Legality of Performance Monitoring Software in Remote Work: Legal Analysis and Case Laws

1. Introduction

Performance monitoring software enables employers to supervise employees working remotely through screenshots, keystroke logging, activity timers, webcam monitoring, application tracking, website histories, GPS location data, and automated productivity scores. Such technologies can help protect confidential information, measure work progress, detect cybersecurity threats, and verify compliance with legitimate workplace requirements.

However, remote monitoring raises significant legal questions concerning privacy, personal data protection, employee dignity, transparency, proportionality, and disciplinary fairness.

The central legal principle is that an employer’s authority to monitor work does not automatically confer unrestricted authority to surveil an employee’s private life. The legality of a monitoring system depends on its purpose, scope, transparency, legal basis, safeguards, and the applicable jurisdiction.

2. Legal Framework in India

A. Constitutional right to privacy

Article 21 of the Constitution protects life and personal liberty. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right, including informational privacy.

This constitutional protection is especially significant where monitoring involves government employers or State action. Its direct application to purely private employment is more complex, but constitutional privacy principles inform the broader legal understanding of surveillance and personal autonomy.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023, establishes India's framework for processing digital personal data. Section 7(i) recognises certain processing for employment-related purposes and safeguarding employers against loss or liability as a category of legitimate use.

However, this provision should not be interpreted as blanket permission for unlimited employee surveillance. The statutory scope, applicable conditions, and commencement provisions must be considered.

As of October 2026, the Act's core processing provisions are scheduled to commence on 13 May 2027 under the phased commencement framework. Consequently, organisations must distinguish between provisions already in force and those not yet commenced, while complying with currently applicable laws and rules.

C. Information Technology Act, 2000

Section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, have historically governed certain security obligations relating to sensitive personal data or information. Their application depends on the data involved and the relevant statutory position.

Unauthorised access, misuse of information, or improper handling of employee data may raise additional legal issues under applicable provisions of the Information Technology Act and other laws.

D. Employment contracts and workplace policies

Employers should establish a written monitoring policy specifying the purposes of surveillance, data collected, monitoring periods, access permissions, retention periods, and circumstances in which monitoring records may be used for disciplinary decisions.

An employee's acceptance of a general employment policy does not necessarily justify every form of intrusive monitoring.

3. Detailed Case Laws

The following decisions provide relevant legal principles. The Indian cases establish broader privacy and constitutional standards, while the European decisions offer comparative guidance on workplace surveillance. The foreign judgments are not binding precedents in India.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Facts: The litigation concerned the constitutional validity of the Aadhaar identification framework and the broader question of whether privacy is constitutionally protected.

Judgment: A nine-judge Constitution Bench unanimously recognised privacy as a fundamental right under the Constitution, particularly within Articles 14, 19, and 21.

Relevance: Remote monitoring software may collect sensitive information about an employee's habits, communications, location, and activities within the home. The judgment supports the importance of informational privacy and the need to examine intrusive State action against constitutional standards.

For government employers, indiscriminate surveillance may raise questions of legality, legitimate purpose, necessity, and proportionality.

Classification: Foundational Indian privacy authority; not a direct employee-monitoring case.

Case 2: People's Union for Civil Liberties v. Union of India (1997) 1 SCC 301

Facts: The case concerned telephone tapping and the invasion of privacy through interception of communications.

Judgment: The Supreme Court recognised that telephone conversations fall within the protection of privacy and prescribed procedural safeguards for interception under the legal framework then considered.

Relevance: Software that records remote employees' communications, captures message content, or monitors calls raises privacy concerns analogous to those arising from communication interception.

Employers should distinguish ordinary work-activity logs from the interception or recording of private communications. The latter ordinarily requires substantially stronger justification and careful legal assessment.

Classification: Indian privacy authority concerning communications; analogous to digital workplace monitoring.

Case 3: District Registrar and Collector, Hyderabad v. Canara Bank (2005) 1 SCC 496

Facts: The dispute concerned statutory powers to inspect private documents and the protection afforded to private records.

Judgment: The Supreme Court examined the importance of privacy in relation to personal documents and the limits on governmental access to private records.

Relevance: Remote monitoring systems may capture personal files, financial information, private messages, and browser activity stored on devices used for work. The judgment supports the principle that access to records must be assessed within the limits of lawful authority.

Employers should avoid treating possession of a work device as an unlimited entitlement to examine every personal file stored on it.

Classification: Indian privacy authority; analogous to access to employee records and digital files.

Case 4: Bărbulescu v. Romania (2017), European Court of Human Rights, Grand Chamber

Facts: An employee was dismissed after his employer monitored communications on a work-related messaging account and accessed their contents.

Judgment: The European Court of Human Rights found a violation of Article 8 of the European Convention on Human Rights because the domestic courts had not adequately protected the employee's privacy and correspondence.

The Court identified relevant considerations including prior notification, the extent of monitoring, legitimate reasons, the possibility of less intrusive methods, consequences for the employee, and safeguards against abuse.

Relevance: This is one of the most directly relevant comparative authorities for remote-monitoring software. Secretly recording message contents, continuously capturing screens, or inspecting personal communications without adequate justification may be disproportionately intrusive.

Classification: Direct workplace electronic-monitoring authority; persuasive comparative material, not binding in India.

Case 5: Copland v. United Kingdom (2007), European Court of Human Rights

Facts: An employee of a public educational institution was subjected to monitoring of telephone usage, emails, and internet activity without adequate prior warning.

Judgment: The Court held that the collection and storage of information about telephone, email, and internet usage interfered with the employee's right to respect for private life and correspondence. The interference was not in accordance with law in the circumstances of that case.

Relevance: The case demonstrates that monitoring metadata can itself implicate privacy. An employer does not necessarily avoid privacy obligations merely by recording websites visited, call durations, application usage, or communication times rather than message contents.

Classification: Direct workplace communications-monitoring authority; persuasive in India.

Case 6: López Ribalda and Others v. Spain (2019), European Court of Human Rights, Grand Chamber

Facts: Employees of a supermarket were subjected to covert video surveillance following suspected thefts. The recordings contributed to their dismissal.

Judgment: The Grand Chamber found no violation of Article 8 in the particular circumstances, considering the legitimate reasons for surveillance, its limited duration and scope, and the balance between employee privacy and the employer's interests.

The judgment did not establish an unrestricted right to secretly monitor employees. It emphasised the importance of assessing the circumstances and proportionality of surveillance.

Relevance: The decision illustrates that covert monitoring may be treated differently where there is a well-founded suspicion of serious misconduct and surveillance is appropriately limited. Continuous webcam surveillance of every remote employee merely to verify activity would require a separate and demanding justification.

Classification: Direct surveillance authority; comparative and fact-specific.

Case 7: Maneka Gandhi v. Union of India (1978) 1 SCC 248

Facts: The case concerned governmental action affecting personal liberty and the fairness of the procedure adopted.

Judgment: The Supreme Court developed the principle that State action affecting protected interests must satisfy applicable standards of fairness, reasonableness, and non-arbitrariness.

Relevance: Where public employers use monitoring software to generate productivity scores or initiate disciplinary action, arbitrary reliance on unexplained algorithmic results may invite scrutiny under constitutional principles.

A system that flags inactivity without accounting for meetings, reading, telephone calls, accessibility requirements, or technical failures may produce misleading conclusions.

Classification: Foundational constitutional authority; analogous rather than directly concerned with workplace surveillance.

4. When Is Remote Monitoring More Likely to Be Lawful?

A defensible monitoring programme generally incorporates the following safeguards:

Legitimate purpose: Monitoring must serve a genuine objective, such as cybersecurity, protection of confidential information, compliance, or appropriate performance management.

Prior transparency: Employees should receive a clear explanation of what is monitored, when monitoring occurs, and how records are used.

Proportionality: Employers should prefer less intrusive methods when they can achieve the same objective.

Data minimisation: Collect only information reasonably necessary for the stated purpose.

Restricted access: Limit access to monitoring records to authorised personnel.

Retention controls: Establish appropriate deletion schedules and prevent indefinite storage.

Fair evaluation: Avoid treating keystroke counts, mouse movement, or screen activity as conclusive proof of productivity.

Review mechanisms: Allow employees to explain anomalies, challenge inaccurate records, and respond to adverse findings.

5. Legally Risky Monitoring Practices

The following practices require particular caution:

Secret webcam or microphone activation without an adequate legal basis.

Continuous screen recording that captures personal communications and sensitive information.

Keystroke logging that captures passwords, banking credentials, or private messages.

GPS tracking outside working hours without an appropriate justification.

Using automated activity scores as the sole basis for dismissal or disciplinary punishment.

Monitoring personal devices without clear boundaries between business and private information.

The legal outcome depends on the applicable legislation, employment arrangements, monitoring purpose, and circumstances. No single rule makes every form of remote monitoring lawful or unlawful.

6. Practical Compliance Strategy

An employer implementing monitoring software should conduct a privacy and necessity assessment before deployment. The assessment should identify the information collected, the business objective, available less intrusive alternatives, risks to employee privacy, and safeguards required.

The organisation should issue a written policy, provide appropriate notice, restrict collection outside working hours, secure stored data, and establish procedures for reviewing contested performance records.

Employees who believe monitoring is unlawful should preserve relevant policies, notices, screenshots of monitoring settings, and communications about the system. They may raise an internal grievance or seek advice concerning available remedies under applicable data-protection, employment, contractual, or constitutional law.

7. Conclusion

Performance monitoring software is not inherently unlawful in remote work. Employers may have legitimate reasons to monitor work-related activity, safeguard information, and assess performance. However, those interests must be balanced against applicable privacy, data-protection, and employment protections.

The Indian Supreme Court's decisions in Puttaswamy, People's Union for Civil Liberties, District Registrar v. Canara Bank, and Maneka Gandhi provide broader principles concerning privacy, lawful interference, and fairness. The European decisions in Bărbulescu, Copland, and López Ribalda address workplace surveillance more directly and offer useful comparative guidance.

The governing practical principle is that remote-work monitoring should be transparent, purpose-limited, proportionate, secure, and subject to meaningful safeguards. The legality of a particular system must ultimately be determined by the applicable law, the nature of the information collected, and the circumstances in which monitoring is conducted.