Firms are monitoring staff with ‘bossware’- is it legal?

Many employees suspect their bosses are watching them, and in many cases, they’re right. In the UK, nearly a third of employers use software to track staff behaviour or performance, the Guardian reports.

This rise in so-called “bossware” is often justified as a way to prevent employee theft, boost productivity in remote environments, or keep an eye on customer experience.

But while employers may see these as legitimate business concerns, constant surveillance isn’t without its risks. Snooping on your team can not only damage trust but also leave your business on the wrong side of GDPR compliance.

Why more firms are using bossware

Nearly a third of UK employers now use “bossware” to monitor staff, most commonly by tracking emails and web browsing. One in seven has gone further, recording employees’ screen activity.

The findings, based on a UK-wide survey of hundreds of managers by the Chartered Management Institute (CMI) and reported by The Guardian, suggest a sharp rise in digital surveillance across the workplace.

Several factors are driving the rise in workplace surveillance. For some employers, theft might be a problem, whether it’s unexplained stock shortages or missing cash. For others, the shift to remote working has made them more inclined to monitor staff from afar.

Not all motivations are based on suspicion, though. Some managers use monitoring to simply keep an eye on customer service quality, ensure regulatory compliance, or uphold health and safety standards.

The form that “bossware” takes will, of course, depend on your industry. A café manager might rely on CCTV, while an office employer is more likely to track computer use or monitor attendance by scanning passes.

Does bossware comply with GDPR?

Since monitoring staff activity involves processing personal data, GDPR rules will apply in full. Employers could argue a lawful basis under “legitimate interests,” but this only stands if the monitoring is proportionate and staff are properly informed.

In response to the findings, the Information Commissioner’s Office (ICO), speaking to the Guardian, said bosses “must make their employees aware of the nature, extent and reasons for monitoring,” warning that excessive surveillance “can undermine people’s privacy, especially if they are working from home.” The regulator added that it will “take action if necessary.”

So while employers may feel they have a valid reason to use bossware, crossing the line carries serious risks. Breaches of GDPR can cause fines, reputational damage, and even employee claims if workers feel their rights have been violated.

Bosses beware

Even if you follow the rules, using bossware has additional company culture risks. Over-monitoring your team is a surefire way to hurt morale, erode trust, and drive up staff turnover. 

It can also lead to jumping to false conclusions. For example, fewer keystrokes or less mouse activity doesn’t always mean someone isn’t working hard. 

The safest approach is to set out a clear, written policy, explain to employees what is being monitored and why, and limit tracking to what’s strictly necessary.

Ultimately, bossware is a double-edged sword. On one hand, it may stamp out concerns around theft, productivity, and compliance. But the potential fallout, from legal penalties to disengaged staff, means employers should tread carefully.