Your employer may use software to record activity on work systems, but monitoring personal data must comply with UK GDPR and the Data Protection Act 2018. The key questions are what is collected, why, how intrusive it is, who can see it and how long it is kept. Monitoring on a company laptop is not automatically lawful, and the fact that you work at home does not give an automatic veto.
ICO guidance says employers should usually tell workers about monitoring, including its purpose and how personal data is used. They need an appropriate lawful basis; legitimate interests is one possible basis, not a blanket permission. Employers should consider necessity, proportionality, less intrusive alternatives, relevant privacy information and, for higher-risk processing, a data protection impact assessment. Information about private communications, health or other sensitive data may require additional safeguards. Consent is often inappropriate in employment because of the power imbalance.
Covert monitoring may be justified only in exceptional circumstances, for example a targeted investigation of suspected serious wrongdoing when notice would prejudice it. The ICO expects strict limits on scope, duration and access. It is misleading to say any hidden webcam, microphone, screen capture or use of monitoring data is always unlawful, or that every undocumented policy automatically proves a legal violation: the facts and legal basis matter. Equally, undisclosed routine observation is a serious concern worth investigating. Privacy and employment-contract issues may also arise; constructive dismissal is fact-specific and should not be assumed.
Ask HR for the monitoring or privacy notice: what is tracked, why, the lawful basis, retention period and who receives the data. Keep a factual record of what you discovered; avoid disabling security tools or copying other people's confidential data. A subject access request can obtain your personal data, including monitoring data where held, but exemptions and the rights of others can limit disclosure. The usual response time is one month, with a permitted extension for complex or numerous requests. Ask for clarification, consider a grievance and complain to the ICO if appropriate; the ICO does not automatically secure individual compensation. Seek independent advice before resigning or making a tribunal claim.
Explore: https://myredundancyrights.co.uk/action-plan · https://myredundancyrights.co.uk/my-rights · https://myredundancyrights.co.uk/legality-checker
Official sources: ICO data protection and monitoring workers; ICO subject access rights. UK data protection applies across the UK; employment remedies differ between Great Britain and Northern Ireland. General information only.