The Legal Framework: Four Layers of Protection
Workplace surveillance in the UK is not governed by a single law. It sits at the intersection of four overlapping legal frameworks — and employers who ignore any one of them are creating significant legal exposure.
Monitoring software captures data about you — your keystrokes, your screen activity, your location, your working patterns. That data is personal data, and its collection and processing is regulated by the UK General Data Protection Regulation and the Data Protection Act 2018.
Under these laws, your employer must have a lawful basis for processing your data. The most commonly cited basis in employment is legitimate interests — but legitimate interests must be balanced against your rights. The proportionality test is central: monitoring must be no more intrusive than is necessary to achieve the employer's stated purpose.
Crucially, the Information Commissioner's Office (ICO) guidance on employee monitoring is clear: employers must tell workers what monitoring is taking place, why it is taking place, and what data is being collected. Covert monitoring — conducted without the employee's knowledge — is only lawful in very limited circumstances, typically where there is a specific, documented suspicion of serious wrongdoing and where informing the employee would undermine the investigation.
Routine covert surveillance of remote workers is not a lawful basis. It fails the proportionality test and breaches the transparency requirements of UK GDPR.
Article 8 of the Human Rights Act 1998 protects your right to respect for private and family life. This right does not disappear when you work from home. In fact, the home environment adds a layer of protection that does not apply in a traditional office — your home is your private space, and surveillance conducted there engages Article 8 considerations that an employer cannot simply override.
The European Court of Human Rights established in Bărbulescu v Romania [2017] that even in a workplace context, monitoring communications without prior notice can violate the right to privacy. UK courts and tribunals apply equivalent reasoning.
Every employment contract in the UK contains an implied term of mutual trust and confidence. Excessive or covert surveillance — particularly where it extends to monitoring personal communications, tracking movements within the home, or activating webcams without consent — can constitute a fundamental breach of that implied term.
Where surveillance is so intrusive that it makes continued employment intolerable, an employee who resigns as a result may have grounds for constructive dismissal — and if the surveillance was connected to a protected characteristic such as disability, pregnancy, or whistleblowing, the claim becomes significantly stronger.
ACAS guidance states that employers should have a clear monitoring policy, explain to workers what is being monitored and why, and ensure that monitoring is used only for the purposes stated. Workers should be consulted before monitoring systems are introduced. An employer who introduces monitoring software without informing staff and without a written policy is not following best practice — and in many circumstances is breaching the law.
What Employers Are and Are Not Permitted to Do
Employers are permitted to monitor work activity proportionately and transparently. This can include:
Monitoring emails sent from work accounts for security purposes, where employees have been informed Logging activity on company systems to protect against data breaches Using productivity software where employees are told what is tracked and why Location tracking of company vehicles or devices where employees are notified in advance Employers are not permitted to:
Conduct covert monitoring of personal communications without a lawful basis and documented justification Activate webcams or microphones without the employee's knowledge Monitor home environments through surveillance tools not clearly disclosed to the employee Use monitoring data for purposes beyond those stated to the employee — for example, using productivity data covertly gathered as the basis for a disciplinary process Real Consequences
"I found software on my work laptop that had been capturing my screen every three minutes," said Daniel, 41, a project manager working remotely. "I was never told it was there. When I raised it formally, HR couldn't produce a monitoring policy or any notification that this had been disclosed. My solicitor advised me I had a strong data protection claim and a potential constructive dismissal case."
According to the ICO, organisations that fail to comply with UK GDPR in the context of employee monitoring face fines of up to £17.5 million or 4% of global annual turnover — whichever is higher. Individual employees also have the right to make a Subject Access Request to find out exactly what data their employer holds about them.
What to Do If You Discover You Are Being Watched
Make a Subject Access Request immediately — write to your employer or HR requesting all personal data they hold about you, including any monitoring data. They have one month to respond Check for a monitoring policy — request a copy of your employer's data protection and monitoring policy. If one does not exist, that is a significant compliance failure Document everything — record how you discovered the monitoring, what software is involved, and what data appears to have been captured Raise a formal grievance — if monitoring was covert, undisclosed, or disproportionate, raise it in writing immediately Report to the ICO — if your employer fails to respond adequately, you can report the breach directly to the Information Commissioner's Office at ico.org.uk Your Action Plan
Make a Subject Access Request to find out what data your employer holds about you — today Request a copy of your employer's monitoring and data protection policy in writing If no policy exists or monitoring was undisclosed, raise a formal grievance immediately Download free template letters and tools at 👉 https://myredundancyrights.co.uk/action-plan If the grievance is ignored, report the breach to the ICO If the surveillance has made your working environment intolerable, take independent legal advice before resigning Resource on your rights at 👉 https://myredundancyrights.co.uk/my-rights. 👉 https://myredundancyrights.co.uk/legality-checker Being watched at work is not automatically illegal. Being watched without your knowledge, without justification, and without a lawful basis — is.