Monitoring staff communications

The rule: UK GDPR, the ICO's guidance and the Investigatory Powers Act

Data protection law permits monitoring of staff communications, on conditions. The ICO's guidance Employment practices and data protection: monitoring workers opens its data protection chapter with: “Data protection law does not prevent you from monitoring workers, but you must do so in a way which is compliant with data protection requirements.” It adds: “Just because a form of monitoring is available, does not mean it is the best way to achieve your aims. You must be clear about your purpose and select the least intrusive means to achieve it.”

The guidance chooses its verbs carefully, and so should anyone reading it. Its introduction to the monitoring workers guidance says: “Must refers to legislative requirements.” And: “Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. You should do this unless there is a good reason not to.” “Could” marks an option. Every page of it also carries a banner: “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.” The regulator itself changed on 30 September 2026, when section 118 of the Data (Use and Access) Act 2025, brought into force by SI 2026/1015, replaced the Information Commissioner with the Information Commission; it is still known as the ICO.

The ICO reminds employers that data protection is not the only law in play: “There are other laws that you should also consider when monitoring workers, outside data protection. These include, but are not limited to, the Human Rights Act 1998, Equalities legislation and investigatory powers regulations.” Article 8 of the European Convention on Human Rights, the right to respect for private life, is given effect by the Human Rights Act 1998 and binds public authorities such as maintained schools directly. Its reach into the workplace is wider than that: in Bărbulescu v Romania (Grand Chamber, 5 September 2017), a case about a private employer, the European Court of Human Rights held at paragraph 80 that “an employer's instructions cannot reduce private social life in the workplace to zero”, and at paragraph 121 listed the factors that matter: whether staff were told in advance, the extent of the checking and the difference between the flow of communications and their content, whether there were legitimate reasons, with content needing “weightier justification”, whether less intrusive methods were possible, the consequences for the employee, and the safeguards.

Then there is the interception regime, which most workplace monitoring policies never mention:

• The offence. Section 3 of the Investigatory Powers Act 2016 makes it an offence to intentionally intercept a communication in the course of its transmission, in the United Kingdom, without lawful authority. Under section 3(2) it is not an offence on a private telecommunication system for “a person with a right to control the operation or use of the system”, which is usually the employer, or someone acting with its consent.
• The civil claim. Section 8 of the Investigatory Powers Act 2016 makes such an interception “actionable at the suit or instance of” the sender or the recipient where its conditions are met, and Condition D is “that the interception is carried out without lawful authority”. The employer that section 3(2) spares from prosecution is exactly the one section 8 can expose to a claim.
• Stored messages count. Under section 4 of the Investigatory Powers Act 2016, interception includes making content available at a “relevant time”, which section 4(4)(b) defines to include “any time when the communication is stored in or by the system (whether before or after its transmission)”. Email sitting in a mailbox on the organisation's own service is within the regime.
• Lawful authority. Section 6(1)(b) of the Investigatory Powers Act 2016 gives lawful authority where “the interception is authorised by any of sections 44 to 52”. For an employer the usual route is section 46 and the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, SI 2018/356. Regulation 3(2) lists the business purposes, including “to establish the existence of facts”, “to ascertain or demonstrate the standards which are achieved or ought to be achieved by persons using the telecommunication system in the course of their duties”, “preventing or detecting crime” and “investigating or detecting the unauthorised use of that or any other telecommunication system”.
• The condition that matters. Regulation 4 of the 2018 Regulations authorises that conduct “only if” the interception is solely for monitoring or keeping a record of communications relevant to the system controller's activities, on a system provided for them, and “the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted”. An employer that reads stored mail without having made those efforts has no lawful authority from the Regulations.

Older policies still cite the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000. They were made under section 4 of the Regulation of Investigatory Powers Act 2000, which was omitted on 27 June 2018; the 2018 Regulations came into force the same day, and the Home Office's explanatory memorandum to the 2018 Regulations says: “The instrument simply maintains the existing legal position.” The 2000 Regulations have been superseded rather than expressly revoked, and the ICO's guidance still lists both among its other sources, but a policy written now should cite the 2018 Regulations.

What counts: email, messages, calls, devices and cameras

The ICO's guidance treats each channel differently. Its page Specific data protection considerations for different ways or methods of monitoring workers covers each one:

• Email and messages on work accounts. “By messages, we mean instant messages available on some applications and the chat functions in collaboration tools.” A staff chat on the organisation's collaboration platform is in the same category as its email. For staff working from home, the ICO says “workers' expectations of privacy are likely to be higher at home than in the workplace”, a risk it expects the DPIA to address.
• Calls. “You should not routinely monitor personal calls.”
• Device activity. “Device activity monitoring is likely to capture excessive amounts of workers' personal information.” The ICO looks at such tools as employers consider them “for tracking workers' activity and productivity”, among other uses. Its list includes screen captures, webcam captures and keystroke monitoring, which it classes as behavioural biometric data where a worker can be identified by their typing, and it says employers are “particularly unlikely to be able to justify capturing webcam shots or footage”.
• Cameras and audio. “You should target any monitoring at areas of particular risk and confine it to areas where expectations of privacy are low. You are only likely to be justified in using continuous video or audio monitoring of workers in rare circumstances.” On audio it says: “You should switch off by default any capability to record audio. You should only use it in exceptional circumstances, for example by a trigger switch.” It says the same of dashcams, and in its taxi example the audio is “switched off by default and only triggered in exceptional circumstances”.

Personal devices and personal accounts are a different matter. An organisation does not control a member of staff's own WhatsApp or private email, and the same ICO page says monitoring tools “can be particularly intrusive if workers are using their own devices”. What a policy can and cannot ask of a personal phone is covered in the bring your own device policy guide; this guide is about the organisation's own systems.

In schools, the monitoring system on school devices shows what users are doing and, in some cases, records it, and staff are users. The Department for Education's guidance Data protection in schools: data protection policies and procedures says schools “should restrict access to monitoring data to authorised staff only”, that “Staff with access should receive appropriate training”, and that schools “should conduct a DPIA before introducing a new filtering or monitoring system or making significant changes to an existing one”. The safeguarding side of that system, for pupils, is covered in the filtering and monitoring in schools guide.

Before anyone opens a message: the tests the ICO sets

The ICO's tests come in a sensible order. Each is short; skipping one is how a reasonable investigation becomes an unlawful one.

1. A purpose, and proportion. The ICO says: “You must be clear about your purpose for monitoring emails and messages and make sure any monitoring is necessary and proportionate to your purpose. You must inform workers of the purpose of any monitoring.” Keeping an eye on things is not a purpose; investigating a suspected disclosure of pupil data on 3 March is.
2. A lawful basis, and rarely consent. Processing needs a lawful basis under Article 6 of the UK GDPR. The ICO warns: “You must not adopt a one-size-fits-all approach.” Legitimate interests, which it calls “the most flexible” basis, often fits; contract or legal obligation sometimes does. A public authority within section 7 of the Data Protection Act 2018, such as a maintained school, a maintained nursery school or an academy trust, cannot rely on legitimate interests for processing in the performance of its tasks, so it looks to public task. The ICO is clear that “consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers.”
3. A special category condition, where needed. Email traffic can include messages to a union representative or occupational health. In the ICO's example of a bank checking all email traffic for fraud, “As well as a lawful basis, the bank should identify a special category condition.”
4. A DPIA before any monitoring of email or messages. “If you are considering monitoring emails and messages, you must complete a DPIA. This is because it poses a high risk to workers' data protection rights and freedoms and is likely to capture special category data.” If you have a data protection officer, “you must seek and record their independent advice on the outcome of the DPIA before making any final decisions”, and if the DPIA “identifies high risk that you cannot reduce, you must consult the ICO before going ahead with the monitoring.” Schools can start from the DPIA for schools guide.
5. Ask staff first. “If you are planning to introduce monitoring, you should seek and document the views of your workers or their representatives (such as trade unions), unless there is a good reason not to.” If you decide not to, record why.
6. Traffic data before content. “It would be difficult to justify monitoring the content of emails and messages if monitoring network data traffic would meet your purpose.” Who sent what to whom, when, and how large the attachment was will often answer the question without anyone reading a word.
7. Practice, not only policy. On calls, the ICO says: “Workers base their expectations of privacy on practice as well as policy. So if you tolerate a number of personal calls, you cannot rely on a policy banning them to justify carrying out this type of monitoring.” The ICO says this of calls, but the same logic plainly reaches a staff team that has always sent the odd personal message from a work account. On messages it adds: “Even a ban would not entirely justify accessing the content of personal messages. You should only investigate workers who breach any ban by looking at network data first rather than content.”

None of this makes a check impossible. It makes it deliberate: a stated purpose, a basis, an assessment, and the least intrusive look that will answer the question.

The employee monitoring policy, and telling staff before any check

Transparency is a legal requirement, not a courtesy. The ICO says: “Workers have the right to be informed about the collection and use of their information, and you must tell workers about monitoring in a way that is accessible and easy to understand.” For content specifically, it says employers “must notify workers in advance, such as in relevant policy documents, if you may monitor content in exceptional circumstances”, and must not access content unless there is “a clear policy in place explaining the circumstances where such monitoring may take place”. The 2018 Regulations add a separate condition: their authority applies only if the employer has made “all reasonable efforts to inform every person who may use the telecommunication system”, which is why the notice belongs where people meet the system as well as in the staff handbook.

An employee monitoring policy that meets those tests answers, in plain words:

• What is checked: which systems (email, chat in collaboration tools, work phones, school devices), and whether the check is of traffic data, content, or both.
• Why: the purposes, in terms that match regulation 3(2) of the 2018 Regulations and the lawful basis recorded in the DPIA.
• When content may be read: the exceptional circumstances, such as a suspected crime, a data breach or IT security incident, or a safeguarding allegation, and that traffic data comes first.
• Who may authorise a check and who may see the results: a named senior role, not the line manager involved, and a short list of people with access.
• Personal use: what is allowed, in and out of work hours, and how it is actually treated, since practice can override the written rule.
• How long results are kept: the ICO sets no fixed period, so tie it to the purpose and your data retention policy.
• Staff rights: how to ask what has been collected, and how to raise a concern.

Most organisations hold this in, or alongside, the acceptable use policy, with the privacy notice for staff pointing to it. For the filtering and monitoring part, the DfE lists what schools should include: it says “Filtering and monitoring procedures should be explained in your privacy notice”, covering “what is monitored”, “why it is monitored”, “who can access alerts or reports” and “how long you keep this information”.

Investigations, allegations and checks staff are not told about

Most real checks are not standing programmes but one investigation: a complaint about a member of staff, an allegation, a suspected leak of personal data, a fraud. The tests above still apply, and a targeted check is easier to defend when it has its own short record: the purpose, who authorised it, which accounts and which dates were searched, whether traffic data or content was examined, who saw the results and when the check ended. Regulation 3(2) of the 2018 Regulations covers establishing facts and preventing or detecting crime, but only on the conditions in regulation 4.

Checks that staff are not told about at the time are another matter. The ICO's own term is used here only in quotation: “It is unlikely that you will be able to justify covert monitoring in most usual circumstances.” The guidance allows for exceptional cases where it is necessary to prevent or detect suspected criminal activity or gross misconduct and telling staff would prejudice that, and sets conditions:

• “Covert monitoring should only be authorised by senior management.”
• A DPIA must be carried out first.
• It should be strictly targeted at obtaining evidence within a set timeframe, “limited to the shortest time possible”, and stop when the investigation is complete.
• “In most circumstances, you should not use covert monitoring to capture communications that workers would reasonably expect to be private, such as personal emails.”

Sector duties can supply the reason for a targeted look, but they do not switch off the tests. In schools, Part four of Keeping children safe in education 2026, “Safeguarding concerns or allegations made about staff, including supply teachers, trainee teachers, volunteers and contractors”, sets the procedure an allegation follows, and a member of staff's work messages to a pupil may be part of the evidence. In regulated care, Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, “Safeguarding service users from abuse and improper treatment”, requires that “Systems and processes must be established and operated effectively to investigate, immediately upon becoming aware of, any allegation or evidence of such abuse.” Charities and nurseries running a disciplinary investigation follow the same ICO tests. Once messages have been gathered, using them fairly is the subject of the guide to messages in a disciplinary hearing.

Whatever data is collected can be asked for. The ICO says: “You must make the personal information you collect through monitoring available to workers if they make a subject access request (SAR), unless an exemption applies.” Its page on finding and retrieving the information adds: “You must make a reasonable and proportionate search to respond to a SAR.” Personal information in the investigation record and the results is within reach of that request, unless an exemption applies; see the subject access request policy guide.

The messages no policy can reach, and a record everyone is told about

A monitoring policy covers the organisation's own systems. The conversation an investigation most often needs is somewhere else. A deputy head and a teacher discuss a parent's complaint in a staff WhatsApp group; a nursery room leader agrees a parent's late collection by text; a charity project worker tells a manager about a disclosure in a voice note at ten at night; a senior carer sorts a medicines error with the night nurse in a group chat. Those messages sit on personal phones in an end-to-end-encrypted consumer app, which the employer cannot lawfully inspect as a matter of routine and which the app is built to keep out of the organisation's reach. The guide to WhatsApp for work under UK GDPR sets out why.

ComplyChat provides channels for work conversations that the organisation controls, with everyone added told up front that the channel is on the record, and free to object or leave at any time. That puts a clear notice in front of every member as they join, rather than in a clause added later; the staff privacy notice still has to cover the rest. A mobile number verified by SMS is the identity, so bank staff, volunteers and others with no work account can be in the channel, and messages are recorded on the server as they are sent. On paid plans, once the organisation's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription.

ComplyChat is not a monitoring tool. It does not check email, log devices or score productivity, and having a record does not make looking at it lawful: access to that record still needs the purpose, the DPIA and the clear policy this guide describes.

A question for the next leadership or board meeting: if you needed to look at a member of staff's work messages tomorrow, is there a written policy that says who may authorise it, what may be read, and where the record of the check is kept?

Questions people ask

Is monitoring staff emails allowed in the UK?

Yes, within limits. The ICO says an employer must be clear about its purpose, make sure any monitoring of emails and messages is necessary and proportionate, tell staff its purpose and complete a data protection impact assessment first, and must not access content unless a clear policy explains when that may happen. On the organisation's own system, intercepting stored email has lawful authority under the 2018 Regulations only for their listed purposes and after all reasonable efforts to tell every user.

Do employers need staff consent for monitoring?

No, and consent is usually the wrong basis. The ICO says “consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers.” Employers rely on another lawful basis, often legitimate interests or, for a public authority performing its tasks, public task, and must still tell staff what is checked and why.

What rights do employees have over monitoring at work?

Employees have the right to be told about monitoring “in a way that is accessible and easy to understand”, and to see what was collected about them through a subject access request, under the ICO's guidance. The ICO also expects employers to seek the views of staff or their representatives before introducing monitoring. Article 8 of the European Convention on Human Rights, given effect by the Human Rights Act 1998, protects private life at work against public authorities such as maintained schools, and section 8 of the Investigatory Powers Act 2016 lets the sender or recipient sue where the organisation controlling a private system intercepts a message without lawful authority.

Is it legal to use CCTV on staff in the UK?

It can be, but the ICO says continuous video or audio monitoring of workers is likely to be justified only “in rare circumstances”. An employer considering it must complete a DPIA and tell staff the extent, nature and reason for it, and should confine cameras to areas of particular risk where expectations of privacy are low.

Can my employer read my personal messages on a work device?

Rarely. The ICO says that even a ban on personal use “would not entirely justify accessing the content of personal messages”, and that a suspected breach of a ban should be investigated by looking at network data first rather than content. Separately, it says employers “should not routinely monitor personal calls”.

How can staff find out what monitoring their employer does?

Staff should already have been told: the ICO says employers “must tell workers about monitoring in a way that is accessible and easy to understand”, usually in the staff privacy notice and a monitoring or acceptable use policy. A member of staff can also make a subject access request for personal information collected through monitoring, which the employer must provide unless an exemption applies.

Is monitoring staff without telling them ever lawful?

Only exceptionally. The ICO says it is unlikely to be justified “in most usual circumstances”, and may be justified only where, for example, it is necessary to prevent or detect suspected criminal activity or gross misconduct and telling staff would prejudice that. It should be authorised by senior management, follow a DPIA, be strictly targeted and last the shortest time possible.

Official guidance and your next step

The ICO's guidance on monitoring workers runs to six pages; the three this guide quotes are the introduction to the monitoring workers guidance, Data protection and monitoring workers and Specific data protection considerations for different ways or methods of monitoring workers, all under review after the Data (Use and Access) Act. The interception rules are in sections 3, 4, 6 and 8 of the Investigatory Powers Act 2016 and regulations 3 and 4 of SI 2018/356. Schools should also read the DfE's Data protection in schools: data protection policies and procedures. Quotations are from those pages as published on 28 October 2026.

UK GDPR and the Investigatory Powers Act apply across the UK; the DfE guidance, KCSIE and the care regulations cited apply in England. In Northern Ireland, the ICO also lists section 75 of the Northern Ireland Act 1998 among the other laws to consider. This guide is not legal advice; for a live investigation, take advice before content is read.

Then do one thing: find the document your organisation would point to if a member of staff asked tomorrow whether their work email can be read. If it does not say when content may be accessed, who decides and how staff were told, that is the policy to write first.