How to Write an Employee Monitoring Policy

Reviewed for accuracy by Tarun Kumar Reddy on October 14, 2026.

An employee monitoring policy is a written document that tells staff which workplace data an employer collects, why, who can see it, how long it is kept, and what rights they have over it. In several US states it is also a legal notice with a specific required form. Most drafts fail for the same reason: they are written to protect the employer from a lawsuit rather than to answer the question an employee actually has.

This guide covers the notice rules that shape the document, the sections a workable policy needs, and the failure mode built into each one. Treat it as drafting guidance rather than legal advice, and have counsel confirm the final wording.

What an Employee Monitoring Policy Has to Do

A monitoring policy has two jobs, and most drafts attempt only one. The first is legal notice: setting out what happens to workplace data in terms a regulator would accept. The second is answering the question every employee has, which is some version of "can my manager see what I typed at four o'clock on Thursday?" Miss the second job and the first one stops protecting you. Which notice you owe depends on where your people sit, and our guide to employee monitoring laws by state sets out the four states with a statutory duty.

Why does that matter so much? Because a policy that fails the employee test gets read once and then filled in by rumor. People do not calibrate to what the document says. They calibrate to the worst thing the document does not rule out. Precision is the only fix, and generic protective wording is precisely what removes it. If you would rather start from wording than from a blank page, our employee monitoring policy template has the clauses ready to copy.

A policy also cannot rescue a program that should not exist. If the underlying collection is disproportionate, no amount of careful drafting makes it acceptable, and writing the document is a good moment to notice. The tests we use for that live in our ethical playbook for employee productivity monitoring.

What US Notice Law Requires in the Document

In the United States, the requirement most likely to shape your document is advance written notice, and it varies by state. New York is the clearest published example. Under New York Civil Rights Law section 52-c, an employer that monitors telephone conversations, email, or internet usage by electronic device must give prior written notice upon hiring to all employees subject to that monitoring.

The statute is specific about form and timing, which is what makes it useful as a drafting model even outside New York:

• Notice must be given upon hiring, before monitoring applies to that person.
• It must be in writing or electronic form and acknowledged by the employee.
• The employer must also post the notice in a conspicuous place readily available to affected employees.
• Civil penalties run up to $500 for a first offense, $1,000 for a second, and $3,000 for a third and each subsequent offense.
• There is a narrow exemption for processes that manage the type or volume of incoming or outgoing email, voicemail, or internet usage and are performed solely for computer system maintenance or protection.

Note what that implies for your paperwork. You need three artifacts, not one: the policy itself, a per-employee acknowledgment captured at hire, and a posted version somewhere staff genuinely see. A policy buried in a handbook portal satisfies neither duty. Our employee monitoring consent form covers the second of those three, in both a full and a short version.

One caution before you copy anything. Monitoring law varies by state, so confirm the requirements with counsel in every jurisdiction where you employ people, including any state rules on recording and interception. If you employ staff in the EU, GDPR adds obligations around lawful basis and data minimization that local counsel should cover.

The Eight Sections an Employee Monitoring Policy Needs

Eight sections cover almost every situation. The third column below is where real documents fall apart, and we have seen every one of these failures more than once.

Three of those deserve more than a table row, because they decide whether anyone believes the rest.

What is not collected

This is the most valuable section in the document and the one most often absent. Write the exclusions as commitments: no keystroke content, no screen recording, no collection on personal devices, nothing outside scheduled hours. Employees read this part first, and they will quote it back to you if something changes. Our list of data types employee monitoring should never collect is a reasonable starting draft.

Scope

Scope is where hybrid work quietly breaks a policy. Say which devices, which hours, and which locations, and say it in a way that survives someone working from a kitchen table. Pew Research Center found in January 2025 that among US workers whose jobs can be done from home, 75% are now required to be in the office certain days, up from 63% in early 2023, so most policies now have to cover two settings for the same person in the same week. Silence about the home setting is read as coverage of it.

Retention

Give a number. Ninety days, one hundred eighty days, whatever your stated purpose genuinely needs, and then say what happens on day ninety-one. Vague retention is the clearest signal that nobody thought about the data lifecycle, and it grows your exposure quietly: every extra month of history is more material in a breach and more work in a records request.

A Plain Language Rewrite of a Monitoring Clause

The gap between a policy that gets accepted and one that gets forwarded to a lawyer is usually specificity, not tone. Here is a clause of the kind that appears in plenty of handbooks, followed by the version we would write. Screen capture needs naming explicitly rather than folding into a general clause, and our guide to computer screen monitoring software sets out what a policy has to say about frequency, retention, and who may open an image.

Before: The Company may monitor use of Company systems and equipment as it deems necessary for legitimate business purposes, and may retain such data for such period as it considers appropriate.

After: On company laptops, during your scheduled hours, we record which applications and websites you have open and for how long. We use this to plan workload and staffing. We do not record what you type, capture your screen, or collect anything on personal devices or outside your hours. Your manager sees team totals by default. You can see your own record at any time. We delete these records after ninety days.

The rewrite is longer in words and far shorter in ambiguity. It also commits you to things, which is the point. A policy nobody can hold you to is not reassuring, it is just quiet. If your collection method makes that clause hard to write honestly, the method may be the problem, which is one of the tradeoffs we compare in manual versus automatic employee productivity trackers.

How to Get the Policy Reviewed and Published

A monitoring policy should clear legal review and an employee read-through before anyone is asked to acknowledge it, in that order. Legal review catches the obligations you missed. The read-through catches sentences that technically say one thing and are read as another, which is where nearly all the trust damage happens.

1. Draft in plain language first, before anyone adds protective wording.
2. Have counsel in each state where you employ people review the substance, not just the format.
3. Build the acknowledgment step into hiring, so new employees get notice before monitoring applies.
4. Post the notice somewhere staff actually see it, in addition to filing it in the handbook.
5. Run the read-through with three or four employees and fix whatever they misread.
6. Publish the whole policy, not a summary, and hold a live session for questions.
7. Keep every version dated and available, so changes are visible rather than silent.

Step six is the one that gets cut for time, and cutting it is a false economy. The questions people ask in that session are the ones they would otherwise answer for themselves, incorrectly. If you are publishing alongside a new rollout, the sequencing advice in our guide to rolling out time tracking without losing trust applies here too.

On where this policy sits relative to everything else you ask people to sign, our guide to the employee handbook covers the structure and the clauses that are unenforceable as commonly written.

What Happens After Employees Acknowledge It

An acknowledgment is the start of the obligation, not the end of it. Policies drift, usually without malice: a system update adds a data field, a report gets shared more widely than planned, a retention job stops running and nobody notices for a year. None of those feels like a policy change to the person making it, and together they turn an honest document into a false one.

Review the policy annually against what your systems actually collect, and again whenever you add a data source or start employing people in a new state. If reality has moved, change the document and tell people it changed. Quiet edits do more damage than the original policy ever did, because they prove the document was never a commitment.

Keep the stakes in view. Gallup reported in April 2026 that global employee engagement declined for a second year in 2025, reaching its lowest level since 2020, with the decline most acute among managers. A monitoring document is a small lever on that, but it points in one direction or the other. Written honestly, an employee monitoring policy is one of the few artifacts that tells a team what you will not do, and it belongs inside a wider approach to employee productivity rather than substituting for one.

Key takeaways

• Write for the employee's real question first and the regulator's second; both need specifics.
• New York requires prior written notice on hiring, employee acknowledgment, and a posted notice, so plan for three artifacts.
• The exclusions section carries more weight with staff than any other part of the document.
• Replace every vague phrase with a number, a named role, or a named data field.
• Have counsel in each state review the wording, then re-review it yearly against reality.