IT monitoring policy for employees and remote work

The employer must define specific purposes: preventing exfiltration, investigating incidents, service continuity or system protection. Statements such as ‘for any company interest’ do not allow a genuine necessity assessment.

Law No. 190/2018 sets special conditions for electronic-communications monitoring or video surveillance based on legitimate interests: justified interest, explicit information, consultation, assessment of less intrusive alternatives and proportionate storage duration.

The policy must describe tools — login logs, EDR, web filtering, DLP, business email, VPN or equipment location — without ambiguities that would surprise employees.

• each tool’s purpose and data categories;
• events triggering human review;
• authorised roles and access logging;
• retention periods and criteria for exceptions;
• external recipients, transfers and providers used;
• data subject rights and contact channel.

Continuous content monitoring, screenshots, keylogging, cameras or precise location are highly intrusive and require exceptionally strong justification. Alternatives often exist: access controls, data segregation, event-based alerts or targeted audits.

Where processing is likely to result in high risk, an impact assessment must precede implementation. Subsequent investigations must respect purpose, restricted access, evidence integrity and the right of defence.

The policy must separate professional use from private life: approved devices, accounts, updates, VPN, Wi-Fi, local storage, paper documents and incident reporting. BYOD requires special rules on containerisation and deletion of company data.

Employees must know what the company can see, when it may intervene remotely and what happens when employment ends. Technical measures must align with telework, occupational health and safety and working-time records.