WorkAuditor Blog

Monitoring employee computer activity is legal in almost every jurisdiction — provided you disclose it, have a legitimate business purpose, and keep the data proportionate. Those three conditions, not the software, are what keep a monitoring program out of court. I've reviewed monitoring setups for companies in the US, the EU, and the UK, and nearly every problem I've seen was a process problem, not a technology one.

The Legal Baseline: Notice and Purpose

Two principles hold in every legal system I've worked with. First, notice: employees must know, before monitoring starts, what is being collected and who can see it. Second, purpose: the monitoring must serve a legitimate business interest — safety, security, compliance, or performance management. If you can't write down the business reason in one sentence, you shouldn't be collecting the data.

The disclosure requirement is where companies fail most often. A policy buried in the employee handbook, signed once at hiring, does not cover a new monitoring program. You need a specific, dated acknowledgement that says what the new system collects and when it starts.

United States: Federal and State Rules

In the US, the federal baseline is the Electronic Communications Privacy Act, which generally allows employers to monitor company-owned devices and systems. The real complexity is state law. Around two dozen states, including California, Delaware, and Connecticut, require some form of advance notice for electronic monitoring. California's rule is the strictest: you must notify employees of email, internet, and phone monitoring before it begins, and the notice can't be buried — it has to be meaningful.

New York's law takes a different shape: it requires a written policy posted or provided before monitoring starts. Whatever state you're in, the safe pattern is identical: written policy, signed acknowledgement, company-owned hardware, legitimate purpose, and a retention schedule.

Europe and the UK: Proportionality Is Everything

In the EU, GDPR applies, and in the UK, the Data Protection Act does the same job. Both require a lawful basis — usually legitimate interest — and a proportionality test: is the monitoring necessary, and is there a less intrusive way to achieve the same goal? Continuous screen recording fails that test in most cases. Intermittent screenshots with blurred personal apps passes it more easily. Activity logs and time tracking generally pass. Keystroke logging rarely does.

A German logistics company with 380 staff asked me to review their rollout. Their plan was full keystroke capture on every forklift dispatch terminal. We scaled it back to application and terminal usage logs, added a six-month retention limit, and got it approved by the works council in six weeks. The original plan would have taken months in negotiation — and might not have been approved at all. In Germany, works council approval is legally required for most monitoring measures, and the same pattern exists in France, the Netherlands, and Sweden.

What Data You Can Keep, and for How Long

Retention is where legality is decided after the fact. If a complaint lands with a regulator, the first question is usually "why do you still have this?" Rules of thumb that hold up: activity logs, 6–12 months; screenshots, 30–90 days; and anything tied to a disciplinary case, keep only as long as the case file requires. Personal data that serves no ongoing purpose is a liability with a timestamp. Set automatic deletion, and don't let anyone override it casually.

The Policy That Keeps You Compliant

A compliant monitoring policy has four parts and I've stopped reviewing policies that lack any of them. Purpose: one sentence on why monitoring exists. Scope: what's collected, on which devices, during which hours. Access: exactly who can view the data — usually HR and the employee's direct manager, and nobody else. Retention: specific windows with automatic deletion.

Add to that a training record. When an employee signs the acknowledgement, keep the record. When you update the policy, collect new signatures. The most expensive mistakes I've seen were companies with excellent policies and no proof anyone ever read them.

Common Mistakes That Get Companies in Trouble

The five failures I see repeatedly: monitoring personal devices, collecting data outside work hours, keeping screenshots longer than needed, letting more people see data than the policy allows, and disciplining an employee based on data the employee never knew was being collected. Each of those converts a lawful program into an unlawful one overnight. The discipline point deserves emphasis: if the policy doesn't say a metric will be used in performance decisions, you can't use it that way.

A Compliance Checklist for Your Rollout

Before you deploy anything, run this list: policy written and signed; legal review done for each country you operate in; monitoring limited to company devices; data collection scoped to work hours; access restricted to named roles; retention windows set with auto-deletion; and an employee-facing explanation of what happens if someone disagrees with the data. If all seven are done, the software itself is the easy part.

If you need the tooling to match a compliant rollout, WorkAuditor is cloud-based employee monitoring software for Windows and Mac with configurable retention and access controls — details at https://www.workauditor.com. When did you last update your monitoring policy? If the answer is "before the last hiring round," that's your first stop.