Employee monitoring under GDPR and the Polish Labour Code: what a company must do before rollout

The short answer

An employer may monitor how company computers are used if this is necessary to organize work in a way that makes full use of working time, or to ensure the proper use of the work tools provided. The employer must define the purpose, scope and method of monitoring in its internal rules, notify employees sufficiently in advance and collect only the data that this purpose requires.

In practice, what makes monitoring lawful is not the tool itself but how it is rolled out: the purpose, proportionality, transparency toward the team and a reasonably limited scope of data.

Which laws govern monitoring of employee computers

The Polish Labour Code (Kodeks pracy) expressly describes two forms of monitoring: video surveillance (art. 22²) and monitoring of work email (art. 22³). Art. 22³ § 4 extends the same rules to other forms of monitoring where their use is necessary to achieve the purposes set out in that article. Monitoring of computer activity, applications used and websites visited is usually placed in this category.

GDPR applies alongside it, because data about an employee's activity is personal data. The principles in art. 5 GDPR are particularly important: purpose limitation, data minimization and storage limitation, as well as the information obligation under art. 13.

When monitoring is permitted: the necessity test

The word “necessary” is the key to these provisions. It is not enough that monitoring would be convenient or that “everyone does it.” The company should be able to point to a specific problem and explain why it cannot be solved in a less intrusive way.

Before deciding, answer a few questions:

• What problem is monitoring meant to solve? For example, not knowing whether remote work starts at the agreed time, or paying for licenses nobody uses.
• What data is really needed for that? To assess license usage, application names and time in use are enough — document contents are not needed.
• Can the same goal be achieved in a less intrusive way? For example, with aggregated team summaries instead of detailed data on individuals.
• How long does the data need to be kept? The period should follow from the purpose, not from how much the system can store.
• Who will have access to the data? The smaller the group, the lower the risk of misuse.

Employer obligations step by step

1. Define the purpose and scope. Write down why the company is introducing monitoring, what data will be collected, on which computers and during which hours.
2. Include it in the work regulations, a collective agreement or a notice. The purpose, scope and method of monitoring must be set out in one of these documents. Companies that are not required to have work regulations do this in a notice (obwieszczenie).
3. Inform employees at least 2 weeks before launch. Use the channel customary in the company — for example email, the intranet or a meeting — ideally with confirmation that employees have read the information.
4. Written information for new hires. Before starting work, a new employee receives information about the purpose, scope and method of monitoring.
5. GDPR privacy notice. Who the data controller is, the purpose and legal basis of processing, the retention period, data recipients and the employee's rights.
6. Set the retention period and access rights. Who may view the data and after how long it is deleted.
7. Risk assessment. Systematic monitoring of employees often requires a data protection impact assessment (DPIA) — make this decision together with the data protection officer.
8. Update the record of processing activities with the new category of data.

What monitoring must not cover

The Labour Code expressly states that monitoring must not violate the confidentiality of correspondence or the employee's other personal rights. In practice, the greatest risk comes from tools that capture content instead of information about activity:

• keystroke logging (keyloggers) — captures passwords, private messages and sensitive data,
• regular screenshots or screen recordings — capture everything the employee sees, including private content,
• reading the content of emails and messaging apps,
• recording full website addresses and search queries, which can reveal information such as health details,
• camera or microphone recordings.

Such data is hard to justify under the necessity test, and storing it requires special safeguards. That is why a tool that does not have these features at all is a safer choice than one where you have to remember to turn them off.

Monitoring remote and hybrid work

The rules are the same whether the company laptop sits in the office or in the employee's home. With remote work, two points matter most:

• Monitoring covers company equipment only. Employees' personal computers and phones should not be included.
• Data collection hours. If a company laptop is sometimes used after hours, limit data collection to working hours so that private time is not recorded.

We describe what open monitoring of remote work looks like in practice in the ActiSignal use cases.

Data minimization in practice

The GDPR minimization principle is easier to apply when you separate data that describes activity from data that reveals content. The overview below is a starting point for a conversation with your legal team:

ActiSignal was designed to stay within the first four rows: it shows computer status, work sessions, active and idle time, application names and — when this feature is enabled — website domains only. It does not take screenshots, contains no keylogger and does not record window titles. We describe the details on the Security & GDPR page.

The most common mistakes when rolling out monitoring

• Launching monitoring “quietly” or without observing the two-week notice period.
• A vague purpose in the work regulations, such as “increasing efficiency,” without stating what data is collected and why.
• Collecting everything the tool offers instead of what the purpose requires.
• No retention period — data sits in the system for years.
• Evaluating employees solely on active time. Idle time does not account for meetings, phone calls or thinking work away from the computer.
• Access that is too broad — every manager can see the data, not just the people who need it.

Pre-launch checklist

• The purpose of monitoring is described specifically and can be defended under the necessity test.
• The purpose, scope and method of monitoring are set out in the work regulations, a collective agreement or a notice.
• Employees were informed at least 2 weeks before launch.
• New employees receive written information before they start work.
• The GDPR privacy notice describes the data categories, purpose, retention period and recipients.
• The scope of data excludes content: typed text, screen images and messages.
• The retention period and access rights are configured in the tool.
• A decision on a data protection impact assessment (DPIA) has been made and documented.

Well-prepared monitoring is transparent to the team and gives the company concrete answers — without conflict or legal risk. If your next step is choosing a tool, see the article How to choose employee monitoring software.