The Information Commissioner’s Office has published fresh guidance for employers using artificial intelligence to monitor staff, warning that invasive tracking tools risk breaching data protection law if deployed without proper justification.
The regulator’s updated framework, released this week, sets out clear expectations for organisations that use AI-powered surveillance, from keystroke loggers and webcam monitoring to algorithmic shift scheduling and productivity scoring. Employers must now demonstrate that any monitoring is necessary, proportionate, and transparent to the workforce affected.
“We are seeing more businesses adopt AI monitoring tools without fully understanding their legal obligations,” said Stephen Almond, the ICO’s executive director of regulatory risk. “Automated decision-making about people’s performance or attendance carries real consequences, and the law requires a high bar for fairness.”
The guidance arrives as remote and hybrid working patterns have driven a surge in demand for digital oversight tools. A survey by the Chartered Institute of Personnel and Development found that 35 per cent of UK organisations now use some form of digital monitoring, up from 24 per cent before the pandemic. Sectors with large desk-based workforces, including financial services, call centres, and professional services, account for the bulk of adoption.
Under the new rules, employers must carry out a data protection impact assessment before deploying any AI monitoring system. Workers must be told what data is being collected, how it is used, and who has access to it. The ICO also stressed that automated decisions, such as flagging an employee for disciplinary review based on productivity algorithms, must include a meaningful human review stage.
Legal experts say the guidance raises the stakes for employers who treat AI monitoring as a simple procurement decision. “This is not about banning workplace monitoring, it is about making sure the technology serves a legitimate purpose and does not discriminate,” said Rebecca Smith, an employment law partner at a London firm. “The ICO is signalling that enforcement action will follow where companies ignore these principles.”
Industry bodies have broadly welcomed the clarity. TechUK, the trade association representing the technology sector, said the guidance struck a sensible balance between innovation and worker protection. The organisation noted that responsible AI deployment could improve workplace safety and operational efficiency when implemented correctly.
The ICO has published supporting materials alongside the guidance, including example scenarios and a self-assessment checklist for employers. The regulator plans to review compliance across several industries over the coming year, with a particular focus on sectors where monitoring practices have expanded rapidly.