In short
Employee monitoring is an employer observing, recording or analysing what workers do at work, usually on company computers and systems. Common types include activity and website tracking, productivity analytics, screen recording, keystroke logging, email monitoring, data loss prevention and insider threat detection. In the UK it must be necessary, proportionate and transparent under data protection law.
Want help with Employee monitoring software?
We can plan it with you or do it for you. Tell us where you are up to.
Employee monitoring in plain English
Employee monitoring is any way an employer keeps track of what workers do in the course of their work. Some of it is old and familiar, such as door access logs, CCTV or vehicle tracking. Most of what people search for today is computer-based: software on work laptops and desktops that records how they are used, analyses the results and alerts someone when something looks wrong.
The ICO's guidance, Employment practices and data protection: monitoring workers (October 2023), takes a broad view. It covers both systematic monitoring and occasional monitoring of anyone who carries out work on your behalf, on your premises or elsewhere, during or outside working hours, and it applies to people working from home: the ICO is clear that monitoring a homeworker is not "household" processing outside data protection law. Among the methods it discusses are keystroke monitoring, screenshots, webcams, productivity tools and tracking internet use.
So if your organisation records information about what identifiable workers are doing, it is monitoring, and UK GDPR applies. This site focuses on computer-based monitoring with Teramind, the platform Forever Systems supplies, sets up and supports.
Types of employee monitoring
The types below are the ones buyers ask about most. Each is a feature, not a product: one platform can do several, and you should switch on only what your purpose needs.
| Type | What it records or does | Read more |
|---|---|---|
| User activity monitoring | Applications, websites, files, email, printing and other activity, building a searchable audit trail | User activity monitoring software |
| Productivity monitoring | Active and idle time, time in productive and unproductive apps, schedules and workload trends | Employee productivity monitoring |
| Screen monitoring | Live view of a screen, recorded sessions for playback, sometimes text read from the screen (OCR) | Screen monitoring software |
| Keystroke logging | What is typed, with exclusions for password fields and chosen apps | Keystroke logging software |
| Email monitoring | Email metadata and, where justified, content | Monitoring emails at work |
| Remote and hybrid monitoring | Activity on work devices away from the office, including offline periods | Remote employee monitoring |
| Insider threat detection | Behaviour rules, anomaly detection and risk scores that flag risky activity | Insider threat detection software |
| Data loss prevention | Content inspection that warns, blocks or redacts when sensitive data moves | Teramind DLP |
| AI usage monitoring | Which AI tools are used and what is shared with them | Employee AI usage monitoring |
The ICO treats some of these as more intrusive than others. It lists keystroke monitoring among its examples of high-risk processing that needs a data protection impact assessment, and it gives automatic webcam images of remote workers, used to check start times, as an example of disproportionate monitoring when less intrusive checks would do. Our employee monitoring DPIA page explains why.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
How employee monitoring software works
Almost every computer monitoring product follows the same three-part pattern. Teramind's own documentation describes it as agent, server and dashboard:
- The agent is a small program installed on each monitored computer: Windows, macOS or Linux, or a terminal server, Citrix or VMware Horizon session. It records the activity your policy allows, sends it to the server and enforces your rules on the computer. Teramind's Stealth and Standard agents can also be set to record while offline and upload when the computer reconnects.
- The server stores and analyses the data, applies behaviour rules and raises alerts. With Teramind it can be Teramind Cloud, a private cloud in your own AWS or Azure account, or an on-premises virtual machine. See deployment options.
- The dashboard is a web console where authorised people see reports, alerts, recorded sessions and investigations. Role-based access decides who sees what.
Policies sit on top of all three. They say which people and computers are monitored, which channels are recorded, at what times, what is excluded, and what happens when a rule is triggered: for example notify the user, warn them, block the action or alert an administrator. Good configuration is where most of the privacy protection comes from, which is why we spend time on it. You can read more about the Teramind agent, including the difference between visible and hidden agents.
Systematic and occasional monitoring
The ICO's guidance distinguishes two broad patterns, and the difference matters when you plan:
- Systematic monitoring: routine monitoring of all workers, or of particular groups, as part of normal operations. Examples are recording website use across the company or running productivity reports for a team. Because it affects many people continuously, you need to show it is necessary and proportionate, and tell everyone affected.
- Occasional monitoring: monitoring introduced as a short-term response to a specific need, such as a targeted investigation after a security incident, or software whose monitoring functions are not always active, such as random screenshots. It still needs a lawful basis, and it should end when the need does.
Many organisations combine the two: light, transparent systematic monitoring for security and productivity, with deeper recording switched on for a defined group or period only when a rule is triggered or an investigation is authorised. Teramind's option to record video only when a rule is broken, available from the UAM plan up, is a practical way to do that.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Why organisations monitor
The ICO's starting point is that you must be clear about your purpose before you monitor, and use the least intrusive means that achieves it. Common purposes include:
- Protecting customer, financial and personal data from being leaked, accidentally or deliberately
- Detecting insider threats, such as a departing employee copying files
- Meeting regulatory, contractual or insurer expectations for audit trails
- Understanding workload and productivity across office, hybrid and remote teams
- Investigating a specific incident with reliable evidence
- Keeping track of which AI tools staff use and what data they share with them
Write your purpose down before you choose features. It decides which plan you need, which channels to record and how long to keep the data, and it is the first thing a regulator, tribunal or worker will ask about.
Where the limits are
Monitoring that is lawful in one setting can be unlawful in another. The main limits UK employers work within are:
- Workers must normally be told about monitoring. Covert monitoring is for exceptional cases only.
- The ICO says consent is not usually appropriate at work; many employers rely on legitimate interests, backed by an assessment.
- Private communications deserve protection. Monitoring that could pick up emails to trade union representatives or occupational health captures special category data and needs an extra condition for processing.
- Monitoring people at home, or on their own devices, carries a higher privacy risk. See working from home and personal devices.
- Workers keep their rights, including subject access requests and, where you rely on legitimate interests, the right to object.
- Results used to judge performance must be fair: the ICO's example is case-management reports that ignore the reasonable adjustments some workers have.
The employee monitoring law UK hub explains the legal framework. This is general information, not legal advice; take legal advice for your situation.
Monitoring people, not just systems
Some tools with "monitoring" in their name are about something else. Remote monitoring and management (RMM) tools watch the health of computers for IT support; security tools such as endpoint protection watch for malware. Employee monitoring software is different because its subject is the person using the computer, which is why data protection law weighs so heavily on it.
There is overlap with security platforms. Microsoft Purview Insider Risk Management, for example, uses signals from Microsoft 365 to flag risky activity, while Teramind records on the endpoint itself and adds productivity analytics and screen-level evidence. Our employee monitoring software comparison sets out the differences using each vendor's own published facts. If you want to talk through which approach suits your organisation, contact us.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
What does employee monitoring software record?
It depends on the product and on how you configure it. Teramind can record applications and websites used, files, email, printing, online meetings, keystrokes and screen activity, among other channels, with each channel switched on or off by policy. You should only record what your stated purpose needs.
Is employee monitoring the same as surveillance?
The words overlap. Employee monitoring usually means tracking work activity on company systems for a defined purpose such as security or productivity. It becomes intrusive surveillance when it goes beyond what that purpose needs, records private life or is hidden without exceptional justification, which UK data protection law does not allow.
Do employers have to tell staff about monitoring?
In almost all cases, yes. The ICO expects employers to explain what monitoring happens, why, how the information is used and who sees it, normally through a monitoring policy and privacy information. Covert monitoring is reserved for exceptional cases such as suspected criminal activity or gross misconduct.
Can my employer see my screen?
If monitoring software with screen recording or live view is installed on a work computer, authorised people can see the screen. In the UK your employer should have told you this, explained why, and limited access to people who need it. Teramind can also black out applications and websites the employer has excluded from monitoring in recordings and live view.
What is the difference between systematic and occasional monitoring?
Systematic monitoring is routine monitoring of all workers or a group as part of normal operations. Occasional monitoring is introduced for a specific reason and a limited period, such as an investigation. Both need a lawful basis; systematic monitoring affects more people continuously, so proportionality and transparency matter even more.
Still have a question about Employee monitoring software?
Ask us and a member of our team will reply by email.