Employer's Guide to Workplace Monitoring & Covert Recording Law (UK)

Key facts

  • Around a third of UK employers use some form of staff monitoring software, according to 2025 research by the Chartered Management Institute.
  • 85% of UK employers admit to monitoring staff online activity in some form, per a 2025 ExpressVPN survey of 1,000 employers and 1,000 employees.
  • Nearly half of UK workers report increased stress from workplace surveillance, and over half say they'd consider quitting if subjected to it.
  • Covert monitoring of employees is lawful only in exceptional circumstances under ICO guidance — it is not a routine management tool.

This guide is aimed at UK employers who want to understand what workplace monitoring, including camera-based monitoring, is actually permitted, and where the legal and reputational risk sits. It complements our general UK covert recording law guide, which covers the underlying legislation in more depth.

How common is workplace monitoring in the UK, really?

Workplace monitoring has moved from a niche practice to something close to the norm. A 2025 Chartered Management Institute study found that roughly one in three UK employers now uses some form of staff monitoring software, a figure that's grown significantly since the ICO first issued dedicated guidance on the topic. Separately, a 2025 ExpressVPN survey of 1,000 UK employers and 1,000 employees found 85% of employers admitted to monitoring staff online activity, with 54% tracking active work hours, 36% monitoring website visits, and 27% using real-time screen observation software.

The shift to hybrid and remote work is the clearest driver. Where monitoring was once mostly CCTV and clocking-in systems, it's increasingly click-tracking, keystroke logging, and webcam-based software, tools that didn't need to exist when most staff worked from a single, employer-controlled office.

The cost of getting it wrong

The same ExpressVPN research found a genuine employee backlash building alongside the rise in monitoring: nearly half of UK workers reported increased stress specifically linked to surveillance, and a majority said they'd consider leaving a job over it. Workers aged 18–24 reported feeling it most acutely. A minority of employees, in the same and similar surveys, admitted to actively working around monitoring tools, such as using "mouse jiggler" software or scheduling emails to appear active, which suggests that intrusive monitoring doesn't just risk legal exposure, it can actively undermine the productivity it's meant to protect.

What UK law actually requires

Workplace monitoring sits under UK GDPR and the Data Protection Act 2018, and the ICO's core standard is that monitoring must be lawful, fair, and proportionate. In practice, that means:

  • Transparency by default. Staff should generally know monitoring is happening and why, communicated clearly before it starts.
  • Necessity and proportionality. Employers are expected to use the least intrusive method that achieves a legitimate purpose, not the most comprehensive one available.
  • A documented Data Protection Impact Assessment (DPIA) for higher-risk monitoring, including anything covert.
  • Covert monitoring as the exception, not a tool. The ICO is explicit that covert monitoring is only justifiable in exceptional circumstances, such as investigating suspected criminal activity or serious misconduct, authorised by senior management, and strictly time-limited to that investigation.

Monitoring in spaces where staff would reasonably expect privacy, toilets and changing rooms being the clearest example, is treated as essentially never justifiable, covert or otherwise.

Legal precedent employers should know

Two European Court of Human Rights cases still shape how UK monitoring disputes are viewed: Copland v United Kingdom (2007), which found that monitoring an employee's phone, email, and internet use without informing them breached their Article 8 right to privacy, and Barbulescu v Romania (2017), which confirmed employees retain some reasonable expectation of privacy even while using work systems. Domestically, employees who feel unfairly or excessively monitored have grounds to bring claims for constructive dismissal or breach of the implied duty of trust and confidence, separate from any ICO enforcement action.

A practical checklist before introducing monitoring

  1. Identify the specific, legitimate business purpose, not just "general oversight"
  2. Check whether a less intrusive method would achieve the same purpose
  3. Draft and complete a DPIA before deployment, not after
  4. Communicate clearly to staff what's being monitored, why, and for how long data is retained
  5. Exclude private spaces entirely from any camera or audio monitoring
  6. Reserve covert monitoring for specific, documented, suspected serious misconduct, authorised at a senior level
  7. Review and delete monitoring data on a defined schedule rather than indefinitely

Sources