Table of contents
An employer’s ownership of a device or system does not remove employees’ privacy rights. Before introducing monitoring, define the purpose, assess necessity and proportionality, choose a valid legal basis and explain the processing. A signature on a broad monitoring clause is not a universal solution.
Do not default to employee consent
The EDPB’s consent guidance addresses the need for a genuine choice and the problems created by unequal power. In employment, consent may not be freely given where refusing could disadvantage the worker. Assess the appropriate basis for each activity instead of collecting one blanket consent for all HR data.
Payroll administration, access control, security monitoring and optional publicity photographs are different purposes and should be analysed separately.
Basis and guidance: EDPB: consent summary
Assess monitoring against a specific need
The EDPB’s video guidance emphasises purpose, necessity and safeguards, and warns against reuse for unexpected purposes. A camera installed for security should not silently become a general productivity tool.
Consider less intrusive alternatives, who can see the information and how long it is kept. Sensitive or biometric processing needs an additional assessment; convenience alone does not establish the necessary legal conditions.
Basis and guidance: EDPB: final video-device guidelines
Prepare a pre-launch privacy review
Bring HR, IT and the relevant privacy adviser together before enabling the tool.
- Describe the actual problem and the information needed to address it.
- Map data collected, inferred metrics, access and onward suppliers.
- Assess lawful basis, necessity and less intrusive alternatives.
- Check whether a DPIA or other consultation is required.
- Provide clear staff information before processing begins where required.
- Set retention, access restrictions and procedures for rights requests.
- Check remote-work and personal-use implications of the configuration.
- Review the vendor’s default features and disable unnecessary collection.
Check what the system really captures
Hypothetical example: a tool purchased to secure company laptops also enables screenshots and activity scoring by default. Those functions require their own assessment; the security purpose does not automatically justify them.
Test the configuration and retain the assessment and staff notice. Review proposed new uses before repurposing data for performance or disciplinary decisions. Where an investigation is necessary, assess its specific scope and safeguards rather than treating a general policy as unrestricted authority.
Primary sources and scope
Sources checked: September 26, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.
Frequently asked questions
Does an employee’s signature make all monitoring lawful?
Can security footage be reused for any HR purpose?
Prepared with AI assistance using the linked primary sources. This is not a claim of individual professional review. General information, not legal or tax advice. Editorial policy
Need tailored advice?
Book a free 30-minute consultation. Zeno coordinates independent Cyprus Bar–licensed advocates and ICPAC–licensed accountants, and sends a written scope-of-work within 24 hours.
Book free consultation