Employee monitoring: the French Data Protection Agency issues a reminder on applicable rules

In a press statement on 9 July 2026, the French Data Protection Agency (CNIL) explained the rules which apply when an employer wishes to monitor its employees’ activities.

Following several fines in 2025 due to non-compliant monitoring tools, the CNIL decided to issue a reminder that any monitoring of employees’ activity (which necessarily involves the handling of personal data) must be legitimate and proportionate. While CCTV, GPS and certain IT monitoring tools may be allowed in certain circumstances, the CNIL stated that certain tools are deemed excessive such as the use of “Keylogger” software for homeworking employees.

The CNIL also insisted on the fact that the Works Council needs to be consulted and each employee informed before any such tool can be implemented.

Finally, such tools can require carrying out and documenting a data protection impact assessment (DPIA) and need to be included in the data processing register.

Advice for HR

Ensure that all employee monitoring tools are compliant both from a GDPR and labour law standpoint.