Employee Monitoring and GDPR in Ireland: Employer Rules

Last updated 28 October 2026. General information only, not legal advice.

Employers monitor staff for many reasons: protecting systems, preventing theft, managing vehicles, meeting health and safety duties or checking productivity. Under the GDPR, almost all of it involves personal data. This guide explains the rules Irish employers need to follow when monitoring employees, and what to put in place before switching any monitoring on.

Does GDPR apply to employee monitoring?

Yes. Emails, browsing history, CCTV images, vehicle location, access-card swipes, keystroke data and screen activity are all personal data when they relate to an identifiable employee. An employer that decides why and how that data is processed is a data controller, with duties under the GDPR and the Data Protection Act 2018. The DPC’s guidance Data Protection in the Workplace: Employer Guidance (April 2023) states the principle plainly: employees do not lose their privacy rights because they are employees.

For a wider view of employer obligations, see our GDPR employee data guide for Irish employers.

Step 1: Identify a lawful basis

Every monitoring activity needs a lawful basis under Article 6 GDPR, identified before it starts. The DPC guidance explains the usual options:

• Consent: generally not suitable for monitoring, because of the power imbalance between employer and employee. Where it is used, staff must be able to withdraw it easily.
• Contract: applies only to processing that is genuinely required by the employment contract itself.
• Legal obligation: can apply where the law requires the processing, but it must still be necessary.
• Legitimate interests: the most common basis. The employer identifies the interest, shows the monitoring is necessary for it and balances it against employees’ rights and freedoms. The DPC expects this balancing exercise to be written down before monitoring starts and will ask for it if a complaint is made.

If monitoring captures health or biometric information, an Article 9 condition is also needed.

Step 2: Test necessity and proportionality

Monitoring must be a proportionate response to a real risk. The DPC’s approach is to prefer prevention to detection and to use the least intrusive option available. Practical examples include blocking certain websites instead of reading browsing histories, or using automated virus scanning instead of reviewing staff emails. Citizens Information makes the same point: blanket monitoring of all emails is not proportionate.

Ask three questions. What specific problem are we solving? Would a less intrusive step solve it? Can we show the monitoring is limited in scope, time and access?

Step 3: Be transparent

Articles 12 to 14 GDPR require employers to tell staff what data is collected, why, on what legal basis, who sees it and how long it is kept. In practice that means:

• An acceptable usage policy covering email, internet and social media use, setting out the nature, extent and purpose of monitoring.
• Updated employee privacy notices.
• Clear CCTV signage and a written CCTV policy.
• Disclosure of any monitoring software used on laptops, including those used for remote working.

The DPC notes that without a clear policy employees may reasonably expect privacy at work. In Barbulescu v Romania, cited in the DPC guidance, the European Court of Human Rights said employees should be notified in advance before an employer accesses the content of their communications.

Common monitoring methods and the rules that apply

CCTV

Security purposes such as deterring theft are generally easier to justify than watching staff. The DPC guidance says cameras should not be used for purposes beyond the stated one, such as assessing performance, and gives examples of the DPC supporting CCTV installed after a documented balancing test but recommending against live monitoring of staff. Cameras should not be placed in break rooms or canteens. See our guide to CCTV and GDPR rules for Irish businesses.

The Court of Appeal decision in Doolin v Data Protection Commissioner [2022] IECA 117 is a useful warning. CCTV footage collected for security was used to discipline an employee for taking long breaks. The court found this was further processing incompatible with the stated purpose, because the employee had not been told footage could be used that way. The case was decided under the Data Protection Act 1988 rather than the GDPR, but the purpose limitation principle it applied remains central today.

Email and internet use

Employers should have an acceptable usage policy and consider less intrusive supervision first. Staff should normally be told promptly if misuse is suspected, unless there is an important reason not to.

Vehicle and GPS tracking

The DPC’s guidance Employer Vehicle Tracking (May 2020) says in-vehicle tracking carries a high risk of interfering with employees’ rights, and that tracking should not be used for general staff monitoring. Its recommendations include limiting tracking to working hours, informing staff fully, avoiding unrelated uses and offering a privacy mode where a vehicle is used for both business and personal journeys.

Monitoring software and remote working

The DPC describes keystroke logging and similar software as highly intrusive, so its use must be objectively and demonstrably justified. Installing monitoring software covertly, including on the devices of staff working from home, is generally unlawful. The same transparency and proportionality rules apply at home as in the office.

Covert surveillance

This should be avoided. The DPC treats it as acceptable only case by case, typically to prevent, detect or investigate offences and usually involving An Garda Síochána. It needs a prior written policy, a short duration and safeguards such as independent review.

Do you need a DPIA?

Often, yes. Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk to individuals. The DPC’s guidance on DPIAs lists criteria that include systematic monitoring, evaluation or scoring, location data and processing of data about vulnerable people, and notes that employees can fall into that last group because of the power imbalance. Processing that meets two or more criteria will usually need a DPIA. Systematic monitoring of staff, such as continuous tracking or monitoring software, is a typical example. Our DPIA support page explains how this works in practice.

Employee rights and AI-driven monitoring

Employees can make a data subject access request for the data held about them, including CCTV images, and the employer must respond within one month, extendable by up to two further months for complex or numerous requests. They can also object to processing based on legitimate interests. See our guide to data subject access requests.

If you use tools that score or rank employees automatically, additional rules may apply, including Article 22 GDPR on automated decision-making and the EU AI Act (Regulation (EU) 2024/1689), which restricts certain AI uses in the workplace. Take care and review the current position before deploying these tools.

Employer checklist

• List every monitoring activity and the personal data it creates.
• Record the purpose, lawful basis and legitimate interests assessment for each.
• Check whether a less intrusive method would work.
• Complete a DPIA where monitoring is systematic or high risk.
• Update policies and privacy notices and tell staff before monitoring starts.
• Restrict who can see monitoring data and set retention periods.
• Keep records and review regularly. For an overview, see our GDPR and data protection guides hub.

Need help with this?

Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495. Find out about our DPIA support.

Frequently asked questions

Can an employer monitor employee emails in Ireland?

Yes, in limited circumstances. The Data Protection Commission (DPC) accepts that employers have a legitimate interest in protecting their business, but monitoring must be necessary, proportionate and transparent. Staff should be told in advance, through an acceptable usage policy, what is monitored and why. Blanket reading of staff emails is hard to justify.

Is employee monitoring legal under GDPR?

It can be, if the employer has a lawful basis under Article 6, meets the GDPR principles in Article 5, tells staff clearly what is happening and uses the least intrusive method that achieves its aim. Monitoring that is secret, excessive or unrelated to a stated purpose is likely to breach the GDPR.

Do I need employee consent to monitor them?

Usually consent is not a suitable legal basis, because of the imbalance of power between employer and employee, and consent must be freely given and easy to withdraw. Most employers rely on legitimate interests or, where it genuinely applies, a legal obligation, and document their reasoning.

Can an employer track a company vehicle or phone with GPS?

Employers can track vehicles for legitimate purposes such as locating assets, but the DPC says in-vehicle tracking carries a high risk of interfering with employees’ privacy. It should not be used for general staff monitoring, and staff should be fully informed. A DPIA is often needed.

Can CCTV footage be used in a disciplinary process?

Only if staff were told that footage may be used for that purpose. In Doolin v Data Protection Commissioner, the Court of Appeal found that using security CCTV footage in a disciplinary process was unlawful further processing where staff had not been told. That case was decided under the Data Protection Act 1988, but the DPC’s current guidance reflects the same purpose-limitation thinking.

OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.