Short answer: tell employees what you collect and why, collect only what you need, keep it only as long as you need it, and let people see their own data. Get legal advice for your situation.
GDPR applies when you handle personal data of people in the EU or UK. Time records, activity data and screenshots are personal data, so the basic principles apply.
The five habits
- Be transparent. Write down what is recorded, why, and who can see it. Share it before tracking starts.
- Have a clear purpose. Payroll, billing and workload planning are clear. "Just in case" is not.
- Collect the minimum. If hours are enough, skip screenshots. If you need proof, use a longer interval and blur.
- Limit retention. Do not keep screenshots forever. Delete them on a schedule.
- Give people access. Employees should be able to see the data held about them.
Do a short impact check
Before you start, ask: Is there a less intrusive way to reach the same goal? Can we reduce what we collect? A short written note of your answers shows you thought it through, which regulators like to see.
Keep breaks and personal time private
Do not capture anything while people are on a break or paused. This is both good practice and the quickest way to earn trust.
Staff in several countries
Rules follow where your people live. A UK or EU employee is covered even if your company is elsewhere, so set one careful standard for everyone.
General information, not legal advice.
TrustHours keeps screenshots for 2 months on paid plans, then deletes them.
Is employee monitoring legal?