UK ICO Employment Practices and Data Protection: Monitoring Workers (2023) 3.1: 3.1 Remote and home working: factor higher privacy expectations and family capture into the DPIA

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Different ways or methods of monitoring workers – UK ICO Employment Practices and Data Protection: Monitoring Workers (2023)

• 3.10 3.10 Data loss prevention and traffic monitoring: least invasive means, a DPIA, and blocking with review as an alternative
• 3.11(a) 3.11(a) Device activity monitoring: document the justification, use less intrusive means if they work, identify a basis and condition, and do a DPIA
• 3.11(b) 3.11(b) Device activity monitoring: consider discussing it with workers or representatives and inform workers, including its use in decisions
• 3.11(c) 3.11(c) Device activity monitoring: webcam capture rarely justified, keystroke logging is behavioural biometric data, and private use of own devices kept out
• 3.2 3.2 Commercial monitoring tools: settle controller and processor roles first, choose a processor with guarantees, and get enough information by contract
• 3.3(a) 3.3(a) Call monitoring: not all calls by default, itemised records first, workers told, personal calls not routinely monitored
• 3.3(b) 3.3(b) Call monitoring: tell callers the call is recorded and why
• 3.4(a) 3.4(a) Email and message monitoring: a clear, necessary purpose, workers told, and a DPIA