Keystrokes, Cameras and Consent: Where the Law Draws the Line on Workplace Surveillance
Photo: Tamasflex, CC BY-SA 3.0, via Wikimedia Commons
A quiet shift has taken place in offices, warehouses and home workspaces across the UK. Employers increasingly track keystrokes, log website visits, record teams calls, and monitor vehicle locations. Some of this is lawful and even sensible; some of it sits on the wrong side of the line. Knowing the difference matters — particularly when the monitoring is used to question your performance or, worse, to justify dismissal.
The Legal Foundations: Transparency Comes First
UK employers do not need your consent to monitor you, but they do need a lawful basis and, crucially, transparency. Under the UK GDPR and the Data Protection Act 2018, any monitoring must be necessary, proportionate to a legitimate aim, and clearly communicated. The Information Commissioner's Office (ICO) expects employers to carry out a data protection impact assessment before introducing intrusive monitoring.
In practice this means:
- A clear policy. Employees should be told what is monitored, why, and how the data is used — ideally in a staff handbook or monitoring policy.
- No covert surveillance without strong justification. Secretly recording employees is only defensible in narrow circumstances, such as a genuine, proportionate investigation into suspected criminal activity.
- Respect for private spaces. Cameras in toilets, changing rooms and locker areas are effectively off-limits.
What Can — and Cannot — Be Watched
Work email and internet use on company systems can generally be monitored, provided the policy says so. Personal emails sent from a private account on a work device occupy greyer territory; employers should not read the content without good reason.
Productivity software that counts keystrokes or takes periodic screenshots is lawful only where it is proportionate. A judge or the ICO will ask whether the same aim could have been achieved by less intrusive means — a question many off-the-shelf monitoring packages fail to answer convincingly.
CCTV in workplaces is permitted for security and safety, but signage is expected, footage must be stored securely, and employees can make subject access requests to see recordings of themselves. Vehicle trackers in company cars are common, yet continuous tracking of breaks and personal journeys raises proportionality concerns.
Red Flags Worth Noting
Certain patterns suggest the balance has tipped unlawfully, or at least unfairly:
- monitoring introduced without any policy or announcement;
- surveillance used disproportionately against particular individuals;
- performance concerns based on metrics never disclosed to staff;
- recordings of private conversations or union activity;
- monitoring used to discourage whistleblowing — a serious matter with its own statutory protections.
If any of these feel familiar, the issue may extend beyond data protection into unfair treatment, discrimination or constructive dismissal territory.
What To Do Before You Resign
Resigning in frustration is the most common mistake. Once you leave, your remedies narrow considerably. Instead:
- Gather what you can. Save policies, emails and any communications about monitoring — lawfully and without breaching confidentiality yourself.
- Raise it in writing. A calm query about the monitoring policy creates a paper trail. Sometimes the explanation is simply poor communication.
- Use the grievance procedure. If the concern persists, a formal grievance obliges your employer to respond and can strengthen a later tribunal claim.
- Seek advice early. Time limits for employment tribunal claims are strict — generally three months less one day from the act complained of — and early advice shapes everything that follows.
- Consider the ICO. A complaint about data protection breaches is free and can run alongside an internal process.
Resigning and claiming constructive dismissal remains possible where monitoring makes your position untenable, but it is a high bar and should never be attempted without legal advice first.
The Bottom Line
Employers are entitled to protect their business, their data and their customers. Employees are entitled to dignity, transparency and proportionality. Where the second is sacrificed to the first, the law offers remedies — but they reward the prepared, not the provoked. If workplace monitoring is affecting you, a short conversation with a solicitor will clarify your position long before any decision needs to be made.
