When work moved out of the office, many employers reached for software to see what their people were doing. Keystroke logging, screenshots, webcam checks and activity scores, sometimes called “bossware”, promised to replace the manager’s view across the office floor.
Employee monitoring is not new, and some of it is necessary. But in remote work it raises sharper questions about trust, privacy and the law.
What the Law Says
In the United Kingdom, the Information Commissioner’s Office published guidance on monitoring workers in October 2023. Employers must tell workers about the nature, extent and reasons for any monitoring, obviously have a lawful basis for it, use the least intrusive means to achieve a clearly defined purpose and carry out a data protection impact assessment where the monitoring is high-risk.
In India, the Digital Personal Data Protection Act, 2023 allows employers to process personal data without consent for the purposes of employment, or to safeguard the employer from loss or liability, such as preventing corporate espionage or protecting trade secrets. That is a wide permission, but it is tied to those purposes.
In the United States, New York has required employers since 7 May 2022 to give new hires written notice of electronic monitoring, to have them acknowledge it and to post a notice where employees can see it.
What Employees Think
Workers are, to say the least, wary, and that matters in a remote workplace, which depends on trust more than most. In research for the ICO’s guidance, 70 per cent of the public said they would find monitoring by an employer intrusive, and 57 per cent said they would be uncomfortable taking a new job with an employer that monitored them.
Monitoring often measures the wrong thing, even as it is harder to track the right stuff (like outcomes). A team that knows it is being watched may learn to look busy rather than to be effective, and the trust that remote teams depend on can drain away.
A Proportionate Approach
Good monitoring starts with a clear purpose, above all protecting client data or meeting a regulator’s requirements, and uses the least intrusive tool that meets it. People should know what is monitored, why, and who sees the results. Measuring outcomes, not keystrokes, keeps the focus on the work.
These rules belong in writing, in the remote work policy, alongside how performance is assessed and how concerns can be raised.
The Problem: Monitoring introduced without a defined purpose creates legal exposure and erodes trust at the same time. Decide what risk it manages and whether the risk trade-off is worth it, and only thereafter choose the least intrusive tool that manages it. Monitoring should not become an end in itself.
