Short answer: yes, it is legal — provided three conditions are met. What's more, keeping track of working time is a direct obligation of the employer under Article 30 of the Labour Code of Ukraine.
But some actions are categorically prohibited, up to and including criminal liability. The difference between lawful monitoring and a violation is fundamental, so let's go through it in detail: what is allowed, what is not, which documents you need, and what happens if you don't put them in place.
This material is for informational purposes only. For your specific situation, it is worth consulting a lawyer.
What you are allowed to record
The question is not whether you can monitor working time, but how to do it properly. Article 30 of the Labour Code obliges employers to keep records of employees' working time — this is not a right, it is a duty.
It is lawful to record:
- start and end times of work;
- duration of active work, breaks and idle time;
- which applications and websites were used;
- the activity category (productive / unproductive / neutral);
- time spent on specific projects and tasks;
- breaches of the work schedule — late arrivals, early departures.
Everything listed above is metadata: information about the activity, not its content.
An analogy that explains the boundary well: a phone bill shows whom you called, when, and how long the conversation lasted — but it does not record the conversation itself.
What is categorically prohibited
Here the line is firm, and it should not be crossed under any circumstances.
| Prohibited action | Provision | Consequence |
|---|---|---|
| Recording keystrokes (keyloggers) | Art. 163 of the Criminal Code | Criminal liability |
| Accessing the content of correspondence | Art. 31 of the Constitution of Ukraine | Violation of a constitutional right |
| Covert installation without consent | Art. 6 of the Law “On Personal Data Protection” | Unlawful data processing |
| Monitoring personal devices outside working hours | Limits of the employment relationship | Invasion of privacy |
| Audio surveillance or video recording without consent | Art. 31 of the Constitution, Personal Data Protection Law | Unlawful interference |
Important to understand: if a software vendor offers to let you “see absolutely everything, including correspondence” — that is not a product advantage, it is an invitation to take on criminal risk as an employer.
Three conditions for legality
For employee monitoring to be lawful, three things are required. All three are mandatory — the absence of any one of them makes the data processing unlawful.
Condition 1. A company order
An internal administrative document introducing the working time tracking system.
What it should specify:
- the name of the system and the purpose of its introduction;
- exactly which data is collected;
- who has access to the data and to what extent;
- the data retention period;
- the effective date;
- the responsible person.
Condition 2. Internal labour regulations
Article 142 of the Labour Code allows the employer to establish rules governing the employment relationship. The tracking system must be written into them — with a description of exactly what is recorded and during which hours.
This matters beyond the formality: once the system is set out in the regulations, it becomes part of the working conditions the employee agrees to.
Condition 3. Written employee consent
Article 6 of the Law “On Personal Data Protection” requires the data subject's consent to the processing of their personal data. Data about a specific person's work activity is personal data.
What the consent must contain:
- a list of the data being collected;
- the purpose of processing;
- the retention period;
- the employee's rights, in particular the right to access their own data;
- signature and date.
In addition: Article 24 of the same law gives the employee the right to access their own data. This means the system must technically allow a person to see their own statistics — that is not a nice-to-have, it is a requirement.
What happens if you skip the paperwork
The risks work against the employer — it is the employer who bears responsibility.
Fines from the State Labour Service. Article 265 of the Labour Code provides for financial liability for breaches of labour legislation, including improper recording of working time.
Losing a labour dispute. Article 235 of the Labour Code places the burden of proof on the employer. If an employee claims unpaid overtime and there are no accurate records, there is nothing to prove otherwise with.
Data being inadmissible as evidence. Information collected without consent cannot be used as evidence — it is itself a violation. In other words, covert monitoring will not protect you even in a situation where the employee really was in breach.
Reputational fallout. When covert monitoring comes to light, the consequences for the team are usually worse than any benefit from the data collected.
A separate word on overtime
A topic that is often overlooked, even though it creates real risks.
- Article 62 of the Labour Code limits overtime to 120 hours per year per employee.
- Article 106 of the Labour Code requires it to be paid at double the rate.
Without records you cannot see that the limit has been exceeded — and you find out from an inspection or a lawsuit. Accurate tracking works here as an early warning system: you can see the limit approaching and redistribute the workload in time.
Monitoring remote employees
A question that has become relevant for most companies. Article 60-2 of the Labour Code governs remote work and expressly provides that an employee may allocate their working time independently.
This does not remove the obligation to keep records — only the method changes. Instead of “when they arrived at the office”, what is recorded is the time actually worked, regardless of the hours and the location.
The documentation requirements are the same: order, regulations, consent. In addition, it is worth stating the fact of remote work itself in the employment contract or an addendum to it.
Yaware is designed around these requirements: it records time and activity, not the content of correspondence, and every employee has access to their own statistics. Try it free for 14 days →
What exactly to write in the documents
The most common question after “is it legal” is “so what exactly do I put in writing”. Here is an outline structure for each document. The final wording is worth agreeing with your lawyer.
In the implementation order
- Legal basis: Article 30 of the Labour Code (the duty to record working time), Article 142 of the Labour Code (internal labour regulations).
- The name of the system being introduced and its effective date.
- The purpose of implementation — stated specifically (for example: recording working time, producing timesheets, analysing workload).
- A list of the data collected: activity time, application and website names, activity category.
- An explicit statement that the content of correspondence and documents, and passwords, are not collected.
- Who has access to the data and to what extent.
- The data retention period.
- The person responsible for data processing.
In the internal labour regulations
- A section on working time tracking with a description of the system.
- The hours during which tracking takes place.
- The employee's obligation not to interfere with the system's operation on a work device.
- The employee's right to access their own data.
In the employee's consent
- A list of the personal data being processed.
- The purpose of processing.
- The retention period.
- A statement of the employee's rights under the Law “On Personal Data Protection”, in particular the right to access their own data and the right to have it corrected.
- Signature and date.
A practical tip: give the employee a copy of the consent and show them where they can view their own data. That removes most of the questions before they even arise.
How to explain it to the team without causing conflict
Legal correctness is a necessary but insufficient condition. The second part is communication. Experience shows that most conflicts arise not from the tracking itself, but from how it was introduced.
What is worth doing:
- Announce it before launch, not after. Discovering the system out of the blue reads as deception, even if all the paperwork is in order.
- State the boundaries clearly. “Time and application names are recorded. The content of correspondence, passwords and personal messages are not.”
- Explain the purpose. Not “we don't trust you”, but a concrete objective: accurate timesheets, fair overtime pay, an understanding of workload.
- Give people access to their own data. This is the strongest argument — a person sees exactly the same view of themselves that their manager does.
- Show that it works both ways. Tracking records extra hours, and therefore protects the right to be paid for them.
Checklist: how to do it right
- ☐ An order introducing the tracking system has been prepared
- ☐ The system has been added to the internal labour regulations
- ☐ Written consents to data processing have been collected from all employees
- ☐ The system records metadata, not the content of correspondence
- ☐ No keyloggers are used
- ☐ Employees have access to their own data
- ☐ The team was informed before the system went live
- ☐ The data retention period has been defined
- ☐ It has been defined who has access to the data and to what extent
- ☐ Remote employees are covered in line with Art. 60-2 of the Labour Code
FAQ
Can a tracking system be installed without employees knowing?
No. Covert installation breaches the Law “On Personal Data Protection”, which requires consent to processing. Beyond the legal side, it destroys trust irreversibly — and what is hidden becomes known sooner or later.
Can an employee refuse to be monitored?
If the system is provided for in the internal labour regulations and the employee has been made familiar with them, it is part of the working conditions. If, however, the system is introduced abruptly, without documentation and consent, a refusal is justified, because the law is being broken.
Is it legal to take screenshots of the screen?
This is a grey area. A screenshot may capture personal correspondence or confidential data, which touches on Article 31 of the Constitution. Explicit consent, a clear purpose and proportionality are required. In certain fields — legal practice, medicine — screenshots are unacceptable because of professional privilege, and the feature must be switched off entirely.
Can you monitor an employee's personal computer if they work on it?
Only within working hours and work tasks, and only under a separate written consent with clearly defined boundaries. In practice it is simpler and safer to provide a work device or to limit monitoring to a work profile.
How long may tracking data be stored?
The law requires that personal data not be kept longer than is necessary for the purpose of processing. You define the specific period yourself and set it out in the order and the consent. Common practice ranges from a few months to a year.
Is consent needed if the person is a sole proprietor (FOP) working under a contract?
Yes. Processing data about their work equally falls under the Law “On Personal Data Protection”. A clause on time tracking is added to the contract, and the sole proprietor signs a consent form.
Summary
Monitoring employees in Ukraine is legal — and, as far as recording working time goes, it is in fact mandatory under Article 30 of the Labour Code. Legality rests on three conditions: an order, internal labour regulations, and the employee's written consent. Keyloggers, access to the content of correspondence, and covert installation are categorically prohibited.
A practical rule you can check yourself against: recording what and when is lawful; recording the content is not.
Lawful monitoring is transparent monitoring. Yaware operates within Ukrainian legislation: it records time and activity, does not intrude into correspondence, and gives employees access to their data.
