Policy
Workforce Network Monitoring Policy
This policy governs the monitoring of workforce network activity: the collection, analysis, and use of telemetry, traffic signals, and presence data generated by personnel and their devices on organization systems and networks. It exists to keep monitoring lawful, proportionate, transparent, and confined to legitimate security and compliance aims, and to place explicit limits on how monitoring signals may be used.
- Type
- Policy
- Version
- 0.1.4
- Date
- 2026-10-24
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material privacy, employment-law, framework, or monitoring-technology change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Proportionality and necessity
- 4. Lawful-basis posture and impact assessment
- 5. Transparency and notice
- 6. Conduct of monitoring
- 7. Prohibited uses
- 8. Retention and minimization
- 9. Roles and responsibilities
- 10. Oversight and assurance
- 11. Violations
- 12. Acknowledgement
- 13. Framework alignment
Frameworks it maps to
- ISO/IEC 27001:2022
- NIST CSF 2.0
- NIST Privacy Framework 1.0
- GDPR (EU)
- UK GDPR
- CSA CCM v4.1
- Article 29 Working Party Opinion 2/2017 on data processing at work (WP 249)
- UK ICO, Employment practices and data protection: Monitoring workers (June 2024)
- ILO Code of Practice on the Protection of Workers' Personal Data (1997)
- Council of Europe Recommendation CM/Rec(2015)5 (processing of personal data in the context of employment)
Related documents
- Acceptable Use Policysecurity
- Insider Risk Programme Frameworksecurity
- Logging and Monitoring Standardsecurity
- Privacy and Data Governance Policyprivacy
- Human Capital and Ethical Conduct Frameworkgovernance
- Data Retention Schedulegovernance
- Bring Your Own Device (BYOD) Policysecurity
Next
All Documents