Privacy, Data and Workplace Monitoring

1. 01

   Map roles, data and purposes

   Map each processing activity before preparing notices or contracts. The map should describe what your staff and systems actually do.

   • Record the basics. For each activity, record what information enters, where it came from, whose information it is, the purpose, system, access, recipients, retention period and deletion route.
   • Flag higher risk. Mark special category data, criminal offence data, children's information, biometrics and international transfers.
   • Assign roles. A controller decides the purpose and essential means of processing. A processor acts on documented instructions. Organisations deciding purposes together may be joint controllers.
   • Why roles matter. The classification affects which notices, records, contracts and responsibilities apply to each activity.
   • Follow real journeys. Build the inventory around actual business journeys, such as recruitment, customer onboarding, marketing and supplier management.

   Checks to make

   • Build a processing inventory for each customer, worker and supplier journey.
   • Assign controller, joint controller or processor roles for every purpose.
   • Flag higher-risk data, vendors, subprocessors and international transfers.
2. 02

   Choose a lawful and limited use

   Choose and document a lawful basis before processing begins, then keep the use within what you told people.

   • Seven bases. The UK GDPR now provides seven bases, including recognised legitimate interests for specified pre-approved purposes. Ordinary legitimate interests still requires a purpose, necessity and balancing assessment.
   • Consent limits. Consent is not the default and can be difficult to rely on in employment, where workers may lack genuine choice.
   • Extra conditions. Special category and criminal offence data need an additional condition on top of the lawful basis.
   • Stay limited. Tell people clearly what the business does, collect only what is needed and apply real retention rules. Do not quietly reuse information for an incompatible purpose.

   Reassess the basis, transparency and safeguards when the purpose, data, people affected or technology changes.

   Checks to make

   • Record the lawful basis and necessity for every processing purpose.
   • Document any legitimate interests assessment and additional data condition.
   • Align privacy information, retention and deletion with the actual processing.
3. 03

   Test monitoring before turning it on

   Worker monitoring is not automatically unlawful, but you need a defined purpose, an appropriate lawful basis and the least intrusive effective method.

   • DPIA first. Screen for a data protection impact assessment before procurement. Complete one where the proposed processing is likely to create high risk.
   • High-risk features. Test home working, personal devices, private communications, health or union information, biometrics, automated decisions and overseas vendor access.
   • Tell workers. Give workers clear information before routine monitoring begins, and restrict access and retention.
   • Covert monitoring. Keep it exceptional, tightly targeted and time-limited, generally where specific criminal activity is suspected and prior notification would prejudice detection.

   A monitoring notice cannot make disproportionate surveillance lawful.

   Checks to make

   • Document the purpose, evidence and less intrusive alternatives.
   • Complete and approve DPIA screening before the tool is enabled.
   • Issue accurate notices and configure access, retention and deletion controls.
4. 04

   Operate requests, complaints and incidents

   Compliance continues after a system launches. Requests, complaints and breaches each run on their own clock.

   • Processor contracts. Put Article 28 terms, security, audit and incident duties into processor contracts, and map safeguards for international transfers.
   • Access requests. A subject access request is generally due without undue delay and within one month.
   • Complaints. Controllers must facilitate data protection complaints, acknowledge them within 30 days and respond without undue delay. Processors should forward complaints and assist the controller under their contract.
   • Breach log. Record every personal data breach and assess its risk, whether or not it turns out to be reportable.
   • Notification duties. Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a breach likely to create a risk, explaining any later notification. Notify affected people without undue delay where the likely risk is high.

   Keep complaint, subject access, grievance and breach workflows distinct so deadlines are not missed.

   Checks to make

   • Assign trained owners and maintain separate deadline registers.
   • Audit processor, subprocessor and international transfer terms.
   • Rehearse containment, risk assessment, notification and communication steps.

Related guides

Follow the connected legal decisions