Employee surveillance in the workplace has always been a controversial area. Various data protection laws, including GDPR, have tried to shed light on what is or isn’t acceptable action by employers. Then we had the pandemic and the subsequent shift to hybrid or remote working, with its additional challenges for employers. Alarmist press coverage raged about home-working employees using ‘mouse jiggler’ software to deceive employers into thinking they were working when they were really watching the telly. So, what are employers allowed to do if they want to monitor employees?

What do we mean by ‘employee surveillance’?

Employee surveillance is any action taken by an employer to monitor what an employee is doing at work. Examples of surveillance activities include:

  • Drug and alcohol testing
  • CCTV
  • Email and phone monitoring
  • Keystroke monitoring or computer activity
  • Vehicle trackers/ GPS tracking
  • Searching employees and/or their property

Such monitoring activity is governed by UK data protection laws, which seek to balance the employer’s right to expect that employees will work safely and effectively with the employee’s right to privacy. Surveillance is permitted only where there is a justifiable reason for it e.g. to protect health & safety, to protect the company’s assets and to prevent criminal activity such as theft or fraud. The surveillance must be limited to the extent needed to achieve the justifiable reason. 

So, for example, if an employee has use of a company vehicle and is permitted to use it for personal travel, it is lawful to fit a tracking device on the vehicle to monitor mileage and location during work activities, but it must be possible for the tracker to be turned off when the employee is using the vehicle for personal travel.  

Where drug and alcohol testing is used for health and safety reasons, the employer should have a policy which clearly sets out why the testing is necessary, how the testing will be done and who will have access to the subsequent results.  The policy should only be used for those roles where drug and/or alcohol misuse would pose a significant safety risk e.g. employees operating machinery or driving for work. It would be harder to justify drug and/or alcohol testing all employees, e.g. those in office roles. Drug testing should be done randomly and not used to single out an individual.

Do you have to notify employees of surveillance?

In the majority of circumstances, yes, you would be required to notify employees of any monitoring activity you undertake as an employer. This notification should be done through a statement in the contract of employment and the Staff Handbook, in the Employee Privacy Notice that all employers are required to give their employees and by specific notification such as CCTV signs in any areas of the workplace where this is used. 

Covert surveillance should only be used in order to prevent suspected criminal activity and only as a last resort. Any covert surveillance in the workplace should cease as soon as the investigation into suspected criminal activity has concluded. Using covert surveillance ‘just in case’ any criminal activity ‘might’ be happening is likely to be unlawful.

Can employees refuse surveillance?

You do need the employee’s consent to undertake a drug test at work. However, if the employee refuses to take a test and you have good reason to suspect they are breaching your health and safety policy through drug use, you may be able to take formal disciplinary action against them for refusing to comply with an H&S requirement, depending on the specific circumstances. 

In other areas, if you have a good business reason for conducting surveillance of employees and you make clear to them how you will do this, in the employment contract, handbook and employee privacy notice, then it will be difficult for the employee to object to the monitoring. However, they could bring a formal complaint if your surveillance conflicts with their right to privacy, such as monitoring the content of personal emails or having CCTV in break areas or toilets.

Who can have access to surveillance data?

Access to information on employees which is gained through employee monitoring should be limited to those with a genuine need to see it. Any information from which an individual can be identified would count as personal data under UK data protection legislation, so access to the results of drug tests, for example, should be limited to specific individuals in the drug testing company and the person responsible for the employer’s health and safety, plus the employee’s immediate line manager. 

Remember that employees also have the right to see any data you hold on them and this can include CCTV footage, vehicle tracking data and the results of drug or alcohol testing. If an employee makes a Subject Access Request under GDPR, they must be given access to any personal data on them which includes anything that has been obtained through employee surveillance activity.

Employee Monitoring vs. Company Culture

Looking at the issue of employee surveillance in a wider sense, the use (or not) of employee monitoring in the workplace can have a major impact on how engaged your employees are. While motoring on the grounds of H&S may be critical for your business, the use of software to monitor keystrokes, for example, can create a sense of employees not being trusted and can become a major source of stress for those being monitored.  Studies regularly show that employees who are treated as adults in the workplace and given autonomy over how and where they work are more engaged and more productive. Ultimately, measuring outputs and quality of work is likely to be of more benefit to employers than worrying about ‘mouse jiggling’…

For further information, see

Need support navigating employee surveillance and privacy policies? 

We’re here to help. Our expert HR Consultants at MAD-HR can guide you in drafting clear, compliant policies and employee privacy notices that strike the right balance between business needs and employee trust. With the right approach, you can protect your organisation while respecting your team’s rights – creating a workplace that’s both secure and supportive. Contact us today, and let us take the guesswork out of getting it right.

Frequently Asked Questions

Useful questions and answers about “The Dos and Don’ts of Employee Surveillance”

What is Employee Surveillance?

Employee surveillance is any action taken by an employer to monitor what an employee is doing at work. Examples of surveillance activities include: Drug and alcohol testing CCTV Email and phone monitoring Keystroke monitoring Vehicle trackers Searching employees and / or their property

Do you have to notify employees of surveillance?

In the majority of circumstances yes, you would be required to notify employees of any monitoring activity you undertake as an employer. This notification should be done through a statement in the contract of employment and the Staff Handbook

Can employees refuse surveillance?

If you have a justifiable business reason for conducting surveillance of employees and you make clear to them how you will do this, in the employment contract, handbook and employee privacy notice, then it will be difficult for the employee to object to the monitoring. However, they could bring a formal complaint if your surveillance conflicts with their right to privacy, such as monitoring the content of personal emails or having CCTV in break areas or toilets.