UK ICO Employment Practices and Data Protection: Monitoring Workers (2023) 1.13: 1.13 Collect no more than needed and review regularly to prevent function creep

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Data protection and monitoring workers – UK ICO Employment Practices and Data Protection: Monitoring Workers (2023)

• 1.10 1.10 Accountability: proportionate policies, senior ownership, DPO involvement and briefed staff
• 1.11 1.11 DPIA before high-risk monitoring, DPO advice recorded, workers informed before start, ICO consulted if high risk remains
• 1.12(a) 1.12(a) Define and document the purpose; no monitoring just in case
• 1.12(b) 1.12(b) Monitoring policies set out nature, purpose and extent, are brought to workers' attention, and match practice
• 1.12(c) 1.12(c) Use monitoring information for a new purpose only if compatible, consented or required by law
• 1.14 1.14 Accuracy: correct monitoring data, weigh challenges, and let workers see and explain results
• 1.15 1.15 Retention schedule for monitoring data, justified by business need and reviewed
• 1.16 1.16 Security of monitoring data: risk-based measures, need-to-know access, trained staff, and responsibility for processors and tools