GDPR Employee Monitoring: 6 Limits and the BAG Line

Main article: Creating a record of processing activities 2026 — the overarching pillar article; every monitoring measure described here is a processing activity and needs an entry there.

Employee monitoring is not a field of law in its own right but the intersection of several sets of rules: the GDPR (legal basis under Art. 6(1), principles of processing under Art. 5, special categories of data under Art. 9), German employee data protection under § 26 BDSG, workplace co-determination, and the AI Act (Regulation (EU) 2024/1689), whose prohibitions under Art. 5 have applied since 2 February 2025. The following six limits place each monitoring measure within that framework: what to do, why — and with which source.

The BAG line in one sentence: the deeper a monitoring measure intrudes into the sphere of personality, the more specific the occasion must be — continuous screen recording (BAG 1 ABR 16/22) and the covert keylogger (BAG 2 AZR 681/16) fail the test, whereas monitoring triggered by a specific occasion and documented accordingly holds up. For the monitoring measures in sections 1 to 4 the same test criteria therefore recur: proportionality and documentation, with the specific occasion added for occasion-based measures and a reasoned suspicion added for covert ones (§ 26(1) sentence 2 BDSG). Sections 5 and 6 place a separate admissibility stage in front of that — the prohibition under the AI Act and co-determination. Where the test criteria are missing, the risk is not only the fine but also the loss of the evidence before the German labour court.

1. Requirements of § 26 BDSG

Short answer: every technical monitoring measure starts with the legal basis — in Germany, in the employment context, that is § 26 BDSG. Processing employee data is permitted only for purposes of the employment relationship and only in so far as it is proportionate; for suspicion-based processing, § 26(1) sentence 2 BDSG applies.

Alongside this, the EU framework applies unchanged. Under Art. 6(1) GDPR, processing is lawful only if at least one of six conditions is met: consent, performance of a contract or pre-contractual measures, a legal obligation, vital interests, a task carried out in the public interest, or legitimate interests — with point (f) not applying to processing carried out by public authorities in the performance of their tasks. If you base the measure on consent, you must be able to demonstrate it (Art. 7(1) GDPR); it can be withdrawn at any time, and withdrawal must be as easy as giving consent (Art. 7(3) GDPR).

If the measure captures health data, biometric data for the purpose of unique identification, trade union membership or other special categories, the general prohibition on processing under Art. 9(1) GDPR applies in addition — in which case a further legal basis from the list of exceptions in Art. 9(2) GDPR is required, for example explicit consent. Accountability under Art. 5(2) GDPR calls for evidence, not assertion.

Practitioner recommendation — record the purpose and the chosen legal basis in writing and carry out the proportionality assessment in four steps: (1) name the purpose the measure is intended to achieve; (2) suitability — does the chosen system actually contribute to that purpose; (3) necessity — which less intrusive means was examined and why is it not sufficient (for example sample-based rather than full evaluation, metadata rather than content, announced rather than covert monitoring); (4) appropriateness — depth of intrusion weighed against the purpose, with limits as to time, group of persons and categories of data. Each of the four steps belongs in the document, with a date, before the system is switched on.

2. Screen recording

Short answer: continuous recording is prohibited (BAG 1 ABR 16/22). Occasion-based and documented recording is permitted.

The difference lies in the occasion and in the documentation. For the prior data protection assessment, Art. 35(1) GDPR is decisive: where a type of processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing, a data protection impact assessment must be carried out beforehand. Art. 35(3) GDPR names as standard examples, among others, a systematic and extensive evaluation of personal aspects (profiling) producing legal effects, processing on a large scale of special categories of data under Art. 9, and systematic monitoring of a publicly accessible area on a large scale.

For screen recording this means, specifically: the more permanent and comprehensive the recording, the more likely Art. 35(1) GDPR applies — with ongoing recording of all screen content it can hardly be ruled out that special categories of data under Art. 9 GDPR will also be captured, and Art. 35(3) GDPR expressly lists processing of those on a large scale as a standard example. Narrowly limited, occasion-based recording may stay below that threshold. Practitioner recommendation: record the assessment with reasons and a date, even where it comes out against carrying out a data protection impact assessment.

Practitioner recommendation for the occasion documentation intended to support occasion-based recording: the specific occasion with a date, the purpose, the group of persons concerned, the technical scope, those authorised to evaluate the data, the start and the planned end, and the erasure period for the recordings. Without these details, proportionality can no longer be demonstrated after the event.

3. Keystroke loggers / keyloggers

Short answer: BAG 2 AZR 681/16: a covert keylogger is inadmissible, and the evidence cannot be used.

The reason lies in its design: a keylogger records every input without distinguishing between work-related and private content. Special categories of data are therefore foreseeably captured as well — and the Art. 9 limits set out in section 1 apply.

Practitioner recommendation — instead of keystroke content, capture only the event metadata the purpose requires: log-on and log-off, access to previously named files and systems, administrator actions. Add to this three determinations that should be set down in writing before the system is switched on: which role may evaluate the data, on what occasion an evaluation takes place, and after what period the logs are deleted. The erasure period belongs in the record-of-processing entry (see the section "Documentation a supervisory authority will want to see").

There is also the access side: employees can assert their rights under Art. 15 to 22 GDPR, and the Controller must respond within the period laid down in Art. 12(3) GDPR (details in the FAQ). Logging whose scope no one internally can describe in full becomes a problem at this point at the latest.

4. Scanning the content of emails

Short answer: where private use is permitted or tolerated, the nature and scope of the monitoring must be communicated under Art. 13 GDPR; content scanning without a specific occasion is not proportionate (§ 26(1) BDSG).

The test criteria from section 1 apply here as well: occasion, proportionality, written documentation of the assessment. The first step is therefore to settle the rules on private use — permitted, tolerated or prohibited — together with the date and the announcement to the workforce (practitioner recommendation). Second step: if the scanning runs through an external service provider (a security gateway, a SaaS filter), there will normally be processing on behalf of the Controller. Under Art. 28(1) GDPR you may work only with Data Processors providing sufficient guarantees of appropriate technical and organisational measures; under Art. 28(3) GDPR a contract is required which sets out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the Controller. Whether there is processing on behalf of a Controller at all must be clarified beforehand — and specifically for each processing activity by reference to the role: Controller (Art. 4 no. 7 GDPR), Data Processor (Art. 4 no. 8 GDPR) or joint controllers (Art. 26 GDPR). The contract under Art. 28(3) GDPR belongs to processing on behalf of a Controller; confusing it with joint controllership is one of the frequent errors in the record of processing activities.

Third step: the service provider belongs in the record of processing activities as a recipient — with the Third Country details and a documented safeguard if it processes outside the EU. If mailbox data is disclosed without authorisation, the notification chain under Art. 33(1) GDPR applies, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (without undue delay and, where feasible, within 72 hours of becoming aware of it, to the competent supervisory authority, with reasons where there is a delay), and, where a high risk is likely, the data subjects must also be notified under Art. 34(1) GDPR.

5. AI performance tracking

Short answer: emotion recognition in the workplace is prohibited under Art. 5(1)(f) of the AI Act (Regulation (EU) 2024/1689). Like every monitoring measure, AI-supported performance tracking needs a legal basis (section 1) and the involvement of the workforce (section 6).

The prohibition on emotion recognition in the workplace and in education institutions is set out in Art. 5(1) of Regulation (EU) 2024/1689 and has applied since 2 February 2025. The Regulation itself has applied in general since 2 August 2026; the obligations for high-risk AI systems (Chapter III, Sections 1 to 3) apply, in the version applicable since 27 July 2026, only from 2 December 2027 for systems under Art. 6(2) and Annex III and from 2 August 2028 for systems under Art. 6(1) and Annex I (Art. 113 as amended by Regulation (EU) 2026/1744). Whether a tool is covered at all is decided by the definition in Art. 3 no. 1: a machine-based system that is designed to operate with varying levels of autonomy and that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions.

If the system is not prohibited, it may be high-risk: Annex III expressly names the area of "employment, workers management and access to self-employment"; under Art. 6(2), the systems listed there are considered high-risk. The exception in Art. 6(3) (no significant risk to health, safety or fundamental rights) is excluded where the system performs profiling of natural persons. Deployers of emotion recognition systems or biometric categorisation systems must inform the persons concerned under Art. 50(3). These rules apply EU-wide, identically in Germany and Austria; supervision, by contrast, is separate: in Germany the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), in so far as no sectoral authorities are competent; as at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act, and the RTR's AI service desk is an information and advisory body without supervisory powers.

Practitioner recommendation — examine every tool in use in four steps, in writing and with a date: (1) does it fall under the definition of an AI system in Art. 3 no. 1 at all? (2) Does it recognise or infer employees' emotions — in which case it is prohibited in the workplace under Art. 5(1)(f). (3) Does it fall within the Annex III area of "employment, workers management and access to self-employment" — in which case it is considered high-risk under Art. 6(2), with the exception in Art. 6(3) excluded where there is profiling of natural persons. (4) Does the information obligation under Art. 50(3) apply? Only then do the legal basis (section 1) and co-determination (section 6) follow.

6. Works council co-determination, § 87(1) no. 6 BetrVG

Short answer: every technical monitoring system is subject to mandatory co-determination. Without the works council's consent it is inadmissible. This source is German law; the Austrian counterpart is the monitoring measure requiring consent under § 96(1) no. 3 ArbVG (monitoring measures affecting human dignity), which requires a works agreement (see the Austria section).

Practitioner recommendation — what a workable works agreement on a monitoring system should regulate: the purpose and the systems covered, the categories of data, those authorised to evaluate the data as named roles, the occasions for and the procedure of an evaluation, retention and erasure periods, involvement of the data protection officer, and a fixed review date. This list is not a statutory minimum content but a value drawn from documentation practice.

Independently of co-determination, an obligation to designate may arise: under Art. 37(1)(b) GDPR, a data protection officer must be designated where the core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale. In Germany, § 38(1) BDSG is added to this: from, as a rule, 20 persons constantly engaged in the automated processing of personal data — and irrespective of the number of persons employed where processing operations are subject to a data protection impact assessment under Art. 35 GDPR or where data is processed commercially for the purpose of transfer, anonymised transfer, or for the purposes of market or opinion research. Austria has no such numerical threshold; there the obligation to designate follows directly from Art. 37 GDPR.

Which provision applies when — Germany and Austria

Short answer: the EU framework is the same in both countries, the national superstructure is not. The following table names, for each test point, only the provision at which the examination starts — it contains no deadlines and does not replace an assessment of the individual case.

Documentation a supervisory authority will want to see

Short answer: four documents support a monitoring measure — the entry in the record of processing activities, the processing agreement where an external service provider is involved, the reference to the technical and organisational measures and, where a high risk is likely, the data protection impact assessment. Experience shows the order in which a supervisory authority examines them to be: record of processing → processing agreement → technical and organisational measures → data protection impact assessment.

The record-of-processing entry for the monitoring measure needs the same mandatory details as any other processing activity: the name and contact details of the Controller (and, where applicable, of the data protection officer), the purposes, the categories of data subjects and of personal data, the categories of recipients, Third Country transfers with safeguards, the envisaged erasure periods and a general description of the technical and organisational measures. Time recording and a vehicle fleet with GPS tracking are among the typical SME entries. The exception in Art. 30(5) GDPR applies only cumulatively — fewer than 250 employees AND no risk to the rights and freedoms of data subjects AND no regular processing AND no special categories under Art. 9 or criminal-law data — and is practically ruled out where personnel data is processed on an ongoing basis.

The reference to the technical and organisational measures in the record-of-processing entry is not a formality: no record of processing without an annex on those measures, and no separate set of measures for each processing activity — instead, a reference to the central concept of technical and organisational measures under Art. 32 GDPR. Practitioner recommendation for a monitoring system: the document on technical and organisational measures should spell out precisely those measures that limit the circle of people able to view the data — role-based access rights to the evaluation, logging of every evaluation access, separation of operation and evaluation, technically enforced erasure once the retention period expires; in the record of processing itself, the short reference suffices.

Informing employees follows directly from Art. 13 and Art. 14 GDPR. For tracking software in use, three points therefore come together: information under Art. 13 and Art. 14 GDPR, the envisaged erasure period in the record-of-processing entry (Art. 30(1) GDPR) and — as a practitioner recommendation — evaluation only by the roles named in the concept of technical and organisational measures. Also a practitioner recommendation for ongoing operation: review the entry annually and whenever something changes; in growing organisations a quarterly review has proved its worth. That is a rhythm from practice, not a statutory deadline.

What an infringement costs

Short answer: two consequences run in parallel — the evidence becomes inadmissible before the labour court, plus a GDPR fine.

The employment-law consequence — in Germany — hits first and hits where the measure had its purpose: findings from a covert, inadmissible monitoring measure cannot be used before the German labour court (BAG 2 AZR 681/16 on the covert keylogger); the CJEU standard from C-396/22 on covert recording in the workplace applies EU-wide. A dismissal based on that evidence is then left without it. This consequence is independent of the fine proceedings and can occur even where the supervisory authority is never involved.

The GDPR framework for fines has two tiers. Infringements of the principles of processing, of the conditions for consent (Art. 5, 6, 7, 9) or of the rights of the data subject (Art. 12 to 22) are subject to fines of up to EUR 20,000,000 or up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5) GDPR). For infringements of certain other obligations — among them those arising from Art. 25 to 39 — the upper limit is EUR 10,000,000 or, in the case of an undertaking, 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4) GDPR).

Prohibited AI practices are sanctioned separately: infringements of Art. 5 of the AI Act are subject to fines of up to EUR 35,000,000 or, in the case of an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(3)). In Germany, § 43(2) and (3) BDSG additionally sanctions certain infringements as administrative offences with a fine of up to EUR 50,000 — namely the incorrect handling of an access request and consumer information under § 30 BDSG. In Austria, § 62(1) DSG provides for administrative penalties of up to EUR 50,000 in so far as the act does not already constitute an offence under Art. 83 GDPR — covered is, for example, anyone who intentionally obtains unlawful access to a data processing operation.