Employee Monitoring and CCTV at Work in Ireland: What the DPC Says

Employee monitoring and CCTV at work in Ireland is governed by data protection law, and the Data Protection Commission (DPC) has published guidance that employers can follow. The headline message in the sources we read is consistent: employees have a right to privacy at work that is balanced against the employer's needs, monitoring must be necessary, legitimate and proportionate, and staff must be told about it. This guide pulls together what the DPC and Citizens Information say about CCTV, email and internet monitoring, vehicle tracking and remote-working software, with a checklist of questions for Dublin employers. If your team has not yet had data protection training, start with our guide to GDPR staff training for employers.

CCTV at work: the DPC's starting questions

The DPC's "Guidance on the use of CCTV" page (no date shown) treats CCTV footage showing identifiable people as personal data. Before installing CCTV, it asks controllers to be able to answer questions about:

• the clearly defined purpose of the system;
• the lawful basis under Article 6 GDPR;
• whether CCTV is necessary, and whether any use beyond security is proportionate;
• how recordings are stored securely; and
• how long they are kept, which should be no longer than needed for the original purpose.

It adds that a data protection impact assessment (DPIA) may be needed, particularly where the system is used for purposes beyond security, and it recommends a CCTV data protection policy that is brought to employees' attention where the cameras cover a workplace.

The DPC's fuller guidance note for data controllers (the file is labelled November 2023) goes further. It says consent is unlikely to apply to most uses of CCTV, that private controllers often rely on legitimate interests provided the interests are balanced against individuals' rights, and that necessity means more than CCTV being merely helpful, so less intrusive alternatives should be considered.

Using CCTV to monitor staff

This is where employers most often get into difficulty. The DPC's guidance note says CCTV "is not generally considered to be an appropriate tool to monitor staff attendance or performance", and that staff monitoring is justified only in very exceptional and special circumstances. It accepts that footage may sometimes be used for a different purpose, such as investigating gross misconduct, but only case by case and with necessity and proportionality shown.

A DPC case study (tagged 2022) shows the principle in practice. An employer collected CCTV footage for security and safety, as its own policy and signs said, but a manager later told an employee that the footage had been reviewed to monitor job performance. The DPC treated that as a separate purpose, incompatible with the original one, contrary to the purpose limitation principle. It also noted that the footage sat on a standalone PC with no login and no access log. The employer rewrote its policy, removed the PC, limited access to one person and agreed to review footage only after a security incident or accident.

A second case study (tagged 2023) involved an individual who complained that cameras had been installed without notice at a beauty-industry business and could record audio. The DPC advised that the vital interests basis applies only where processing is necessary to protect a person's life or mitigate a serious threat, so it could not support the CCTV. It found the employer had demonstrated a valid lawful basis under legitimate interests; the employer said it had carried out a balancing test before installation, kept footage for 20 days and had access controls in place. The page does not present a finding on notice to staff.

Signs, policy and sensitive areas

• Signs. The guidance note says notification can usually be achieved by easily read, well-lit signs in prominent positions, normally covering the purpose and the controller's identity and contact details.
• Staff notice. Citizens Information (page last edited 22 July 2026) says that if monitoring is not obvious, such as monitoring behaviour or performance, employees must be told beforehand, and that a written CCTV policy should cover who holds the footage, why, third-party sharing, how to request footage, retention and security.
• Toilets, changing rooms and break rooms. The DPC guidance note says CCTV in these areas "will likely contravene the GDPR in nearly all circumstances".
• Covert recording. The DPC says covert surveillance is normally only permitted on an exceptional case-by-case basis, with a specific written policy, a tight focus and a short duration. Citizens Information says secret monitoring is generally prohibited and allowed only in exceptional cases linked to criminal investigations.

Retention, security and access requests

On retention, the DPC guidance note says that for a normal security system it would be difficult to justify keeping footage beyond one month, with incident footage isolated and kept longer where needed. On security, it recommends avoiding generic or shared passwords and using access logs and restricted access. On access requests, it says controllers must normally respond within one month, should not delete footage once a request is received, and may pixelate or otherwise de-identify other people in the images. Our guide to data subject access requests in HR covers the wider process, including how footage requests sit alongside personnel file requests.

Email, internet, vehicles and home working

Citizens Information says employers should provide an acceptable usage policy, tell employees who is monitoring, what, how and when, and make sure monitoring is necessary, legitimate and proportionate. Its example of disproportionate monitoring is blanket reading of all emails, while automated virus scanning is likely proportionate. It says the same transparency rules apply when working from home, and that employers should disclose any software tracking keyboard and mouse activity, email, files or applications.

For vehicles, the DPC's employer vehicle tracking guidance (the PDF is labelled May 2020) says in-vehicle tracking carries a high risk of interfering with employees' privacy rights, and that "vehicle tracking should not be used for the general monitoring of staff". The introductory page does not set out the detailed conditions, so read the full note if you track vehicles. Citizens Information's surveillance page does not cover GPS tracking.

A practical approach: a monitoring checklist

This is our suggestion, built on the points above rather than any extra legal rule.

• List every form of monitoring you use: cameras, email filters, device management, tracking, call recording and productivity software.
• For each one, write down the purpose, the lawful basis, why it is necessary and what less intrusive option you considered.
• Check that the policy and signs say what you actually do, and that footage is not used for a different purpose without an assessment.
• Set a retention period you can justify and a named person responsible for access.
• Decide who handles access requests and how quickly you can find the footage or logs.
• Train managers so that nobody informally reviews footage to check on staff.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Can an employer use CCTV to check staff performance?

The DPC's guidance note says CCTV is not generally considered an appropriate tool for monitoring attendance or performance and that staff monitoring is justified only in very exceptional circumstances. A DPC case study found performance review of security footage to be incompatible further use.

Do employers have to tell staff about CCTV?

Yes, in the sense that both the DPC and Citizens Information describe clear signage and bringing the CCTV policy to employees' attention. Citizens Information says employees must be told beforehand where monitoring is not obvious.

How long can CCTV footage be kept?

The DPC guidance note gives no fixed legal period but says that for a normal security system it would be difficult to justify retention beyond one month. Keep only what you can justify.

Is covert monitoring of employees allowed?

Generally not. Both sources say it is only allowed in exceptional circumstances, with a specific written policy, a limited scope and duration, and (per the DPC) a DPIA beforehand.

Policies and guidance change, so check the DPC's current pages before updating your own.