Employee monitoring policy template: free sample and guide

An employee monitoring policy template is a ready-made document that tells employees what the company monitors, why, how the data is used and stored, and what rights they have. Below is a free template you can copy, the clauses every version needs, the notice rules that apply in the US, UK, and EU, and a rollout plan that starts at the job offer.

TL;DR

• An employee monitoring policy is a written notice that lists what you monitor, why, who sees the data, how long you keep it, and what employees can do about it.
• Every policy needs 12 clauses: purpose, scope, methods, data collected, what is not monitored, acceptable use, personal devices, access and retention, security, employee rights, and review and acknowledgment.
• New York, Connecticut, and Delaware require written notice of electronic monitoring. Connecticut's updated law, in force since October 1, 2026, also requires notice of where monitoring happens and a written statement for new hires.
• In the UK and EU, consent is rarely the right legal basis for monitoring staff. Rely on a documented legitimate interest, run an impact assessment, and tell people first.
• Gallup found only 19% of US employees have ever been told what data is collected about their work, and just 20% strongly trust leaders to use it responsibly.
• Give the policy to new hires with the offer or onboarding pack and collect a signed acknowledgment before day one.

What is an employee monitoring policy?

An employee monitoring policy is a written document that explains which employee activities and communications the company monitors, the reasons for it, the tools used, who can see the results, how long data is kept and how employees can ask questions or raise concerns. Most companies keep it in the employee handbook and ask every employee to sign an acknowledgment.

The policy covers any monitoring that is not plain observation by a manager: email and chat review, web and app usage logs, screen captures, call recording, CCTV, badge and access logs, GPS on company vehicles, and time tracking. A template saves you from starting with a blank page, but the final version must match what your tools actually do. A policy that promises less than your software collects is worse than no policy at all.

Why do you need an employee monitoring policy?

An employee monitoring policy is needed for two reasons: several laws require written notice before you monitor, and employees trust monitoring far more when they know exactly what is collected and why. A clear policy also limits what managers can do with the data, which protects the company if a monitoring-based decision is challenged.

The trust gap is massive. Gallup's September 2026 study of 22,573 US employees found that only 20% of employees who work on a computer or device have a great deal of trust in leaders to use employee data responsibly. Just 19% said anyone at work had ever spoken to them about the data collected on their work. Comfort depends on purpose: 53% were comfortable with activity data in performance reviews and 57% with its use for staffing and scheduling.

For HR and People Ops teams, the policy does three jobs:

• Legal cover: It is the written notice that New York, Connecticut, Delaware, and Ontario require, and the transparency record UK and EU regulators expect.
• Guardrails for managers: It limits monitoring data to the stated purposes, so nobody uses keystroke logs to settle a personal dispute.
• Trust with employees: It answers the questions people ask anyway, in writing, before rumors fill the gap.

For a wider view of why monitoring has grown, see the role of employee monitoring in the remote work era.

What should an employee monitoring policy template include?

An employee monitoring policy template should include 12 clauses: purpose, scope, monitoring methods, data collected, what is not monitored, acceptable use, personal devices, data access and retention, security, employee rights, review and updates, and an acknowledgment. Most templates online stop at five or six and skip the clause that builds the most trust: what you will not monitor.

Pro tip: Write the "what is not monitored" clause first. Agreeing on the limits forces IT, Legal and HR to confirm what the tools really collect, which is the hardest part of the whole policy.

What does a sample employee monitoring policy template look like?

A sample employee monitoring policy template is a plain-language document of about two pages with fill-in fields for your company, tools, and contacts. Copy the version below, replace every item in square brackets, delete any method you do not use, and have your employment counsel review it for each country and state where you have staff.

Employee monitoring policy: [Company Name] Effective date: [date] | Policy owner: [HR or People Ops lead] | Last reviewed: [date]

1. Purpose: [Company Name] monitors the use of company systems, devices, and premises to protect company and customer data, meet our legal and contractual obligations, keep people and property safe, and support accurate payroll and scheduling. We do not use monitoring to judge anyone on data alone, and every decision that affects an employee is reviewed by a person.

2. Scope: This policy applies to all employees, contractors, interns, and temporary staff who use [Company Name] systems, devices, networks, or premises, whether they work in the office, at a client site, or remotely.

3. Monitoring methods: We may use the following methods. Each one is used only for the purpose stated next to it.

• [Email and chat on company accounts]: security and legal compliance.
• [Web and application usage on company devices]: security and software licensing.
• [Time and attendance records]: payroll and scheduling.
• [CCTV in entrances, parking areas and server rooms]: safety and security.
• [Call recording for customer-facing teams]: quality and training.
• [GPS on company vehicles during working hours]: route planning and safety.

4. Data collected: We collect [list the data points, for example sites visited, application names, active and idle time, call recordings, login times]. We do not collect [for example, keystroke content, screenshots, webcam images] unless a separate written notice says otherwise.

5. What we do not monitor: We do not monitor personal accounts, personal devices that are not enrolled in company device management, activity outside working hours, restrooms, changing rooms or break rooms, or private conversations that do not use company systems. We do not use software to infer emotions.

6. Acceptable use: Limited personal use of company devices is allowed if it does not interfere with work or break the [IT acceptable use policy]. Personal use on company systems may be captured by the methods in section 3, so employees should not expect privacy there.

7. Personal devices: Personal phones and laptops are monitored only if the employee enrolls them in [device management tool] to access work data. Enrollment covers the work profile only. We never access personal apps, photos or messages.

8. Data access and retention: Monitoring data can be accessed only by [roles, for example, IT security and HR], and by managers only through [process]. We keep monitoring data for [number] days, except where it is needed for an open investigation or a legal hold.

9. Security: Monitoring data is stored in [location or region], encrypted, and protected by role-based access. Suspected breaches are reported to [contact] and handled under our [incident response policy].

10. Employee rights: Employees can ask to see the monitoring data held about them, ask for corrections, and raise concerns with [HR contact, email]. Where local law gives further rights, such as access or objection rights under data protection law, we follow that law.

11. Investigations: Targeted monitoring of a specific person is used only when there are reasonable grounds to suspect a breach of law or policy, must be approved by [senior role], and stops when the investigation ends.

12. Review and acknowledgment: We review this policy every [12] months and whenever we add or change a monitoring method. Employees will be told about changes before they take effect and asked to acknowledge the new version.

Employee acknowledgment: I have received and read the [Company Name] employee monitoring policy dated [date]. I understand which activities may be monitored and how to raise questions. Name: [ ] | Signature: [ ] | Date: [ ]

Do employers have to tell employees they are monitored?

Employers in several places must tell employees about monitoring in writing, and in most others it is strongly advised. In the US, New York, Connecticut, and Delaware have specific notice laws, and federal wiretap law relies on consent for intercepting communications. In the UK and EU, data protection law requires clear information before monitoring begins.

New York's rule is short and strict. Under New York Civil Rights Law 52-c, an employer that monitors phone, email or internet use must give written notice to employees at hiring, get an acknowledgment and post the notice in a conspicuous place. Penalties run to $500 for a first offense, $1,000 for a second and $3,000 for each later one.

Connecticut changed its law most recently. According to Connecticut Public Act 26-73, which took effect on October 1, 2026, the notice must now name the specific places on the premises where monitoring happens, the posting must appear at those places, and every employee hired from that date must receive a written statement before starting work.

If your template was written before October 2026, update the methods clause with locations. For more on keeping policies current, see HR compliance.

What is the difference between notice, acknowledgment and consent?

Notice, acknowledgment and consent are three different things. Notice tells employees about monitoring, acknowledgment records that they received the notice, and consent is their free agreement to it. Most monitoring policies need notice and acknowledgment. Consent is needed only for specific cases, and in the UK and EU it is rarely a valid basis for monitoring staff.

In the US, consent matters most for communications. The federal wiretap rule in 18 U.S.C. 2511 allows interception where one party to the communication has given prior consent, and some states require all parties to agree before a call is recorded. That is why the acknowledgment form often includes a line about call recording.

For personal phones and laptops, ask for separate consent and limit monitoring to the work profile. Most companies do this with device management software that separates work and personal data. Remote teams raise the same questions, covered in best practices for remote employee management.

How do you roll out a monitoring policy to employees and new hires?

Rolling out a monitoring policy works best in six steps: map what your tools actually collect, run a risk check, draft from the template, brief managers, publish with an acknowledgment, and build the policy into hiring and onboarding. New hires should see the policy before day one, not in week three.

1. Map the tools: List every system that collects data on people, including settings such as screenshots or idle time. IT owns this list.
2. Run a risk check: For UK and EU staff, a data protection impact assessment is needed before high-risk monitoring such as keystroke logging, according to the UK ICO's guidance on monitoring workers. The same guidance says covert monitoring should be rare, approved by senior management and time-limited.
3. Draft from the template: Fill in the template above and delete any method you do not use. Have counsel check it for each state and country.
4. Brief managers: Explain what they can and cannot see and that monitoring data never decides an outcome on its own.
5. Publish and collect acknowledgments: Share the policy, hold a short Q&A and record every acknowledgment in your HRIS.
6. Build it into hiring: Mention monitoring in the offer letter, add the policy to the onboarding pack and collect the signature before the start date.

The hiring step is the one most teams miss. A new hire who learns about screen tracking after joining feels caught out. One who reads it next to the offer sees a company with nothing to hide. Add it to your onboarding checklist alongside the handbook and equipment forms.

What mistakes should you avoid with an employee monitoring policy?

The most common employee monitoring policy mistakes are copying a template without matching it to your tools, relying on blanket consent, setting no retention period and never reviewing the policy. Each one turns a document meant to protect the company into evidence against it.

• Copying without checking: The policy says you do not take screenshots, but the software does. Audit settings before you publish.
• Blanket consent: "By working here you consent to all monitoring" is weak in the US and usually invalid in the UK and EU.
• No retention limit: "As long as necessary" invites the question "necessary for what?" Pick a number of days for each data type.
• Monitoring off the clock: Tracking that continues after hours or on personal devices is the fastest way to lose trust.
• Emotion analysis: Under Article 5 of the EU AI Act, AI that infers emotions in the workplace has been banned since February 2, 2025, except for medical or safety reasons.
• Never reviewing it: Laws change, as Connecticut showed in 2026. Review the policy every year and whenever a tool changes.

Key takeaway: A monitoring policy protects the company only when it is accurate, specific and shared early. Match it to your tools, set limits in writing and give it to every new hire before day one.

For how AI is changing what monitoring tools can do, read the use of AI in employee monitoring.

How does the same approach apply to candidate assessments?

Candidate assessments follow the same rules as employee monitoring: tell people what is checked, limit checks to the task and let a person make the final call. Proctored skills tests are monitoring of candidates, so the notice, purpose and limits in your policy should match how you treat applicants before they join.

Testlify builds this into its assessments. Its anti-cheating and proctoring includes 20+ proctoring checks, such as full-screen enforcement, tab proctoring and webcam snapshots, applied during the test. Candidates accept an honesty agreement before they begin, and hiring teams set their own violation tolerance, so they decide how strict each test should be. Teams can choose from 3,500+ tests in the Testlify test library, and assessments run in 15+ languages.

Frequently asked questions (FAQs)