Employee monitoring is no longer limited to checking attendance or reviewing completed work. Employers can now use software to record screen activity, track location, analyse communications and assess employee behaviour, raising questions about privacy and the limits of workplace oversight.
In India, the legal position is not a simple division between practices employers can and cannot use. The purpose of monitoring, the data collected and the circumstances in which it takes place all matter.
A September 2026 analysis published by Chambers and Partners notes that India’s Digital Personal Data Protection (DPDP) Act, 2023 does not prohibit workplace monitoring. It also recognises employment-related data processing and measures to protect employers from loss or liability as legitimate uses under Section 7(i), subject to the provision’s scope.
The distinction is important as organisations expand their use of digital tools to manage employees working in offices, at home and in the field.
Where workplace monitoring meets privacy concerns
The Supreme Court’s 2017 Justice K.S. Puttaswamy (Retd.) v. Union of India judgment recognised privacy as a constitutionally protected right. However, its implications for monitoring by private-sector employers are not identical to the rules governing government surveillance.
India also notified the DPDP Rules, 2025, on 14 November 2025. The Ministry of Electronics and Information Technology has outlined a phased implementation timeline, with the Act’s core provisions scheduled to take effect 18 months after notification, in May 2027.
Until the relevant provisions take effect, organisations must assess their practices against the legal requirements currently in force. The following areas illustrate where monitoring raises questions about the boundary between business needs and personal privacy.
1. Emails and workplace messaging
Employers may have legitimate reasons to review communications on company systems, including investigating suspected data leaks, protecting confidential information and meeting compliance obligations.
The position becomes more complicated when personal accounts or private conversations are involved. Access to a company device does not automatically settle every question about an employee’s expectation of privacy.
In the US case City of Ontario v. Quon, the Supreme Court considered an employee’s privacy expectations around messages sent using a work-provided device. The case illustrates the importance of workplace policies and the circumstances surrounding monitoring, but it is not a binding precedent in India.
2. Keystrokes and active time
Some monitoring software records keystrokes, mouse activity, application use and periods of inactivity. Employers may use such tools to investigate security incidents or understand how company systems are being used.
However, activity logs do not necessarily provide a reliable picture of an employee’s contribution. A low level of keyboard activity, for example, cannot by itself establish poor performance.
Organisations should distinguish between collecting technical data for a defined purpose and using isolated metrics to make employment decisions. The legal and operational implications depend on how the information is collected and used.
3. Screenshots and screen recording
Screen-monitoring tools can capture activity on work computers, potentially exposing business documents, customer information and other material displayed during a shift.
The privacy risk increases when screenshots capture personal messages, passwords or information unrelated to the employee’s work. Monitoring policies should specify what is recorded, when recording takes place and who can access the resulting data.
In Stengart v. Loving Care Agency, Inc., a US appellate court examined an employer’s access to an employee’s password-protected personal webmail account on a company laptop. The case demonstrates why ownership of a device does not automatically resolve questions about access to private communications.
4. Browsing history and application use
Employers may log websites and applications accessed through company systems to identify security threats, restrict malicious sites and investigate potential misuse.
The purpose and scope of collection remain important. A tool intended to detect cybersecurity risks may gather information extending beyond the original objective if it records extensive browsing histories or runs continuously.
Companies should establish clear rules for monitoring work systems and limit access to collected information. Activity unrelated to the stated purpose should not automatically become material for performance reviews or disciplinary action.
5. Personal devices used for work
Bring-your-own-device arrangements create a more complicated boundary because a single phone or laptop may contain both corporate and personal information.
Employers may need to manage work accounts, protect company files or enforce security settings on devices used for business. Those requirements do not, by themselves, justify unrestricted access to personal photographs, messages or other private content.
Policies should explain which work-related information can be accessed and what happens when an employee leaves the organisation. The precise legal requirements depend on the data involved and the applicable rules.
6. GPS and location tracking
Location data can help employers manage company vehicles, coordinate field operations and respond to safety incidents. For delivery personnel and other mobile workers, it can also support operational planning.
Continuous tracking raises different concerns when it extends beyond working hours or captures an employee’s movements for reasons unrelated to the job.
Employers should define when location tracking is active, what information is retained and who can access it. The legal position depends on the circumstances, including whether the device is company-owned or personal and whether the monitoring serves a legitimate business purpose.
7. Webcams and microphones
Video calls and recorded customer interactions may be part of routine business operations. In some roles, employers may also have specific security requirements governing access to sensitive systems.
Those practices are different from continuously recording employees in their homes or activating cameras and microphones outside a clearly defined work activity.
The central questions are what the monitoring is intended to achieve, whether its scope is justified and whether employees have been informed. A general requirement to attend video meetings should not be treated as automatic permission for unrestricted audio or video surveillance.
8. CCTV in offices and other workplaces
CCTV can serve identifiable purposes, including physical security, access control and investigating incidents on company premises. Its use nevertheless raises questions about camera placement, access to recordings and how long footage is retained.
Restrooms, changing rooms and similar personal spaces present particularly serious privacy concerns. Surveillance in such areas cannot be treated as equivalent to cameras at entrances or in shared operational spaces.
India’s constitutional privacy framework provides important context, although the precise legal position depends on the circumstances and applicable laws. Employers should establish the purpose of CCTV systems and restrict access to footage.
9. Public social media activity
Public posts may come to an employer’s attention if they disclose confidential information or relate directly to workplace conduct. Organisations may also need to investigate specific allegations involving employees’ online activity.
However, public visibility does not mean every personal opinion is automatically a legitimate basis for disciplinary action. Private accounts, direct messages and restricted profiles raise separate concerns, particularly where access is sought through passwords or other intrusive methods.
Employers should assess the context of a post and the relevance of the conduct to the employment relationship before deciding whether action is warranted. The applicable legal protections vary by jurisdiction.
10. Emotion recognition and voice analytics
AI-based systems can analyse speech, facial movements and other behavioural signals. In customer service, recorded calls may also be reviewed for quality assurance or compliance.
The risks increase when employers use automated assessments to infer an employee’s emotional state, stress levels or attitude. Such outputs should not be treated as established facts about an individual without considering the system’s limitations and the context in which the data was collected.
Organisations considering these tools need to examine what information they process, how assessments are used and whether the resulting decisions can be scrutinised. The legal treatment of particular systems depends on the technology, purpose and applicable jurisdiction.
What employers need to establish before monitoring
Three considerations cut across these ten areas:
Purpose: Identify the specific business or security need before introducing a monitoring tool.
Transparency: Explain what information is collected, when monitoring occurs and who can access the data.
Scope and safeguards: Limit collection and access to what is appropriate for the stated purpose, with controls over retention and use.
Employee consent is not a universal requirement for every form of workplace data processing in India. Section 7(i) of the DPDP Act recognises certain employment-related uses, but employers should not interpret this provision as unrestricted permission to monitor every aspect of an employee’s life.
The question is no longer simply whether employers can monitor
Workplace surveillance is likely to remain part of how organisations manage security, compliance and distributed teams. The harder question is how employers demonstrate a clear reason for collecting employee data and prevent its use from extending beyond that reason.
As India’s DPDP framework moves through its implementation timeline, employers will need to review their policies alongside the provisions currently in force and those scheduled to take effect. The practical test is not whether a monitoring tool is available, but whether its use can be justified in the context of the work and the information it captures.
