Monitoring your staff: what the ICO says small employers must do

Plenty of small employers watch something. It might be a CCTV camera over the till, a tracker in the delivery van, a fingerprint or face scanner on the back door, or software that logs what staff do on their computers. All of that counts as monitoring workers, and the Information Commissioner's Office (ICO) has published guidance on how to do it lawfully. The government is also consulting on whether employers should have to talk to staff before bringing in monitoring technology. This post explains what is in force now, what is only proposed, and what a small business can sensibly do this week.

Monitoring is allowed, but it has rules

The ICO guidance, "Monitoring workers", is aimed at employers and applies to anyone doing work for you, whatever their contract, including gig workers. It sits under the UK GDPR and the Data Protection Act 2018. The ICO says on the page that the guidance is under review because of the Data (Use and Access) Act, so details may change. Check the ICO page before you rely on any wording here.

The ICO uses three signal words. Must means a legal requirement. Should means good practice that the ICO expects you to follow unless you have a good reason, and if you do something different you need to be able to show it still complies. Could means an option.

What you must do

Several points are firm requirements:

• You must identify a lawful basis for the monitoring. The ICO says consent is usually a poor choice in employment because workers are likely to feel they have no choice but to agree. For most small firms the realistic basis is legitimate interests.
• Legitimate interests needs a three part test: a clear purpose, proof the monitoring is necessary for that purpose, and a balance against the rights of your workers. Write down the outcome.
• You must tell workers about monitoring in a way that is accessible and easy to understand, apart from very exceptional covert cases. Keep that information up to date and tell people when it changes.
• You must not collect more information than you need, and you must not keep it longer than necessary. The ICO warns against monitoring "just in case" and against reusing the data for unrelated purposes, such as performance management, without a compatible reason.
• If a worker makes a subject access request, you must make the personal information you collected through monitoring available to them, unless an exemption applies.
• You must carry out a data protection impact assessment (DPIA) before any processing likely to cause high risk. The ICO's examples include biometric data, keystroke monitoring and performance related monitoring.

What the ICO says you should do

The ICO says you should carry out a DPIA even where high risk is not obvious, and record your reasons if you decide not to. You should also seek and record the views of workers or their representatives when planning monitoring, unless there is a good reason not to, and note that reason if so. A DPIA sounds heavy, but for a small business it can be a short written record: what you are monitoring, why, what less intrusive options you considered, who can see the data and how long you keep it.

The ICO's checklists add practical items. Document what personal information you process when you monitor workers. Put specific monitoring information in your privacy notice and make sure workers can easily find it. Consider data protection when you choose suppliers and when you switch on features built into work tools. For email and messages, have an acceptable use policy and remind staff of it regularly, distinguish between network data and content, and only access content in exceptional circumstances after notifying workers in advance. Have a retention policy.

Biometrics and automated decisions

If you use fingerprints or face scans for clocking in or door access, the ICO checklist expects you to document the evidence for using biometrics and why less intrusive options will not do, carry out a DPIA, and discuss the plan with workers during it. Where you rely on consent, offer an alternative method to anyone who declines. Make manual review available for workers wrongly refused access by an automatic error.

Where monitoring tools make decisions automatically, the checklist says to offer alternatives to workers who ask for human intervention, make sure any human involvement is meaningful, and check regularly that the system works as intended.

Secret monitoring

The ICO says covert monitoring is generally hard to justify. It may be considered only in exceptional cases, such as suspected criminal activity or gross misconduct. It should be authorised by senior management, backed by a DPIA and grounds for suspicion, targeted and time limited, and ended once the investigation is complete. Covert audio or video should not be used in areas where workers would reasonably expect privacy, such as toilets or changing rooms.

What is only proposed: a duty to consult

The Register reported on 4 August 2026 that the Department for Business and Trade is consulting, as part of its Make Work Pay reforms, on how employers should involve workers before introducing "workplace monitoring technology". The options include non-statutory guidance, a statutory code of practice, or a legal duty to consult recognised trade unions or elected employee representatives. The proposed definition is broad and would cover CCTV, access control, biometrics, location tracking, keystroke monitoring, productivity software and systems using automated decision-making or AI. According to the article, the consultation ran until 30 September, ministers have not chosen an approach, and no start date has been given. The article also cites ICO research that one in three UK organisations say they actively monitor digital activity, up from one in five two years earlier.

So nothing new is required of you yet. But the direction of travel is clear, and the ICO already expects you to seek workers' views, so building that habit now costs little.

What to do this week

• List everything that watches or records staff: cameras, vehicle trackers, door systems, till or EPOS logs, email and phone systems, and any software that logs activity.
• For each, write one line stating the purpose and why a lighter option would not do.
• Check your staff privacy notice mentions each one, and that staff can find it.
• Write a short DPIA for anything high risk, especially biometrics or keystroke and productivity tracking.
• Set retention periods. Delete footage and logs when you no longer need them.
• Ask your software suppliers what the tool collects and where data is stored.
• Talk to your team before adding anything new, and note what they said.

Security matters here too. Monitoring data is personal data, and it needs the same protection as customer records. The less you collect, the less there is to lose. If you are choosing or building systems that log activity, such as ordering platforms, tills or staff apps, our team can help you design them so they record what you need and nothing more. See our cloud and security service.