Employee Monitoring in 2026: What Global Employers Can Track

Managing a globally distributed team means monitoring questions arise constantly: can you track productivity on company devices for remote workers in Germany? Does a new performance-analytics tool require works council approval in France before it goes live? Does your IT team need 14 days' notice before running computer surveillance for employees in New South Wales? The answers depend on where your employees are, and getting them wrong exposes the company to fines, injunctions, or orders to stop monitoring.

Employee-monitoring requirements are changing across multiple jurisdictions in 2026. The UK government launched a formal consultation on workplace monitoring technologies on July 8, 2026, open until September 30, 2026. Germany and France already require works council involvement before new monitoring systems go live, and Australia is mid-reform on its Privacy Act. Employers with teams across multiple jurisdictions can no longer rely on a single global monitoring policy.

This guide covers the core legal foundations of employee monitoring compliance, a jurisdiction-by-jurisdiction breakdown of what is permitted and restricted, the works council requirements that trip up European deployments, and practical steps for building a multi-jurisdiction monitoring policy.

What employee monitoring covers

Employee privacy rights law governs a wide range of employer practices. Common forms include:

• Email and messaging monitoring: reviewing content, metadata, or communications on company systems

• Screen capture and keystroke logging: periodic or continuous capture of device activity

• Location tracking: GPS tracking of company vehicles or devices, including employee geofencing for time tracking

• Productivity software: tools measuring active time, application usage, and output metrics

• CCTV and biometric data: physical surveillance, fingerprint or facial recognition for access control

• AI-driven behavioral analytics: algorithmic tools that score performance or feed automated decisions

Legal definitions of "monitoring" differ across these categories. The EU's General Data Protection Regulation (GDPR) treats almost all of the above as personal data processing subject to its full framework. The US federal framework under the Electronic Communications Privacy Act (ECPA) gives employers broad latitude to monitor company-owned systems with a legitimate business purpose. Those different legal baselines require multi-jurisdiction employers to apply jurisdiction-specific rules rather than a single universal standard.

The legal foundations: consent, notice, and proportionality

Three requirements cut across almost every jurisdiction that regulates employee monitoring: a valid legal basis, adequate notice to employees, and proportionality between the monitoring method and the business purpose it serves.

When consent is required vs. legitimate interest

For employers maintaining global GDPR compliance, the most important principle is that employee consent is rarely the right legal basis for workplace monitoring. The European Data Protection Board (EDPB) has consistently held that employees cannot freely refuse consent given the inherent power imbalance in the employment relationship. A signed consent form is unlikely to constitute freely given consent when refusing it carries realistic employment consequences.

Legitimate interest under Article 6(1)(f) is the predominant basis for most monitoring activities, including email access logs, time-and-attendance software, CCTV, productivity tracking, and location data from company devices. It requires a documented three-part test: a specific legitimate interest, a necessity finding, and a balancing test confirming that employee privacy rights do not override the employer's interest. That test must be written down before monitoring begins.

Notification and transparency requirements

Regardless of legal basis, employees must be informed that monitoring is occurring, why it is occurring, and what is collected, before monitoring starts rather than after. The GDPR's Articles 12, 13, and 14 set this requirement. US states including Connecticut, Delaware, New York, and Maine impose specific written-notice obligations at the point of hiring or annually.

A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 before any systematic employee monitoring is deployed. No exceptions apply for smaller employers or limited-scope programs.

Jurisdiction-by-jurisdiction breakdown: what's permitted and what's restricted

The following table summarizes the key requirements across major markets. The sections below provide detail on each jurisdiction.

European Union and EEA (GDPR + Article 88 national implementations)

GDPR Article 88 allows member states to adopt more specific rules for processing employee personal data, and most have done so. GDPR sets the floor (lawful basis, transparency, data minimization, DPIA), while national law adds requirements on top.

Germany: The works council (Betriebsrat) has co-determination rights under the Betriebsverfassungsgesetz over the introduction or modification of monitoring systems. Deploying a new productivity-tracking tool without works council approval renders the monitoring legally invalid, regardless of whether the GDPR legal basis is otherwise sound. See Germany's mandatory time-tracking rules for how this applies in practice.

France: The Comité Social et Économique (CSE) must be informed and consulted before an employer introduces technology capable of monitoring employee activity. Failure to consult can result in a court order suspending the monitoring. EU time-tracking law provides the broader legislative context.

Netherlands: The Works Councils Act (WOR) gives the ondernemingsraad (works council) a consent right, not just an advisory role, over any system monitoring employee behavior or performance. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) actively checks whether this prior consent was obtained as part of enforcement investigations.

United Kingdom

The ICO's Monitoring Workers guidance under UK GDPR and the Data Protection Act 2018 closely mirrors the EU framework: employers need a valid lawful basis, a DPIA, and transparent employee notice. The UK government's July 2026 consultation is exploring options ranging from a statutory code of practice to primary legislation requiring employer consultation with worker representatives before introducing monitoring systems.

United States and other key markets

At the federal level, ECPA permits employers to monitor company-owned devices with a legitimate business purpose without requiring explicit employee consent. State law varies considerably. Connecticut, Delaware, New York, and Maine each impose specific written-notice obligations. Illinois' Biometric Information Privacy Act (BIPA) adds separate consent and disclosure requirements for biometric monitoring.

Outside the US and EU: Australia's Workplace Surveillance Act 2005 (NSW) requires 14 days' written notice before overt surveillance commences, with covert surveillance requiring a magistrate's authority. Canada's PIPEDA and substantially equivalent provincial laws require employers to identify purpose and notify employees. Brazil's Lei Geral de Proteção de Dados (LGPD), Singapore's Personal Data Protection Act (PDPA), and India's Digital Personal Data Protection Act 2023 (DPDP Act) each impose notification and lawful-basis requirements on employers monitoring workers in those countries.

Works councils and employee representation

For employers in Germany, France, or the Netherlands, works council involvement is a legal prerequisite for deploying monitoring systems, separate from and additional to GDPR compliance requirements.

Bypassing the Betriebsrat in Germany can render a monitoring arrangement legally invalid, expose the employer to injunctions, and give employees grounds to challenge employment decisions made using monitoring data that was not properly authorized. Consultation timelines vary: straightforward systems can clear in weeks, while AI-driven analytics tools may take months.

In France, the CSE must be consulted before deployment. The CSE can call in an expert at the employer's expense when a new system is sufficiently complex to warrant detailed review.

In the Netherlands, the ondernemingsraad's consent right means that if the works council withholds consent, the employer must seek approval from a cantonal court before proceeding.

Treating consultation as a post-launch formality can trigger legal challenges and force a rollback of already-deployed systems. Build works council timelines into your technology procurement plans, not into your go-live checklist.

Building a compliant global monitoring policy

A global monitoring policy needs a universal core plus jurisdiction-specific annexes addressing requirements that vary by market. Key steps:

• Audit existing monitoring tools. The audit should document what each tool collects, how often it collects data, and for what purpose. Many employers discover monitoring tools that have never been formally evaluated for compliance.

• Assign a lawful basis per jurisdiction. Legitimate interest is appropriate for most EU and UK contexts but requires a documented Legitimate Interest Assessment (LIA) for each monitoring activity.

• Draft transparent disclosures. Onboarding documentation, acceptable-use policies, and privacy notices should reflect current monitoring practices before employees start.

• Conduct DPIAs before deployment. For EU and UK monitoring, the DPIA must be completed before the system goes live. It is a legal prerequisite, not a post-implementation exercise.

• Engage works councils early. For Germany, France, and the Netherlands, consultation should begin before procurement, with timelines built into technology rollout plans.

• Address EOR workers specifically. For employees hired through an employer of record (EOR) arrangement, monitoring responsibilities should be reviewed with the EOR provider and local counsel, as notice, consultation, and data-protection obligations vary by jurisdiction and the parties' respective roles.

• Set retention and deletion policies. Monitoring data must not be retained longer than necessary for its stated purpose.

• Schedule annual reviews. The UK consultation, Maine's LD 61, Australia's Privacy Act reform, and India's DPDP Act secondary legislation are all live as of September 2026. Regulatory developments in every market where you have employees require active tracking.

Stay compliant with Deel HR

Maintaining multi-jurisdiction monitoring policies across a globally distributed workforce is a significant compliance undertaking. Deel HR, built on a human resources information system (HRIS) foundation and extended through Workforce Planning and Engage, helps HR teams centralize workforce data and HR processes for employees in multiple countries.

Deel HR supports globally distributed employers by:

• Centralizing employee records and HR workflows for a globally distributed workforce

• Supporting consistent onboarding processes and centralized employee documentation

• Connecting relevant workforce workflows while keeping employee data centralized

• Providing the foundation for HR teams to manage multi-jurisdiction people operations at scale

For EOR employees specifically, monitoring responsibilities should be reviewed with Deel and appropriate local advisers to determine how applicable monitoring notice, data-protection, and employee-representation requirements affect the proposed arrangement before any monitoring system is deployed.

Book a demo to see how Deel HR can centralize workforce data and HR workflows for globally distributed teams.