CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
The French data protection authority's guidance on monitoring staff: any control device must be justified and proportionate, presented to the works council beforehand and disclosed to staff; no constant surveillance, hidden purposes or keyloggers; where cameras may and may not point, one-month retention and signage; no biometric or photo time clocks; limits on vehicle tracking outside working hours; call recording, screen capture, email and telework monitoring limits. Official guidance, not law.
CNIL Guidance on Employee Monitoring and Workplace Video Surveillance is a compliance framework from France with 10 domains and 52 controls that map to 2 other frameworks. The largest domains are Workplace video surveillance – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (10 controls), Access to premises, time clocks and biometrics – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (8 controls), General conditions for any activity-control device – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (8 controls). Every control below carries what it requires and what an assessor expects to see.
Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.
Visit cnil.frFramework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (10)
Absent or departing employee's mailbox – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::MBX-1 | MBX-1 Set in advance, in the IT charter, the rules for consulting an absent employee's mailbox |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::MBX-2 | MBX-2 On departure, warn the employee of the account closure date and then delete the nominative address |
Access to premises, time clocks and biometrics – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-1 | ACC-1 Do not use biometric or photo-taking time clocks to control working hours |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-2 | ACC-2 Do not reuse access-control logs for another purpose such as checking hours |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-3 | ACC-3 Do not track movements inside the premises or check staff representatives' movements and delegation hours |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-4 | ACC-4 Restrict access to access and time data to authorised staff with habilitations, traceability and strong authentication |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-5 | ACC-5 Keep identification data for the authorisation period, access logs three months and time-tracking data up to five years |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-6 | ACC-6 Inform the representative bodies and give each employee clear information on the access or time system |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-7 | ACC-7 Record the device in the record of processing and carry out a DPIA where risk is high, notably for biometrics |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-8 | ACC-8 Use biometric access control only as a subsidiary measure, justified, with the template held on an individual medium |
General conditions for any activity-control device – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-1 | ACT-1 Define the objective and scope of each control device and identify the risks to employees' rights before installing it |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-2 | ACT-2 Show the device is necessary: no less intrusive means, only the data, retention and access strictly required |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-3 | ACT-3 Do not place staff under constant or permanent surveillance |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-4 | ACT-4 Do not use a device for a hidden purpose other than the one declared |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-5 | ACT-5 Keystroke loggers are disproportionate for monitoring staff |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-6 | ACT-6 Submit the device to the staff representative bodies before implementation |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-7 | ACT-7 Inform the people concerned before the device is put in place |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACT-8 | ACT-8 Document the compliance analysis and re-check each device before any installation or change |
Internet, email and IT tools – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::NET-1 | NET-1 Set and communicate the tolerated personal use of IT tools and control internet and email use only for security and abuse |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::NET-2 | NET-2 Do not receive automatic copies of all staff email, and keep connection logs no more than six months |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::NET-3 | NET-3 Respect messages and files identified as personal |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::NET-4 | NET-4 Keep passwords confidential and demand them only when an absent employee's post holds indispensable information |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::NET-5 | NET-5 Consult the representative bodies, inform staff through a charter, record the processing and involve the DPO |
Listening to and recording calls – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-1 | CALL-1 Listen to or record calls only occasionally, for training, evaluation, service quality or legally provided proof, collecting only what is needed |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-2 | CALL-2 Do not record calls permanently or systematically unless a law requires it |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-3 | CALL-3 Provide lines or a cut-off for personal calls and for staff representatives |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-4 | CALL-4 Limit access to recordings to the service pursuing the purpose, with authorisations and traceability |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-5 | CALL-5 Keep recordings up to six months and analysis documents up to one year |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::CALL-6 | CALL-6 Consult the representative bodies and inform employees and callers, including the periods when employees may be recorded |
Monitoring teleworkers – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::TLW-1 | TLW-1 Do not monitor teleworkers constantly by webcam, audio, screen sharing, keyloggers or forced presence checks |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::TLW-2 | TLW-2 Do not impose cameras on in videoconferences unless background blur is available or the meeting requires it |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::TLW-3 | TLW-3 Enter teleworker monitoring in the record of processing and run a DPIA for any constant monitoring |
Screen capture and screen video coupled with call recording – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::SCR-1 | SCR-1 Do not couple screen captures with call recording |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::SCR-2 | SCR-2 Couple screen video with call recording only for training, with every listed safeguard |
Telephone usage records – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::PHN-1 | PHN-1 Mask the last four digits on call records, keep telephony data a year at most and never monitor representatives' calls |
Vehicle geolocation and telematics – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-1 | GEO-1 Use vehicle geolocation only for the purposes the CNIL recognises |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-2 | GEO-2 Do not use geolocation to check speed, to monitor continuously, for free-roaming staff, staff representatives or outside working time |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-3 | GEO-3 Let employees switch off location collection outside working time |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-4 | GEO-4 Restrict geolocation data to authorised staff and do not give clients the driver's name |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-5 | GEO-5 Secure the geolocation platform and bind its provider by contract |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-6 | GEO-6 Keep location data two months, one year for route optimisation or proof, five years for working time |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-7 | GEO-7 Inform or consult the representative bodies and inform each driver before installing geolocation |
Workplace video surveillance – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance
| Code | Title |
|---|---|
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-1 | VID-1 Install cameras only for a defined, lawful and legitimate purpose |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-10 | VID-10 Inform and consult the staff representative bodies before deciding to install cameras |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-2 | VID-2 Point cameras at entrances, exits, emergency exits, circulation routes and storage areas, not at workstations |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-3 | VID-3 Do not film break or rest areas, toilets, or union and staff representative premises |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-4 | VID-4 Secure remote viewing and do not use it to supervise work quality |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-5 | VID-5 Record sound only in particular situations, triggered by an employee |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-6 | VID-6 Limit viewing of images to authorised, trained persons and secure access |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-7 | VID-7 Set a retention period tied to the purpose, in principle not over one month, and log extractions |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-8 | VID-8 Post permanent visible signs with the required information and give full information by other means |
| cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::VID-9 | VID-9 Complete the formalities: register entry, DPO involvement, DPIA where required, prefectoral authorisation for areas open to the public |
Maps to 2 other frameworks
Coverage is not the same as your position
This page shows what CNIL Guidance on Employee Monitoring and Workplace Video Surveillance overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is CNIL Guidance on Employee Monitoring and Workplace Video Surveillance and who does it apply to?
CNIL Guidance on Employee Monitoring and Workplace Video Surveillance is a compliance framework from France with 10 domains and 52 controls. The French data protection authority's guidance on monitoring staff: any control device must be justified and proportionate, presented to the works council beforehand and disclosed to staff; no constant surveillance, hidden purposes or keyloggers; where cameras may and may not point, one-month retention and signage; no biometric or photo time clocks; limits on vehicle tracking outside working hours; call recording, screen capture, email and telework monitoring limits. Official guidance, not law. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does CNIL Guidance on Employee Monitoring and Workplace Video Surveillance actually require?
CNIL Guidance on Employee Monitoring and Workplace Video Surveillance has 52 controls organised across 10 domains. The largest domains are Workplace video surveillance – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (10 controls), Access to premises, time clocks and biometrics – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (8 controls), General conditions for any activity-control device – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of CNIL Guidance on Employee Monitoring and Workplace Video Surveillance do I already cover?
CNIL Guidance on Employee Monitoring and Workplace Video Surveillance maps to 2 other compliance frameworks. The top mapping partners are GDPR (88% coverage), ISO 27001:2022 (10% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement CNIL Guidance on Employee Monitoring and Workplace Video Surveillance?
Start your CNIL Guidance on Employee Monitoring and Workplace Video Surveillance compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CNIL Guidance on Employee Monitoring and Workplace Video Surveillance requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 52 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 844 frameworks.
Get Started Free →Free forever — no credit card required