Summarize With AI
Meet Monica, who leads people operations at a software company in the United States. Sara works from Berlin and Arjun from Dublin. They're fictional, but their questions are familiar. We'll follow Monica as she plans monitoring for her EU staff, and we'll check what Sara and Arjun see.
This guide is general information, not legal advice. We read every source named below on the day we updated it. Laws and guidance change, so ask a lawyer about your own situation.
Does GDPR apply to employee monitoring?
Yes, when monitoring touches personal data of people in the EU, and logs and screenshots do. The General Data Protection Regulation (GDPR) is the EU's data protection law. It covers employers based in the EU and, in some cases, employers based elsewhere that monitor people in the EU.
The GDPR text says it covers processing done through an EU establishment. It also covers a company outside the EU when its processing relates to monitoring people's behavior inside the EU. Whether that reaches your employees is a question for your lawyer.
Personal data means any information about an identifiable person, and processing means almost anything you do with it. A timesheet and a screenshot both count.
Countries can add workplace rules of their own. Article 88 lets each EU country set more specific rules for employee data, by law or by collective agreement. It names "monitoring systems at the work place".
Monica's company has no office in Europe, so she assumes GDPR is someone else's problem. A recruiter reminds her that Sara and Arjun live there, and her tool would watch them.
In short: if people in the EU work for you, assume the rules apply until a lawyer tells you otherwise.
What principles apply to GDPR employee monitoring?
Article 5 sets six principles, plus a duty to prove you follow them. Each one asks a plain question about your monitoring: why, how much, how long and how safe. Any plan that can't answer all six isn't ready, whatever tool it uses.
Lawful, fair and transparent
You have a legal reason, and staff know about it.
Purpose limitation
You collect data for a stated purpose and don't reuse it for another.
Data minimization
You collect only what that purpose needs.
Accuracy
You keep records correct and fix errors without delay.
Storage limitation
You keep data no longer than the purpose needs.
Integrity and confidentiality
You protect data from unauthorized use, loss or damage.
The article adds accountability: you must be able to show you follow the principles, so write decisions down.
Sara asks why Monica needs her app history. Monica has a reason in her head but nothing on paper, so her first answer is vague.
In short: a purpose that fits in one sentence is also a limit you can be held to.
Which lawful basis can an employer use?
Under Article 6, every use of personal data needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. For monitoring, employers usually turn to the last one, because consent rarely works between a boss and a worker.
The European Data Protection Board (EDPB) is the body of EU privacy regulators. Its consent guidelines, adopted May 4, 2020, say employees can give free consent only when saying no costs them nothing.
Consent needs a free choice.
- Staff must be able to say no without penalty
- They must be able to withdraw it later
Legitimate interests needs a written test.
- You name a real business reason
- You show monitoring is needed and fair
Monica plans a consent form. Sara asks what happens if she doesn't tick the box. The honest answer is that she'd look difficult, so the tick wouldn't count as free.
In short: a tick box under pressure is not consent, so pick another basis and say which one you use.
How do you test legitimate interests for monitoring?
Legitimate interests works only when three things are true. You have a real business reason, monitoring is needed to reach that reason, and employees' rights don't outweigh it in this case. Article 6(1)(f) sets this test. Write your answers down before you start.
The EDPB's guidelines, version 1.0 adopted October 8, 2024, call these three conditions that must all be met. The PDF is marked as a version for public consultation, so look for a later final text.
Swipe sideways for full table
Condition | Question to ask | A plain example |
|---|---|---|
A real interest | What are we protecting or planning? | Spread work fairly across a team |
Necessary | Would less data do the job? | Hours and apps, not screens |
Balanced | Do staff rights come first here? | Yes, if it reaches private messages |
Regulators have been blunt about the heaviest tools. A 2017 opinion from the advisory group of EU regulators that came before the EDPB called logging keystrokes and mouse movements disproportionate. It said an employer is "very unlikely" to have a legal ground for it. It predates GDPR's start date.
Arjun's team lead wants screenshots every few minutes. Monica fills in the test, then her lawyer sends it back. The draft lists reasons she already likes and never asks whether less data would do. On the second try, hours and app time answer the question.
In short: if less data answers your question, collect less.
When do you need a DPIA before tracking staff?
A data protection impact assessment (DPIA) is a written risk check done before processing starts. Article 35 requires one when processing is likely to be high risk for people's rights. Monitoring staff widely, or scoring them automatically, can reach that level, so check your national authority's list.
Under Article 35, each country's data protection authority publishes a list of processing that needs a DPIA. Look up the list for every country where you have staff.
Two nearby rules matter here. If the DPIA shows a high risk you can't reduce, Article 36 says to consult the authority before you start. And people have a right not to face a decision based only on automated processing that significantly affects them.
Monica expects the DPIA to be a formality. Instead it catches something she missed: screenshots can show a personal email that an employee left open on a shared screen.
In short: run the assessment before launch, because it costs less than redoing the rollout.
How much must you tell employees, and what can they ask for?
Before collection starts, tell employees who you are, why you collect their data, on which legal basis, who receives it and how long you keep it. They can then ask for a copy, and sometimes object. You have one month to reply.
Article 13 lists what to provide at the time data is obtained. That includes the interests you rely on, the storage period or how you set it, and the right to complain to a regulator. GDPR sets no single number of days. It asks for a period you can justify.
Employers
- give notice when collection starts, not later.
- name the legal basis and the interest behind it.
- publish a plain monitoring policy that staff can find.
Employees
- request a copy under Article 15.
- object where the basis is legitimate interests, under Article 21.
Secret tracking is hard to square with this notice rule, since the notice must come when collection starts. The 2017 opinion adds that staff can't use their rights if they don't know the monitoring exists.
Arjun emails HR for his data. The request sits in a shared inbox, and Monica finds it when the one-month reply period, set by Article 12, is nearly over.
In short: tell people before you collect, and be ready to show them afterward.
Do regulators really fine employers for monitoring?
Regulators can fine employers, and the top fines are large. Article 83 allows up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. That tier covers the basic principles and people's rights. Other duties, such as the impact assessment, carry a lower tier.
Source: Conseil d'État, decision 492830, December 23, 2025, in French.
The decision shows where the line sat. The court accepted an alert that fires only after ten idle minutes and skips breaks. The same decision upheld the finding that the company hadn't shown why it kept each productivity indicator for 31 days. Notice and security findings stayed too.
Sara reads about the case and asks how long Monica's tool keeps data. The pilot keeps everything, just in case. Monica has no reason to give.
In short: the court cut the fine but kept the retention finding, so a long storage period needs its own reason.
What should a pre-launch checklist cover?
An employee monitoring GDPR checklist covers eight things: purpose, legal basis, a written test, a DPIA where needed, notice, access, retention and security. Run it before launch and once a year. Keep the answers in writing, so you can show them to staff or a regulator.
- Purpose written in one sentence
- Lawful basis chosen, with the test recorded
- DPIA done, or a note on why it isn't needed
- Notice given before collection starts
- Only necessary data collected
- Access limited to named roles
- Retention period set and applied
- Access and objection process ready, with an owner
- Security measures in place
Monica runs the list on her pilot and finds two gaps. Nobody owns access requests, and the notice skips screenshot blurring. Fixing both means a delay.
In short: a late checklist still beats none, but run it before you announce a date.
How do you choose a GDPR compliant tool?
GDPR compliant employee monitoring tools help you follow the rules, but the law applies to how you use them, not to a label. Look for controls that match your plan. You should be able to choose what is collected, limit who sees it, set retention and show employees their own data.
A tool that logs hours is easier to justify than one that captures screens.
We360.ai is our product, and it sits in the activity analytics group. Its privacy docs describe what the desktop agent collects and what it never does.
What it collects on a work computer.
- Active app and window, with the URL in a browser
- Keyboard and mouse activity, not what was typed
- Periodic screenshots at a frequency admins set
Where you control it as an admin.
- Screenshots can be switched off for a team or person
- Blur level and manager downloads are adjustable
- Screen recording stays off until you enable it
- Monitoring can be limited to work hours
What it never collects from employees.
- Individual typed characters
- Webcam feeds or audio
Employees can see their own analytics. The docs say a Data Processing Addendum is available for customers subject to GDPR. They also say customers can choose a hosting region through managed cloud or bring-your-own-cloud.
The platform lists SOC2 Type II · ISO 27001 · GDPR · HIPAA on its security and compliance page. That doesn't decide your own compliance. The docs tell you to review local legal requirements before you turn on screenshots or recording.
One honest limit: the docs don't say which legal basis, notice or impact assessment your country needs. That stays with you and your lawyer. Ask where your data sits by default.
Monica tries a tool with Sara's team only. Arjun hears about it from a colleague before his own notice arrives, and he's annoyed.
In short: pick the lightest tool that answers your question, and tell people before you switch it on.
FAQ
Does GDPR apply to US companies with EU employees? +−
It can. An EU establishment brings processing under GDPR, and so can monitoring people's behavior in the EU from outside it. Whether it reaches your staff depends on the facts, so ask a lawyer.
Do you need consent to monitor employees under GDPR? +−
No, and consent is usually a weak choice, because refusing a boss can carry a cost. Most employers rely on legitimate interests instead, backed by a written test and a clear notice. The EDPB treats free consent at work as the exception.
Is keystroke or screenshot monitoring allowed under GDPR? +−
It isn't banned by name, but it is hard to justify. A 2017 opinion of EU regulators called logging keystrokes disproportionate. Screenshots need a written test, often a DPIA, and a reason lighter data can't meet. The We360.ai privacy docs say it never records typed characters.
What are the penalties for unlawful employee monitoring under GDPR? +−
Under Article 83, the top tier is 20 million euros or 4% of worldwide turnover, whichever is higher. It covers the basic principles and people's rights. Article 83 also sets a lower tier of 10 million euros or 2% for other duties, including the DPIA.
Can employees in the EU refuse monitoring? +−
Sometimes. If the basis is legitimate interests, you can object because of your situation, and the employer must stop unless it shows compelling grounds. Ask HR for the notice and the basis in writing, and ask what your country's rules add.
Does my employer need to tell me what data it collects about me? +−
Yes, at the start of collection. You should hear the reason, the legal basis, the recipients and the storage period. You can also ask for a copy of your data. If nobody told you, ask HR in writing, and read the signs of being monitored.
What makes employee monitoring software GDPR compliant? +−
Mostly how you use it. The duties sit with the employer: a lawful basis, a purpose, notice and, for high-risk cases, a DPIA. GDPR compliant employee monitoring software can help with access, retention and screenshot controls, but no product makes you compliant alone.
Related Guides
What is employee monitoring? It is when an employer collects data about how work gets done, such as hours, apps, activity or location, usually with software on company devices. This guide explains what it tracks, how it works, what US law says and how to start fairly.
Screen monitoring software captures what appears on a work computer screen, as scheduled screenshots, a live view or a video recording. Employers use it to review work and settle disputes. Employees should know what it captures and who sees it. This guide covers the types, features, privacy controls and US legal basics.
To monitor employee computer activity well, decide why you need the data, pick the lightest method that answers it, tell employees first and test on one computer before a rollout. This guide covers the methods, built-in tools versus software, setup, what monitoring can see, US notice rules and fair use.
An employee monitoring policy is a short written document that tells employees what a company tracks on work devices, why, who sees the data and how long it's kept. This guide gives you an employee monitoring policy template, sample wording, a consent form and the US notice rules.