Privacy Tools Guide

Employee monitoring has become increasingly sophisticated, with employers tracking keystrokes, screen activity, communication metadata, location data, and more. Privacy regulations like GDPR (in Europe), CCPA (in California), and similar laws worldwide give you the right to access this data. This guide walks through submitting a Subject Access Request (SAR) to obtain all monitoring information your employer holds about you.

Understanding Your Right to Access Employee Monitoring Data

The General Data Protection Regulation grants data subjects—including employees—the right to obtain confirmation whether their personal data is being processed, where, and for what purpose. You can also request a copy of this data in a commonly used electronic format. This right extends to all information employers collect through workplace monitoring tools.

Most employee monitoring software captures some combination of the following: keystroke logs, screenshot snapshots, application usage data, website visit history, email metadata, calendar entries, instant message content, file access logs, GPS location data (for company devices), and network traffic. Under GDPR Article 15, you have the right to access this entire dataset.

UK GDPR and the EU GDPR provide the strongest employee monitoring access rights. In the United States, state privacy laws like CCPA and CPRA offer similar rights for California residents, though with some exemptions for employment data. Regardless of your jurisdiction, requesting your data is always legal—employers cannot retaliate against you for exercising your privacy rights.

Preparing Your Subject Access Request

Before submitting your request, gather information about your employment that helps identify you in their systems. This includes your employee ID, department, manager’s name, office location, and device identifiers if you know them. Having this information ready speeds up the employer’s response.

Document the monitoring tools you know your employer uses. Common enterprise monitoring platforms include Microsoft Endpoint Analytics, SpectorSoft, ActivTrak, Teramind, Hubstaff, and Veriato. Mention specific tools in your request—this demonstrates your awareness of their data collection practices and encourages responses.

Check your company’s privacy policy, employee handbook, or acceptable use policy. These documents often specify what monitoring they conduct and data retention periods. Reference specific sections in your request to show you’ve done your homework and to prompt complete disclosures.

Writing Your Subject Access Request

Your request should be clear, formal, and specific. Use professional language but assert your rights firmly. Here’s a template structure:

Subject: Subject Access Request - Employee Monitoring Data
Dear [HR Department / Data Protection Officer],

I am writing to exercise my rights under [GDPR Article 15 / UK GDPR / applicable privacy law] to request access to all personal data you hold about me relating to workplace monitoring.

I request the following categories of data:
1. All keystroke logs recorded from my work devices
2. All screenshots or screen recording files
3. All application usage data and timestamps
4. All website visit history and timestamps
5. All email and instant message metadata and content
6. All calendar data and meeting notes
7. All file access and document viewing logs
8. All GPS or location data from company devices
9. All network traffic logs involving my devices
10. All analytics or reports generated about my activity

Please provide this data in a commonly used electronic format (such as CSV, JSON, or PDF).

I am employed by [Company Name] as [job title] from [start date] to present. My employee ID is [if known]. I can be reached at [your email] and [your phone].

Please confirm receipt of this request and provide the data within one calendar month as required by law. If you cannot fulfill any part of this request, please explain the legal basis for the refusal.

Sincerely,
[Your Name]
[Date]

Submitting Your Request

Send your request via email to both HR and the Data Protection Officer (DPO) if your company has one. Many organizations list their DPO contact in their privacy policy or on their website. Sending to multiple addresses ensures your request reaches the right party.

Request read receipts or delivery confirmation to establish a clear timeline. The legal deadline starts from the day the employer receives your request, not when you sent it. Keep copies of all correspondence.

If your company uses an internal HR portal or ticketing system, submit your request through official channels as well. This creates a paper trail and ensures compliance tracking within their processes.

What to Expect After Submission

Employers must respond within one month under GDPR, though they can request a two-month extension for complex requests. Expect an initial acknowledgment within the first week. If they request an extension, get the reason in writing.

The response may arrive as a compressed archive containing multiple files, a detailed report, or a written summary. Review everything carefully. Employers sometimes provide incomplete responses or claim certain data falls under exemptions.

Common employer responses include requesting identity verification, citing business confidentiality exemptions, referring you to self-service dashboards where you can view some data, or providing partial disclosure with redactions. All of these responses should include explanations of their legal basis.

Handling Incomplete or Refused Requests

If your employer refuses or provides incomplete data, respond asking for specific justifications. GDPR requires employers to explain which exemptions they claim and why. Business confidentiality and trade secrets are potential exemptions, but they must be specifically justified—not generically invoked.

If the response is inadequate, escalate within the company. Request to speak with the DPO directly. Many issues resolve at this stage when DPOs realize the request is legitimate and the response was insufficient.

For persistent problems, you can file complaints with data protection authorities. In the UK, contact the Information Commissioner’s Office (ICO). In EU countries, contact your national data protection authority. In the US, state attorneys general handle privacy law enforcement. These authorities can investigate and compel disclosure.

Using Your Data Once Received

Once you receive your monitoring data, you can analyze it to understand what your employer tracks. Look for patterns in when monitoring intensifies, which applications receive the most scrutiny, and whether any data seems inaccurate or excessive.

This data serves multiple purposes beyond curiosity. It documents potential privacy violations, supports negotiations around workplace monitoring policies, and provides evidence if you suspect discriminatory treatment. Understanding what your employer knows helps you make informed decisions about your digital behavior at work.

You can also request corrections if you find inaccurate data about yourself, and you can ask for deletion of data that exceeds legitimate business needs. These follow-up rights reinforce your initial access request.

Analyzing Your Monitoring Data

Once you receive your Subject Access Request data, systematic analysis reveals your employer’s monitoring scope:

Data Organization Steps:

  1. Create a spreadsheet to categorize all data types received (keystroke logs, screenshots, email metadata, etc.)
  2. Note the date ranges covered for each data type
  3. Identify which devices were monitored
  4. Map which applications and websites received the most recording attention
  5. Look for patterns—certain times of day, specific departments, particular activities

Pattern Analysis:

Red Flags to Document:

Technical Data Analysis Tools

For technical users, these tools help analyze received monitoring data:

CSV/Log Analysis with Python:

import pandas as pd
from collections import Counter
import json

# Load monitoring data
df = pd.read_csv('monitoring_data.csv')

# Analyze most monitored applications
app_counts = Counter(df['application'])
print("Top 10 monitored applications:")
for app, count in app_counts.most_common(10):
    print(f"{app}: {count} records")

# Temporal analysis - when most monitoring occurred
df['hour'] = pd.to_datetime(df['timestamp']).dt.hour
hourly_counts = df.groupby('hour').size()
print("Monitoring by hour of day:")
print(hourly_counts)

# Identify suspicious patterns
offline_monitoring = df[df['device_status'] == 'locked']
print(f"Monitoring while device locked: {len(offline_monitoring)} instances")

Screenshot Analysis:

Negotiating Based on Data Received

Once you understand your employer’s monitoring practices, use this information strategically:

Preparation for negotiation:

  1. Identify the most egregious or unnecessary monitoring practices
  2. Document specific examples (e.g., “Screenshot on 3/15 at 11:47 PM shows personal browsing”)
  3. Research industry standards for similar roles
  4. Compile evidence of how monitoring interferes with your work
  5. Identify financial costs to the company (e.g., admin overhead, employee turnover)

Discussion approach:

Requesting Data Deletion

GDPR Article 17 grants you the “right to be forgotten”—you can request deletion of data that:

Follow-up deletion request template:

Subject: Right to Erasure - Request to Delete Employee Monitoring Data

Dear [HR Department / Data Protection Officer],

Following my Subject Access Request dated [original date], I now request deletion of the personal data you hold about me under GDPR Article 17 (Right to Erasure).

I request deletion of all monitoring data from [date range] for the following reasons:
1. This data is no longer needed for its original purpose
2. Data retention period of [number] years exceeds legal requirements for [reason]
3. [Specific data category] was processed without my lawful consent
4. The processing serves no legitimate business interest

I understand the employer may have legitimate reasons to retain some data, but request you specify which data will be retained and the legal basis for retention of each category.

Please confirm deletion completion within one month.

Sincerely,
[Your Name]

Post-SAR Documentation Strategy

After receiving your monitoring data:

Keep organized records:

When to escalate:

Rights Beyond Access

GDPR provides additional rights beyond accessing data:

Right to rectification: Request correction of inaccurate data. If monitoring shows you working when you were on approved leave, request this be corrected in their systems.

Right to restrict processing: You can ask employers to stop monitoring specific activities while allowing others. For example: “Continue monitoring productivity metrics but stop recording keystroke logs.”

Right to data portability: Request your data in a structured, commonly used format (CSV, JSON) rather than proprietary formats that only their system can read.

Right to object: You can object to specific types of processing. For example: “I object to location monitoring because I work remotely from home.”

European cases:

US considerations:

Other regions:

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides