Employee monitoring GDPR: what the rules require

What GDPR requires for employee monitoring

Employee monitoring is the processing of personal data, so the GDPR applies whenever a tool can identify an employee. The regulation does not prohibit monitoring. It sets conditions that an employer must meet before collecting anything. Article 88 also lets EU member states adopt more specific rules for employment, and several have done so.

Four parts of the GDPR do most of the work:

• Article 5 principles. Data must be processed lawfully, fairly and transparently, for a specific purpose, limited to what is necessary, kept only as long as needed and kept secure.
• Article 6 lawful basis. Every monitoring activity needs one of the lawful grounds in Article 6.
• Article 13 transparency. Employees must be told, at the point of collection, what is collected, why, for how long and who receives it.
• Article 35 impact assessment. A data protection impact assessment (DPIA) is required where processing is likely to create a high risk.

Choosing a lawful basis

Consent is rarely a valid basis for employee monitoring. The Article 29 Working Party's Opinion 2/2017 on data processing at work explains that the imbalance between employer and employee usually means consent is not freely given. Employers therefore tend to rely on legitimate interests under Article 6(1)(f), which requires a documented balancing test, or on a legal obligation under Article 6(1)(c), such as statutory working time records.

Legitimate interests is not a blank cheque. The employer has to show a real interest, that monitoring is necessary to achieve it, that less intrusive options were considered and that employee rights are adequately protected.

Special category data and automated decisions

Monitoring can reveal health, religion, union membership or other special category data under Article 9. Sick-leave patterns or location data around a union meeting are examples. Processing that data needs an Article 9 exception and a stronger case.

Article 22 restricts decisions based solely on automated processing that significantly affect a person. A productivity score that alone decides a dismissal or a bonus needs meaningful human review.

Where these rules apply

This page covers the EU GDPR and the German and EU rules that sit on top of it. Employers in Great Britain are subject to the UK GDPR and the Data Protection Act 2018. The principles are similar, but the text is separate, and the German works council and EU AI Act rules do not apply in the UK. The Information Commissioner's Office (ICO) publishes its own guidance on monitoring workers.

Data protection impact assessments

A DPIA is a structured assessment of the risks that monitoring creates and the steps taken to reduce them. The EDPB's criteria for high-risk processing (WP248 rev.01) include systematic monitoring and data about vulnerable people. Employees are generally treated as vulnerable because of the power imbalance.

In practice, assume a DPIA is needed before you deploy any tool that records behaviour, activity or performance. Document the purpose, the data, the retention period and the safeguards. Involve your data protection officer where you have one, and review the assessment when the tool or its purpose changes.

For camera-based monitoring, the EDPB's Guidelines 3/2019 on video devices set out further conditions, including limits on scope and retention.

Germany: BDSG section 26 and the works council

Germany adds its own layer. Section 26 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) governs employee data. Under section 26(1), processing is allowed where it is necessary for the employment relationship. Processing to detect crime is permitted only where there are documented, concrete grounds for suspicion and the measure is proportionate. Consent under section 26(2) must be voluntary, and the law sets out factors for judging that.

The works council adds a second requirement. Under section 87(1) no. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), the works council has co-determination rights over technical systems designed to monitor employee behaviour or performance. In companies with a works council, the employer generally needs a works agreement (Betriebsvereinbarung) before introducing such a system.

Courts apply these rules strictly. In a 2017 decision (BAG, 27 July 2017, 2 AZR 681/16), the Federal Labour Court held that covertly installed keylogger software could not justify a dismissal without concrete suspicion and a proportionality check. Covert methods carry the highest legal risk in German law.

European Court of Human Rights and CJEU case law

Two decisions of the European Court of Human Rights set the standard for workplace monitoring under Article 8 of the European Convention on Human Rights:

• Bărbulescu v. Romania (Grand Chamber, 5 September 2017, application no. 61496/08). The court found a violation where an employer read an employee's messages sent through a work Yahoo Messenger account. Employees must be told in advance about the possibility and extent of monitoring, and national courts must check that the measure is proportionate.
• López Ribalda and Others v. Spain (Grand Chamber, 17 October 2019, nos. 1874/13 and 8567/13). The court found no violation in a case of covert video surveillance, given reasonable suspicion, limited scope and duration. Prior notice was treated as one factor among several, not an absolute rule.

The Court of Justice of the EU has also held, in Case C-34/21 (2023), that national rules on processing employee data must meet the specific safeguards in Article 88(2) GDPR.

The EU AI Act

Regulation (EU) 2024/1689, the AI Act, adds rules on top of data protection law:

• Article 5(1)(f) prohibits AI systems that infer emotions of people in the workplace, except for medical or safety reasons. These prohibitions have applied since 2 February 2025.
• Annex III, point 4(b) classifies as high-risk any AI intended to make decisions affecting work relationships, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate workers' performance and behaviour.
• Article 26(7) requires employers that deploy a high-risk system to inform workers' representatives and affected workers before the system is put into service at the workplace.

The high-risk obligations were originally due to apply from 2 August 2026. The European Commission has proposed delaying parts of that timetable, so check the current position before you roll out an AI-based tool.

US overview

The United States has no single federal law on workplace monitoring. Several sources apply:

Biometric timekeeping has its own rules. Illinois' Biometric Information Privacy Act (BIPA) requires notice and written consent before collecting biometric identifiers such as fingerprints. State rules change, so check every state where your employees work.

A practical compliance checklist

How emai supports compliant monitoring

emai is built for transparent, consent-based workforce monitoring. Its design follows the principles above:

• Opt-in and visible. Tracking is switched on for a defined purpose, and employees can see what is collected.
• Pausable. Tracking can be paused, which supports consent and proportionality.
• Team-level insights. Reports roll up to team and project level. emai does not produce individual scores.
• Self-service and audit trail. Employees see their own data, and changes are logged.
• EU data storage. Data is stored in Frankfurt, a data processing agreement is available online, and data can be exported or deleted.
• Role-based access. Owner, Admin, Manager and Employee roles limit who sees what.

emai is free for up to 3 users. The Pro plan is €8 and the Business plan is €14 per user per month. emai does not offer covert monitoring, keystroke logging or secret screenshots, whatever the local rules.

To go further, read about transparent employee monitoring, AI employee monitoring and employee monitoring software.

This is not legal advice

This guide is general information about GDPR, German, EU, UK and US rules as understood at the time of writing. Laws change and vary by country and state. Talk to a qualified data protection or employment lawyer before you introduce employee monitoring, and involve your works council or employee representatives where required.