Keystroke logging: what the law asks at each location

What it watches

every key typed, and often mouse movement

Family

Computer

Reads as this class

for example "keystroke logging" in a practice column

• Representative stepstatutory requirementInform and consult the CSE before deciding to put the means of control in place, while the consultation can still change the decision (undertakings of 50 or more employees). (where a CSE exists) Code du travail L2312-38 al3Code du travail L2312-8 II 4Code du travail L2312-14CNIL guidance ACT-6
• Representative stepofficial guidance, not lawThe CNIL adds, for IT tools: inform or consult the representative bodies before a control device is put in place, and inform staff through a charter. (where a CSE exists) CNIL guidance NET-5 official guidance, not law
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Noticestatutory requirementNo information about an employee may be collected by a device not first brought to the employee's knowledge. Code du travail L1222-4CNIL guidance ACT-7
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Limitsofficial guidance, not lawFor outbound email scanning: transparent rules and a warning to the sender before an email is blocked. WP249 para 5.3(f) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Lawful basisstatutory requirementEvery restriction on employees' rights justified by the task and proportionate to the aim. Code du travail L1121-1
• Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
• Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
• Assessmentstatutory requirement guidance says noNo constant surveillance of staff; keystroke loggers are disproportionate; teleworkers are not watched by webcam or forced presence checks. CNIL guidance ACT-3CNIL guidance ACT-5CNIL guidance TLW-1Code du travail L1121-1
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawConnection logs no more than six months; no automatic copy of all staff email. CNIL guidance NET-2 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementA works agreement (or a conciliation committee award) before the practice starts, changes or is extended. The test is whether the device can monitor conduct or performance, not what it was bought for; a company-wide system goes to the central works council. (where a works council exists) BetrVG s 87(1) no. 6BetrVG s 80(2)BetrVG s 77(1), (2)BDSG s 26(4)
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Limitsofficial guidance, not lawFor outbound email scanning: transparent rules and a warning to the sender before an email is blocked. WP249 para 5.3(f) official guidance, not law
• Covert monitoringstatutory requirementTo uncover a crime: documented facts supporting a suspicion, necessary, and not disproportionate; blanket or suspicion-free covert measures do not meet it. The Federal Labour Court ruled against keylogging without a concrete suspicion. BDSG s 26(1) sentence 2 Federal Labour Court decision 2 AZR 681/16, named, not quoted
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Lawful basisstatutory requirementEmployee data only where necessary for the employment relationship; consent only where genuinely voluntary, in writing or electronically, with notice of the right to withdraw. BDSG s 26(1) sentence 1BDSG s 26(2)
• Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
• Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
• Assessmentstatutory requirementNecessity under s 26(1): no more data and no more intrusive processing than the employment purpose needs. BDSG s 26(1) sentence 1BDSG s 26(5)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementEquipment that also allows remote monitoring of workers only for organisational and production needs, workplace safety or asset protection, and only after an agreement with the union representation or, failing one, prior authorisation from the labour inspectorate. Workers' Statute Art. 4(1)Italian Privacy Code Art. 114Italian Privacy Code Art. 171
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Noticestatutory requirementAdequate information to workers on how the instruments are used and how checks are made, before the data is used for any employment purpose. Workers' Statute Art. 4(3)
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Limitsofficial guidance, not lawFor outbound email scanning: transparent rules and a warning to the sender before an email is blocked. WP249 para 5.3(f) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
• Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementThe works council's consent to the arrangement before it is adopted: a proposal in writing with reasons and consequences, at least one consultation meeting, then written notice of the decision and its start date. Without consent or the cantonal court's permission the decision is void if the council invokes nullity. (where a works council exists) WOR Art. 27(1)(l)WOR Art. 27(2)WOR Art. 27(4)
• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Limitsofficial guidance, not lawFor outbound email scanning: transparent rules and a warning to the sender before an email is blocked. WP249 para 5.3(f) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
• Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
• Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
• Limitsofficial guidance, not lawFor outbound email scanning: transparent rules and a warning to the sender before an email is blocked. WP249 para 5.3(f) official guidance, not law
• Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
• Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
• Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementThe Art. 13 information at collection, and tell workers about monitoring in an accessible way. UK GDPR Art. 13ICO monitoring guidance para 1.9
• Written policyofficial guidance, not lawMonitoring policies that set out the nature, purpose and extent of monitoring, brought to workers' attention and matching what happens. ICO monitoring guidance para 1.12(b) official guidance, not law
• Limitsofficial guidance, not lawContent only exceptionally, under a clear policy notified in advance; network data first. ICO monitoring guidance para 3.4(a)ICO monitoring guidance para 3.4(b)ICO monitoring guidance para 3.10 official guidance, not law
• Covert monitoringofficial guidance, not lawCovert monitoring only exceptionally, for suspected crime or gross misconduct, authorised by senior management after an assessment, tightly targeted and time-limited, never in toilets or changing rooms. ICO monitoring guidance para 1.19(a)ICO monitoring guidance para 1.19(b) Human Rights Act, Article 8, named, not quoted official guidance, not law
• Personal devicesofficial guidance, not lawWhen workers use their own devices, make sure private use is not captured. (if personal devices are monitored) ICO monitoring guidance para 3.11(c) Human Rights Act, Article 8, named, not quoted official guidance, not law
• Lawful basisstatutory requirementAn Art. 6 basis chosen for the specific purpose and documented from the start; consent rarely valid; legitimate interests with a recorded assessment. UK GDPR Art. 6ICO monitoring guidance para 1.4(a)ICO monitoring guidance para 1.4(b)ICO monitoring guidance para 1.4(d)
• Assessmentstatutory requirementAn assessment before high-risk monitoring, the DPO's advice recorded, workers told before it starts; device monitoring needs its justification documented and a less intrusive way used if one works. UK GDPR Art. 35ICO monitoring guidance para 1.11ICO monitoring guidance para 3.11(a)
• Assessmentofficial guidance, not law guidance says noWebcam capture is rarely justified; keystroke monitoring can be behavioural biometric data. ICO monitoring guidance para 3.11(c) official guidance, not law
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementA retention schedule justified by business need, reviewed, and not kept in case a use turns up. UK GDPR Art. 5ICO monitoring guidance para 1.15
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementWritten notice to each employee at least 14 days before the surveillance starts (email counts), saying the kind, how it is done, when it starts, whether continuous or intermittent, and whether for a set period or ongoing. A new starter gets it before they start. NSW WSA s 10
• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Written policystatutory requirementComputer surveillance only as a written policy on staff computer use allows, and only after the employee has been told of it in advance so they can be taken to know and understand it. NSW WSA s 12
• Places kept privatestatutory requirement not allowed hereNo surveillance of employees in a change room, toilet, shower or other bathing facility at a workplace. (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas) NSW WSA s 15
• Covert monitoringstatutory requirementNo covert surveillance of employees at work without a covert surveillance authority from a Magistrate; surveillance without the notice Part 2 asks for is covert. NSW WSA s 19NSW WSA s 22
• Covert monitoringverification requiredNo communication, publication or possession of records obtained by a device used outside the conditions of the Act. NSW SDA s 11NSW SDA s 12NSW SDA s 14
• Outside workstatutory requirement not allowed hereNo surveillance with a work surveillance device while the employee is not at work, except computer surveillance of the use of equipment or resources the employer provided or paid for. (if it runs outside work) NSW WSA s 16
• Personal devicesstatutory requirementTracking a person, or monitoring a computer they own, needs their consent; the employer's own devices rest on its possession or control. (if personal devices are monitored) NSW SDA s 9NSW SDA s 10
• Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Representative stepstatutory requirementConsult the workers in good faith about how the surveillance will be run, for at least the 14-day notice period. ACT WPA s 14
• Noticestatutory requirementWritten notice at least 14 days before the start, giving the device, the method, who is watched, the start date, continuous or intermittent, set period or open-ended, the uses of the records, and the right to be consulted. ACT WPA s 13
• Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
• Written policystatutory requirementData surveillance only under a notified policy saying how computer resources may be used, what is logged, who sees the logs, and how compliance is audited. ACT WPA s 16
• Places kept privatestatutory requirement not allowed hereNo surveillance in a toilet, change room, shower or bathing facility, parent or nursing room, prayer room, sick bay or first-aid room. (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays) ACT WPA s 41
• Covert monitoringstatutory requirementNo covert surveillance of a worker without a covert surveillance authority from the Magistrates Court. ACT WPA s 35
• Outside workstatutory requirement not allowed hereNo surveillance of a worker who is not in a workplace, except data surveillance of employer-supplied equipment and tracking that cannot be switched off. (if it runs outside work) ACT WPA s 42
• Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementDestroy or permanently de-identify records no longer needed for a purpose the Act allows. ACT WPA s 44(2)
• Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementWritten notice on hiring to every employee whose telephone, email or internet use is monitored, acknowledged by the employee in writing or electronically, and the notice posted in a conspicuous place. NY Civil Rights Law 52-c(2)(a)NY Civil Rights Law 52-c(2)(a)NY Civil Rights Law 52-c(2)(b)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementPrior written notice to every employee who may be affected, naming the types of monitoring and the specific locations on the premises where it may occur, posted conspicuously including at those locations; and a plain-language statement to each new hire before they start. (the replacement text takes effect 1 October 2026 (Public Act 26-73); before that date it is not in force) Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(1)Conn. Gen. Stat. 31-48d(b)(3)
• Covert monitoringstatutory requirementMonitoring without prior written notice only on reasonable grounds to believe employees are breaking the law or others' rights, or creating a hostile workplace, where monitoring may produce evidence. (the replacement text takes effect 1 October 2026 (Public Act 26-73); before that date it is not in force) Conn. Gen. Stat. 31-48d(b)(2)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementBefore monitoring telephone, email or internet use: an electronic notice each day the employee uses the employer's email or internet, or a one-time notice the employee acknowledges. Del. Code tit. 19 705(b)Del. Code tit. 19 705(b)(1)Del. Code tit. 19 705(b)(2)
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementAt or before collection, tell staff the categories collected, the purposes, and how long each is kept. (when you say the business meets the CCPA thresholds) CCPA 1798.130(a)(5)(C)CCPA 1798.100
• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentstatutory requirementCollection proportionate to its purpose; a risk assessment where processing presents significant risk. (when you say the business meets the CCPA thresholds) CCPA 1798.100(c)CCPA 1798.185(a)(15)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionstatutory requirementRetention periods disclosed and no longer than reasonably necessary. (when you say the business meets the CCPA thresholds) CCPA 1798.100
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• Noticestatutory requirementA copy of the written policy to every employee within 30 days of the date the policy was required, and to each new employee within 30 days of starting. (when you say 25 or more employees in Ontario on 1 January) Ontario ESA 41.1.1(3)Ontario ESA 41.1.1(4)
• Written policystatutory requirementA written electronic monitoring policy covering all employees, in place before 1 March, saying whether the employer monitors, how and in what circumstances, the purposes, and the dates it was prepared and changed; kept for three years after it ends. (when you say 25 or more employees in Ontario on 1 January) Ontario ESA 41.1.1(1)Ontario ESA 41.1.1(2) para 1Ontario ESA 41.1.1(2) para 1 iOntario ESA 41.1.1(2) para 1 iiOntario ESA 15(8.2)
• Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
• Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

• 1 Representative step before start not recorded
• 2 Notice not recorded, or its period not met
• 3 Written policy not recorded where the law asks for one
• 4 Covert monitoring
• 5 Monitoring a place the law keeps private
• 6 Monitoring outside work
• 10 Continuous, keystroke or screenshot monitoring with no assessment recorded
• 11 Retention not set, or above the period you set
• 12 Personal devices monitored
• 13 Lawful basis not recorded for an EU or UK line

The example "keystroke logging" in a practice column reads as this class. Words are matched whole.

See the specimen plan run Plan your own list