Introduction: Why this matters now
Cyber attacks on small and mid sized businesses are rising every year, and employees are involved often by mistake in most successful breaches. Yet at the same time, staff are increasingly sensitive to how much they are watched at work, especially with hybrid and remote working.
For an owner/director, this creates a clear tension: you need visibility to protect the business, but you do not want to create a “surveillance culture” that destroys trust, damages morale, or breaches UK data protection law (including GDPR). This newsletter explains how to monitor the right things in a way that safeguards your data while respecting your people.
How employee monitoring supports UK GDPR
This quick checklist is designed for small and mid-sized businesses using employee monitoring tools on company devices during working hours. Employee monitoring will usually involve personal data, so UK GDPR and data protection rules are likely to apply.
1. Define and justify the monitoring
- State the business reason.
- List what will be monitored.
- Check it is truly necessary.
2. Choose a lawful basis
- Pick the lawful basis.
- Record why it applies.
- Avoid relying on consent.
3. Assess risk and do a DPIA if needed
- List the data collected.
- Note who can access it.
- Complete a DPIA if the monitoring is intrusive or ongoing.
4. Update policies and worker information
- Update the monitoring policy.
- Update the privacy notice.
- Tell staff clearly and directly.
5. Configure the tool with minimisation in mind
- Turn off features you do not need.
- Limit access to detailed logs.
- Set deletion and retention rules.
6. Train managers and staff
- Train managers on proper use.
- Brief staff on what is monitored.
- Keep the explanation simple.
7. Enable and respect worker rights
- Be ready for access requests.
- Allow objections where applicable.
- Explain decisions based on monitoring data.
8. Manage vendors and security
- Put a processor agreement in place.
- Check where the data is stored.
- Use strong access controls.
9. Review regularly
- Review the setup at least yearly.
- Check it is still proportionate.
- Update documents when tools change.
What “good” employee monitoring looks like
Effective monitoring focuses on systems and behaviours that create cyber risk, not on snooping into every detail of an employee’s working day. Done well, it should feel like CCTV in a shop: there to protect everyone, not to spy on individuals.
In practice, this means putting controls around access to sensitive data, risky activities (like downloading unknown files), and unusual account behaviour, rather than reading private messages.
Watch systems and data, not people
Here are examples of monitoring that protect the business while limiting intrusion into personal privacy:
- Logins and access to key systems: Track when and from where accounts log in, especially for admin and finance tools. This helps spot compromised accounts or logins from unusual locations.
- Data movement, not personal content: Monitor large downloads, mass email sends to external addresses, or copying files to USB or cloud drives, rather than what is written inside each document.
- Use of risky websites and applications: Use web filtering to block malicious or inappropriate sites, and log access attempts at a high level, instead of fully recording every website visited.
- Endpoint protection and alerts: Ensure devices have security tools that can flag malware, suspicious activity, or attempts to disable security, without collecting more information than needed.
All of these give strong security signals without feeling like constant personal surveillance.
Be transparent: tell people what you monitor and why
Under UK GDPR and ICO guidance, monitoring must be necessary, proportionate, and transparent, and employees should know what is being monitored and for what purpose. Hidden monitoring can be unlawful except in very limited circumstances, and it almost always destroys trust.
Good practice for a small business includes:
- Clear written policies explaining what is monitored, how long data is kept, and who can see it.
- Explaining monitoring during induction and refresher training, linking it directly to cyber risk and legal obligations (for example, protecting client data).
- Avoiding intrusive tools such as constant screen recording or webcams, unless there is a very strong, proven business need and proper consultation.
Involve staff and build a security culture
Monitoring works best when employees see it as a safety belt, not a trap. Involving staff in the conversation helps avoid a “them vs us” feeling. Practical steps:
- Share real examples (anonymised) of how monitoring has helped block phishing or stop fraud.
- Encourage staff to report suspicious activity and reassure them that genuine mistakes are learning opportunities, not automatic disciplinary issues.
- Make it clear that the goal is to protect customers, the business, and employees themselves, not to micromanage every minute of their day.
Action points for owner/directors
- List your critical systems and data: Identify accounts and data that would cause real damage if lost, stolen, or leaked (finance, customer records, IP, email).
- Decide what signals you really need: Focus on events like failed logins, unusual locations, large exports, and blocked malware, rather than detailed content of emails or documents.
- Choose tools with privacy in mind: Ask suppliers how their tools support privacy by design (for example, aggregation, pseudonymisation, and role-based access to monitoring data).
- Update your policies and Staff Handbook: Clearly document what is monitored, your lawful basis (usually legitimate interest, sometimes legal obligation), and employees’ rights.
- Train managers not to misuse data: Make sure monitoring data is used for security and compliance, not as a shortcut to performance management or “time policing” unless that is clearly communicated and justified.
Conclusion
Employee monitoring does not have to mean spying. When it is targeted at genuine cyber and compliance risks, explained openly, and designed with privacy in mind, it can protect your company’s data and your culture.
The real test is simple: if you had to stand in front of your team and explain exactly what you monitor and why, would you feel comfortable doing so? If not, it is probably time to adjust your approach.
Until next month, stay secure.