Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Monitoring workers — CCTV, keystroke logging, email and internet monitoring, GPS tracking of vehicles or devices, screen-recording productivity software, or biometric access control — is lawful in the UK, but it is not exempt from data protection law simply because it happens at work. The ICO’s guidance on monitoring workers treats employee monitoring data as personal data subject to full UK GDPR obligations: employers need a lawful basis (usually legitimate interests, which requires a documented balancing test), must generally carry out a Data Protection Impact Assessment before introducing new or intrusive monitoring, and must tell staff clearly what is monitored, why, and how the data is used through an up-to-date monitoring policy. Covert monitoring is only justifiable in narrow circumstances, such as a genuine suspicion of criminal activity, and even then must be tightly targeted, time-limited, and independently authorised. The growth of remote and hybrid working has pushed many employers toward always-on productivity software, webcam activity checks, and AI-driven analytics tools that infer things like attentiveness or mood from keystrokes and camera feeds — the kind of profiling that carries a higher compliance bar and, in some cases, engages Article 22 UK GDPR rules on automated decision-making. Getting this wrong creates real exposure: ICO enforcement action and fines, successful employment tribunal claims where covert or disproportionate monitoring is found to breach trust and confidence, and reputational damage when staff discover surveillance they were never told about. Businesses introducing or reviewing any form of employee monitoring need to check their lawful basis, transparency, proportionality, and retention practices against current ICO expectations.
