisations get wrong
Monitoring tools introduced without a DPIA. Systematic monitoring of staff is likely to be high risk, so a data protection impact assessment should come before the tool goes live, not after.
No staff communication explaining what is monitored and why.
Assuming the same rules apply at home as in the office. They do not. Employees have a higher expectation of privacy when working from home.
Using monitoring data to make automated decisions about performance without the proper safeguards.
What is coming
The consultation proposed eight principles for responsible use, closely mapped to UK GDPR. New legislation or statutory guidance is now expected. The ICO is also updating its own workplace monitoring guidance following the Data (Use and Access) Act.
Organisations that get ahead of this now will not need to scramble when the new rules land.
Does your organisation use any form of employee monitoring, and do staff know what is collected and why? If you are not sure, our DPIA support and data protection training can help, or you can start with a free data protection review.
