Short answer
A UK employer may monitor work systems, investigate suspected misconduct and use data-assisted tools only for a defined and lawful purpose, through a necessary and proportionate method, with adequate transparency, security and retention limits. Ownership of a device or network does not create an unrestricted right to read communications, record workers or reuse their data.
Covert monitoring is exceptional. It normally requires a concrete suspicion of criminal activity or serious misconduct, senior authorisation, a documented data-protection impact assessment and a narrowly targeted, time-limited operation. Monitoring in toilets or changing rooms is almost never justifiable. An employer should not access obviously private communications merely because they pass through a work system.
Automated tools may assist recruitment, allocation, performance management and discipline, but a significant decision made solely by automation triggers statutory safeguards. Health information is special-category data and requires both an ordinary lawful basis and an additional Article 9 condition. Evidence obtained covertly is not automatically unusable in an employment tribunal, but the method, reliability, disclosure and opportunity to respond can determine whether a dismissal was fair and can generate separate privacy, data-protection, discrimination or contractual claims.
Start with the full legal map
Workplace monitoring is governed principally by the UK GDPR and the . The employer must identify its purpose and lawful basis, process data fairly and transparently, minimise collection, keep it accurate and secure, limit retention and respect access, objection and other data-subject rights. Consent is usually a weak basis in employment because the power imbalance may prevent it being freely given.
Other regimes operate alongside data protection. Interception engages the and its business-monitoring regulations. Contractual trust, the Equality Act 2010 and sector rules may add limits. Public-sector employers must also act compatibly with Article 8 privacy rights.
Before deploying monitoring, record the purpose, persons affected, data fields, access, retention and alternatives. Complete a data-protection impact assessment where processing is likely to create high risk—for example keystroke capture, biometric identification, extensive profiling or monitoring that may lead to financial loss or dismissal.
Communications monitoring requires notice and proportionality
An employer can monitor business email, calls, internet use or collaboration systems for purposes such as security, quality control, regulatory compliance, preventing crime or investigating unauthorised use. It should first ask whether metadata, sampling or an alert can achieve the purpose instead of reading content continuously.
The authorise specified interception on a system controlled by the business, including monitoring to establish facts, assess standards, secure effective operation and prevent or detect crime. This is not a general monitoring licence. Regulation 4 confines interception to relevant activities and requires reasonable efforts to inform users:
“the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted”
—
An interception permitted by those regulations must still satisfy data-protection, employment and equality law. A clear policy should identify systems and purposes, what is collected, whether personal use is permitted, who receives results, retention and worker rights. A generic clause saying that “all use may be monitored” cannot make excessive or unexpected surveillance fair.
Covert monitoring is a last resort
The treats covert monitoring as exceptional. There should be reasonable grounds to suspect criminal activity or equivalent serious misconduct and a real risk that notice would frustrate detection. Senior management should authorise a defined operation after a DPIA.
Limit the people, location, system, data and duration. Keep investigators independent where possible, restrict access and use findings only for the stated investigation. Stop when the purpose is achieved and delete irrelevant material. Recording toilets, changing rooms or comparable private spaces is generally impermissible. Accessing private communications should be avoided unless exceptional facts make it strictly necessary and lawful.
For an existing recording made by a worker or third party, establish authenticity, completeness, context, lawful handling and whether others' data can be redacted. A worker's covert recording may itself be misconduct, but seriousness depends on the purpose, circumstances, subject matter and policy.
Investigations must be reasonable and even-handed
The and current ACAS investigation guidance require a fair effort to establish the facts. Evidence may include emails, access records, CCTV, telephone records, vehicle or device data and witness accounts. The investigator should collect material that supports and undermines the allegation, preserve an audit trail, keep an open mind and separate investigation from decision-making where practicable.
Workers should normally know the allegation, see the material relied on and have a meaningful chance to explain or challenge it. Searches of a person, locker or property require exceptional justification; contractual wording alone does not guarantee that a search is lawful. The employer should record how and why digital or covert evidence was obtained, check whether it has been altered or selectively extracted, and avoid drawing conclusions from ambiguous metadata without corroboration.
For unfair dismissal, the tribunal asks whether the employer genuinely believed misconduct occurred on reasonable grounds after a reasonable investigation, and whether dismissal fell within the range of reasonable responses. A data-protection breach does not automatically decide that statutory question. However, intrusive collection, failure to disclose evidence, a predetermined algorithmic result or refusal to investigate an obvious explanation may make the process unreasonable. The tribunal may admit relevant evidence despite irregular acquisition, while privacy or data-law remedies remain separately available.
Automated employment decisions after the 2025 Act
Section 80 of the replaced Article 22 of the UK GDPR with Articles 22A–22D. A decision is solely automated where there is no meaningful human involvement. It is significant if it has a legal or similarly significant effect—for example rejection from employment, dismissal, loss of pay or a decisive promotion score.
The reform permits more solely automated significant decisions than the previous framework, but it does not remove accountability. Article 22C states that safeguards must include measures that:
“enable the data subject to make representations about such decisions; ... obtain human intervention ... [and] contest such decisions”
—
The employer must also provide information about the decision. Human review must be real: the reviewer needs competence, evidence and authority to change the result, not merely approve a score. Employers should validate data, explain material factors, test errors and provide an accessible challenge route.
Special-category data remains more restricted. A solely automated significant decision involving such data normally requires explicit consent or necessity for a contract or legal authorisation together with the substantial-public-interest condition. The new “recognised legitimate interests” basis cannot support a solely automated significant decision. The require the ICO to prepare a statutory code; as at 19 July 2026 the final code is still expected later in 2026, so draft material should not be treated as settled law.
Automated tools also create equality risk. Employers should test whether criteria or proxies disadvantage protected groups, consider reasonable adjustments and accessible alternatives, and investigate unequal error rates. A supplier's assurance does not transfer the employer's legal responsibility.
Health data needs an additional legal condition
Sickness records, diagnoses, disability information, occupational-health reports and inferences about physical or mental health are special-category data. The employer needs a lawful basis under Article 6 and a condition under Article 9, often employment and social-protection law or occupational medicine. Relevant conditions in may require an appropriate policy document explaining compliance and retention.
Collect only what is necessary for the stated purpose. Managers usually need functional advice—fitness, restrictions and recommended adjustments—not an entire clinical history. Define occupational-health roles, restrict access and set retention periods. Do not reuse health data for scoring or misconduct analysis without a compatible lawful purpose and required conditions.
A solely automated significant decision based on health data attracts the stricter Article 22B route and should undergo a DPIA. Even where a tool recommends an outcome, a competent human must examine medical context, possible disability discrimination, reasonable adjustments and conflicting evidence.
Practical decision checklist
Before relying on monitored, covert, health or algorithmic evidence, ask:
- What precise purpose and lawful bases apply, including any Article 9 condition?
- Is the least intrusive method being used, and has a DPIA been completed where required?
- What did workers reasonably expect from the policy and surrounding communications?
- Is covert collection truly necessary, targeted, authorised and time-limited?
- Is the evidence authentic, complete, contextualised and lawfully retained?
- Has the worker seen the case and had a genuine chance to respond?
- Can a competent human alter an automated outcome, and are reasons available?
- Have discriminatory effects, disability adjustments and alternative explanations been tested?
Conclusion
UK law permits proportionate workplace monitoring and evidence-based investigation, not surveillance by ownership or managerial convenience. Transparency is the norm and covert monitoring the exception. Automated tools require meaningful human safeguards when decisions are significant, while health data attracts heightened conditions. A fair dismissal decision depends not only on what the evidence appears to show, but also on a reasonable investigation, reliable context, disclosure and an open-minded decision-maker.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.