Last updated: August 11, 2026. Employee monitoring is legal in many countries, but rarely without limits. Employers generally need a legitimate and clearly stated purpose, must tell workers what is being monitored, collect no more data than necessary, protect the information, and respect local consultation or consent rules.
This 2026 guide compares employee monitoring laws across major jurisdictions and translates them into practical steps for HR, legal, security, and operations teams. It covers computer activity, time tracking, email and communications, screenshots, video, location, and remote-work monitoring.
Are employers allowed to monitor employees?
Usually, yes—but not secretly, indiscriminately, or without a business reason. The safest model is transparent and proportionate monitoring of work activity on company-managed systems. The highest-risk practices are continuous screenshots, webcam or audio capture, keystroke content, private-message inspection, precise location tracking outside working hours, and monitoring on personal devices.
In most jurisdictions, a policy or consent form alone does not make excessive monitoring lawful. Employers must still show necessity, proportionality, data minimization, security, limited retention, and respect for employee rights.
Employee monitoring laws by country: 2026 comparison
| Country or region | Is monitoring generally permitted? | Notice or consent | Key additional requirement |
|---|---|---|---|
| European Union | Yes, when lawful, necessary, and proportionate | Clear prior notice; employee consent is often an unsuitable basis | Lawful basis, data minimization, and often a DPIA |
| United Kingdom | Yes | Clear notice in most cases | Document lawful basis and conduct a DPIA for high-risk monitoring |
| United States | Often, especially on employer systems | Federal and state rules differ; several states require written notice | Check state wiretap, off-duty, biometric, and labor laws |
| Canada | Yes, if reasonable and appropriate | Transparency is expected; consent requirements depend on jurisdiction | Show the purpose cannot reasonably be achieved less intrusively |
| Germany | Yes, under strict proportionality rules | Transparent notice; consent is scrutinized | Works council co-determination may be mandatory |
| France | Yes | Employees must be informed in advance | Consult the CSE where required; hidden monitoring is exceptional |
| Spain | Yes | Prior, express, clear information | Respect digital-disconnection and workplace privacy rights |
| Italy | Yes, but remote-control tools are tightly regulated | Prior information is required | Union agreement or labor-authority approval may be necessary |
| Netherlands | Yes, when necessary and proportionate | Prior notice | Works council consent may be required |
| Poland | Yes for defined statutory purposes | Purpose, scope, and method must be disclosed | Special rules apply to video and email monitoring |
| Ukraine | Generally possible with a lawful purpose and transparency | Workers should be informed before monitoring begins | Respect constitutional privacy, labor, and personal-data rules |
| Australia | Yes, but state and territory rules differ | Prior written notice is required in some jurisdictions | Check the worker’s location and applicable surveillance statute |
| New Zealand | Yes, if fair, necessary, and transparent | Tell employees what is collected and why | Apply Privacy Act information privacy principles |
| Brazil | Yes | Transparent privacy information | Use an LGPD legal basis and respect necessity and purpose limitation |
| Mexico | Yes | Privacy notice generally required | Comply with proportionality, purpose, and data-subject rights |
| South Africa | Yes, subject to POPIA and interception rules | Notification and a lawful basis are normally required | Communications interception needs particular care |
| Singapore | Yes for reasonable employment-management purposes | Employees must be notified of purposes | Collection and use must be reasonable and appropriately secured |
| Japan | Yes | Specify and communicate the purpose of use | Follow APPI obligations and workplace-specific guidance |
| Switzerland | Yes, but behavior-surveillance systems are restricted | Transparent notice | Systems must not be used primarily to monitor behavior |
Seven rules that apply in most countries
- Define a legitimate purpose. Examples include recording work time, protecting systems, allocating project costs, meeting a legal obligation, or investigating a specific incident.
- Choose the least intrusive method. If aggregate time data answers the question, continuous screenshots or webcam images are difficult to justify.
- Tell employees before monitoring begins. Explain the data collected, purpose, legal basis, recipients, retention period, employee rights, and whether the tool operates outside working hours.
- Keep personal and work activity separate. Allow pausing outside work, avoid personal devices where possible, and provide a private-use procedure.
- Limit access and retention. Managers should see only what they need. Set automatic deletion periods rather than retaining detailed activity indefinitely.
- Assess high-risk features separately. Screenshots, webcam, audio, precise location, biometrics, message content, and automated scoring need stronger justification and controls.
- Do not let software make employment decisions by itself. Human review, context, and a way to challenge inaccurate data are essential.
European Union
The General Data Protection Regulation (GDPR) applies whenever monitoring involves identifiable workers. An employer needs a lawful basis under Article 6, must comply with purpose limitation and data minimization, provide Articles 13–14 information, secure the data, and respect access, objection, and other rights.
Consent is often a poor legal basis in employment because the power imbalance can prevent it from being freely given. Depending on the purpose, employers more commonly assess legitimate interests, contractual necessity, or a legal obligation. A legitimate-interest assessment does not automatically justify monitoring: the employer must document necessity and balance its interests against worker rights.
A data protection impact assessment is normally appropriate where monitoring is systematic, extensive, covert, uses new technology, combines datasets, or could significantly affect workers. The European data-protection authorities’ guidance on data processing at work stresses proportionality, transparency, and the difficulty of relying on employee consent.
Germany
Employee data processing is governed by the GDPR and Section 26 of the Federal Data Protection Act (BDSG). Monitoring must be necessary for the employment relationship or supported by another valid legal basis. Continuous performance or behavior surveillance is especially difficult to justify.
If a works council exists, Section 87(1)(6) of the Works Constitution Act can require co-determination when introducing technical systems capable of monitoring behavior or performance. Address that process before procurement or activation—not after data collection starts.
France
Under Article L1222-4 of the French Labour Code, information concerning an employee may not be collected by a device that has not previously been brought to the employee’s attention. Employers should also document GDPR compliance and consult the Social and Economic Committee (CSE) where applicable. The CNIL’s workplace guidance treats constant surveillance as disproportionate in ordinary circumstances.
Spain
Spain’s Organic Law 3/2018 recognizes employee rights concerning digital devices, video surveillance, geolocation, and digital disconnection. Employers may monitor compliance with work obligations, but must establish usage criteria, inform workers clearly, and preserve dignity and privacy. Recording areas intended for rest or private use is particularly problematic.
Italy
Article 4 of Italy’s Workers’ Statute restricts equipment that can remotely monitor employees. Tools required to perform work or record attendance may receive different treatment, but other monitoring systems can require a collective agreement or authorization from the labor inspectorate. Employees must also receive adequate information about how devices and controls are used before collected data can be relied upon.
Netherlands
Dutch employers must satisfy the GDPR and demonstrate that monitoring is necessary and proportionate. If a works council exists, its consent may be required under Article 27 of the Works Councils Act for employee-monitoring or personal-data systems. A clear protocol, DPIA, limited pilot, and periodic review are prudent controls.
Poland
Articles 22² and 22³ of the Polish Labour Code regulate video and other forms of employee monitoring. Monitoring must serve defined purposes, and the employer must specify its objectives, scope, and method in workplace rules, a collective agreement, or an announcement. Employees must receive advance information, and video surveillance is prohibited in certain private areas except under narrow safeguards.
United Kingdom
The UK GDPR and Data Protection Act 2018 apply to workplace monitoring. The Information Commissioner’s Office monitoring guidance recommends defining the purpose, selecting the least intrusive means, telling workers, conducting a DPIA for high-risk monitoring, and keeping the arrangement under review.
Covert monitoring should be exceptional, targeted, time-limited, and connected to a reasonable suspicion of criminal activity or similarly serious misconduct. It should not be used in areas where workers reasonably expect privacy.
United States
The United States has no single comprehensive federal employee-monitoring law. The Electronic Communications Privacy Act regulates interception and access to electronic communications, but contains exceptions that may apply to providers, ordinary-course business activity, or consent. Those exceptions are fact-specific, and state laws can be more protective.
Employers must check where each employee works. For example, Connecticut, Delaware, and New York have electronic-monitoring notice requirements. California privacy rules, Illinois biometric law, state wiretap laws, lawful off-duty conduct protections, and federal labor-law rights may also affect a program.
A defensible US policy uses a signed notice, clearly identifies monitored systems, avoids recording personal accounts, limits after-hours collection, and obtains specialist advice before capturing audio, biometrics, or message content.
Canada
Canada evaluates monitoring through reasonableness, necessity, proportionality, and transparency. PIPEDA directly covers employee information in federally regulated organizations; Alberta, British Columbia, and Quebec have private-sector privacy laws that may apply more broadly. Other employers may also be governed by employment, collective-agreement, surveillance, or tort rules.
The Office of the Privacy Commissioner of Canada recommends that employers establish a specific need, consider less intrusive alternatives, assess privacy impact, limit collection, and be open with employees. Its privacy guidance for employee monitoring is a useful starting point.
Ukraine
Ukraine does not have a single statute devoted exclusively to employee monitoring. Employers must consider the constitutional rights to private life and communications, the Labour Code, and the Law of Ukraine “On Personal Data Protection”.
Before introducing monitoring, the employer should document a legitimate and specific purpose, inform workers about the tool and workplace rules, minimize the collected data, establish access and retention limits, and avoid observing private communications or life outside working time. Consent should not be used as a blanket cure for disproportionate monitoring. For practical rollout steps, see our employee time monitoring implementation guide.
Australia and New Zealand
Australia
Australian requirements vary by state and territory. The New South Wales Workplace Surveillance Act 2005, for example, regulates camera, computer, and tracking surveillance and generally requires prior written notice. The Australian Capital Territory has its own workplace privacy legislation, while other jurisdictions rely on different surveillance-device, privacy, and employment rules.
The federal Privacy Act’s employee-records exemption is limited and should not be assumed to cover every stage, contractor, applicant, outsourced provider, or unrelated use. Determine where the employee physically works before applying a policy.
New Zealand
The Privacy Act 2020 information privacy principles require a lawful purpose connected with the organization’s functions, necessary collection, fair collection, notice, security, access and correction, retention limits, and controlled disclosure. The New Zealand Privacy Commissioner’s explanation of the privacy principles provides the official framework employers should apply.
Other important jurisdictions
Brazil
Brazil’s General Data Protection Law (LGPD) applies to identifiable employee data. Employers need a legal basis, a defined purpose, necessity, transparency, security, retention controls, and a process for data-subject rights. Legitimate interests require a documented balancing analysis; sensitive or biometric data has narrower legal bases.
Mexico
Mexico’s private-sector personal-data law requires employers to provide a privacy notice describing the identity of the controller, data collected, purposes, transfers, and mechanisms for exercising rights. Monitoring must remain relevant, necessary, and proportionate. Sensitive and biometric information requires heightened care.
South Africa
The Protection of Personal Information Act (POPIA) requires lawful, reasonable, minimal, purpose-specific, transparent, secure processing. Monitoring communications can also trigger the Regulation of Interception of Communications and Provision of Communication-related Information Act. A general monitoring policy may not be enough to authorize interception in every circumstance.
Singapore
Singapore’s Personal Data Protection Act allows certain processing without consent where it is reasonable for managing or terminating an employment relationship, but employees must be notified of the purposes and organizations remain responsible for reasonableness, protection, retention, and transfer controls. The exception should not be treated as permission for unrelated or excessive surveillance.
Japan
Japan’s Act on the Protection of Personal Information requires an employer to specify the purpose of use, avoid unnecessary use beyond that purpose, secure personal data, supervise processors, and handle requests appropriately. Workplace monitoring should be covered by internal rules and communicated in advance, with access limited to responsible personnel.
Switzerland
Swiss data-protection and employment rules require transparency and proportionality. Article 26 of Ordinance 3 to the Labour Act prohibits surveillance and control systems intended primarily to monitor employee behavior. A system needed for safety, performance measurement, or another legitimate operational purpose must be designed and arranged to protect worker health and freedom of movement.
Which law applies to a remote or international team?
Do not assume the employer’s headquarters law is the only one that matters. Privacy and employment obligations frequently follow the worker’s location, the establishment processing the data, or the people targeted by the monitoring.
For an international rollout:
- map every country, state, and province where workers are located;
- identify employee, contractor, agency-worker, and applicant populations;
- create a global minimum standard based on the most protective common requirements;
- add local schedules for notice periods, works councils, unions, regulator filings, and prohibited features;
- review cross-border transfer mechanisms and vendor locations;
- disable high-risk features by default unless locally approved.
Employee monitoring policy checklist
A useful policy should answer these questions in plain language:
- What business problem is the company solving?
- Which employees, devices, applications, and working periods are covered?
- Exactly which data fields are collected—and which are not?
- Is monitoring continuous, periodic, triggered, or limited to a specific investigation?
- Who can view individual-level information?
- How long is detailed and aggregate data retained?
- Can employees pause monitoring or mark private time?
- How can a worker access, correct, explain, or challenge data?
- Are any automated scores or alerts used, and is a human responsible for decisions?
- Which vendors and countries receive the data?
- How are incidents, policy exceptions, and deletion requests handled?
Yaware.TimeTracker can support a proportionate implementation through configurable activity tracking, reporting, access controls, and privacy-conscious settings. Review the available time tracking and productivity features, our explanation of what computer activity tracking records, and the Yaware Privacy Policy before deployment.
Frequently asked questions
Is employee monitoring legal without consent?
Sometimes. Many jurisdictions allow monitoring on a basis other than consent, such as legitimate interests, contractual necessity, employment management, or legal obligation. That does not remove duties of notice, necessity, proportionality, consultation, and security.
Can an employer monitor a personal computer?
Monitoring a personal device is substantially riskier because work and private activity are mixed. Use a separate work profile or company-managed device, limit collection to work applications and working time, and provide a reliable pause or exclusion mechanism.
Are screenshots legal?
Screenshots may be lawful in some situations, but they can capture private messages, passwords, health information, financial data, and third-party confidential material. Use them only where a documented need cannot be met with less intrusive data, reduce frequency, blur sensitive content, restrict access, and retain them briefly.
Can employers read private messages or record audio?
These are among the highest-risk monitoring practices and may trigger communications-interception or wiretap laws in addition to privacy and employment rules. A general IT policy is not always sufficient. Obtain jurisdiction-specific advice before enabling either feature.
How long should monitoring data be kept?
There is no universal period. Keep identifiable, detailed information only as long as necessary for the stated purpose. Use shorter periods for screenshots, location, and granular activity, then delete or aggregate the data. Document the schedule and apply it automatically.
Editorial methodology and sources
This guide was prepared by comparing official legislation and regulator guidance available on August 11, 2026. It intentionally states common compliance principles conservatively and does not attempt to replace country-specific advice. Laws and regulator interpretations change; verify the linked primary sources before relying on any section.
