Employee monitoring software: the questions to answer before you buy

A senior manager asks for monitoring software. Pressed on what problem it solves, the answer is usually one of three: a suspicion about one person, a nervousness about remote working in general, or a request from somebody more senior who is nervous.

Only the first of those has anything to do with software, and even then the honest route is usually a conversation.

This article covers what employee monitoring software actually measures, the duties that come before any purchase in the United Kingdom, when an impact assessment is required, the effect on trust and on the numbers you care about, and the proportionate alternatives. It names no products, and it is general information rather than legal advice.

If the real problem is that nobody can see what remote colleagues are contributing, the answer is evidence rather than surveillance. See how New Dynamics continuous feedback keeps work, goals and recognition visible without watching anyone's screen.

Our post on the remote performance review covers where that evidence comes from when you cannot see the work.

If the real requirement is hours for payroll rather than oversight, our post on time and attendance software covers the records you have to produce.

What it measures, and what it does not

Typical capabilities fall into four groups:

• Activity: active time, idle time, keystrokes, mouse movement.
• Content: applications used, websites visited, screenshots, sometimes keystroke capture.
• Location and devices: logins, device use, in some products physical location.
• Aggregate analytics: meeting load, collaboration patterns, hours worked.

None of these measures output. A person reading a long document, thinking, or talking to a customer by phone registers as idle. A person moving a mouse registers as productive. The further a role is from repetitive screen work, the less the data means.

The fourth group, aggregate analytics with no individual attribution, is the most defensible use and the one most often sold alongside the least defensible.

The ICO is specific about which methods sit at the intrusive end, noting that screenshots, browsing records and keystroke capture collect "excessive amounts of workers' personal information" and that you are "unlikely to be able to justify covert monitoring in usual circumstances".

The duties that come first

In the United Kingdom the question is not whether monitoring is allowed. The ICO states plainly that "Data protection law does not prevent you from monitoring workers, but you must do so in a way which is compliant with data protection requirements."

Five things have to be settled before a purchase order.

1. A named purpose. Written in one sentence, specific enough to test. "Visibility" is not a purpose.
2. A lawful basis. The ICO is direct: "To lawfully collect and process information from monitoring workers, you must identify a lawful basis."
3. Transparency. You "must make sure workers are aware of how and what personal information you are collecting during any monitoring". Covert monitoring is a separate and much narrower matter.
4. A balance. The guidance asks employers to "carefully balance your business interests as an employer and workers' rights and freedoms under data protection law".
5. An impact assessment where the risk is high. The ICO says you "must carry out a DPIA before undertaking any processing likely to cause high risk", and lists keystroke monitoring and biometric data among the high-risk examples.

A vendor cannot do any of this for you, and a product that promises "compliance" without asking about your purpose should be treated carefully.

What monitoring does to the thing you are measuring

Three effects are predictable enough to plan for.

People optimise for the metric. Mouse movers, scheduled emails, documents left open. The activity score rises and nothing improves.

Trust falls fastest among the people you want to keep. Strong performers read monitoring as a statement about the organisation's view of them, and they have options.

Managers stop managing. A dashboard looks like supervision, so the one-to-one that would have surfaced the real problem does not happen.

If an individual's performance is the concern, the proportionate response is a conversation, a written standard and a review date, not a product rolled out to everyone. Our post on performance reporting covers the numbers worth watching instead.

Proportionate alternatives, in order

1. Define the output. Most "visibility" problems are undefined expectations. Write down what good looks like for the role, weekly.
2. Make work visible by design. Shared boards, written updates, demos. Visibility of work beats visibility of people.
3. Use the systems you already have. Tickets closed, deals progressed, cases resolved, code shipped. These are outputs and you already own them.
4. Fix the one-to-one. Half an hour a fortnight surfaces more than any activity report.
5. Aggregate, anonymous insight, where a genuine organisational question exists, such as meeting load, with no individual attribution.
6. Targeted, time-limited monitoring where there is a specific, documented concern, with the assessment and the balance done properly.

That order matters. Most organisations that work through it never reach the sixth item.

If you are going to do it anyway

Sometimes there is a genuine reason: a regulated environment, a security investigation, a contractual duty. In that case:

• Write the policy before the pilot, and tell people what is collected, why, who sees it and for how long.
• Minimise. Collect the narrowest thing that answers the question. Screenshots are rarely it.
• Set retention and enforce it in the product rather than in a reminder.
• Restrict access to named people with a reason to look.
• Never use it as evidence in a performance process without checking it with a person, because activity data is routinely wrong about why something happened.
• Review it on a date, and switch it off if the purpose has gone.
• Give workers a route to query it, since they have rights over their own data.

Frequently asked questions

Is employee monitoring software legal in the UK?

Yes, with conditions. The ICO states that data protection law does not prevent monitoring but it must be done compliantly: identify a lawful basis, tell workers what is collected, balance your interests against their rights and freedoms, and complete an impact assessment before high-risk processing such as keystroke monitoring.

Do you have to tell employees they are being monitored?

In nearly all cases, yes. The guidance is that workers must be aware of how and what personal information is being collected during monitoring. Covert monitoring is a narrow exception for specific circumstances, not a general option, and it needs its own justification.

Does monitoring software improve productivity?

It improves activity scores. Because the measures are proxies, people adapt to them, and the usual result is more visible busyness rather than more output. Where organisations do see gains, they usually come from the clearer expectations set during the rollout rather than from the watching.

When is a data protection impact assessment needed for monitoring?

Before any processing likely to cause high risk to workers' interests. The ICO lists examples including keystroke monitoring, biometric data, monitoring that affects financial decisions, and profiling involving special category data. The assessment comes before the deployment, not after it.

What are the alternatives to monitoring remote workers?

Define the output for each role, make work visible through shared boards and written updates, use the systems that already record real outputs, and hold regular one-to-ones. If a specific individual concern exists, address it directly with a written standard and a review date.

Can monitoring data be used in a disciplinary process?

Treat it with caution. Activity data describes what a device recorded, not why, and it is frequently wrong about context. If it is used at all, check it with the person first, use it alongside other evidence, and make sure the monitoring itself was lawful, proportionate and disclosed.

Your next step: write the sentence

1. Write one sentence naming the problem you want monitoring to solve, and show it to someone who will argue with you.
2. Work down the alternatives above in order, and stop at the first one that would answer it.
3. If you still need monitoring, complete the impact assessment before the pilot, not after.
4. Set a review date and a condition for switching it off.

For the wider duties around employee data, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.

Want visibility of work rather than of people? Book a New Dynamics demo and bring the question you are trying to answer. You can also email contact@new-dynamics.com.