Rules on monitoring workers that reach an event log
10 UK and US rules on monitoring workers that decide whether event logs about named employees may leave a company, each quoted from the statute or the regulator page, read 28 October 2026.
Which body of rules
What it requires
The rule in its own words
Each rule, answer by answer
A rule per row. Every answer opens onto the line it comes from, quoted exactly, with the text it sits in and the day of the read. "Not stated" marks a question the text leaves unanswered.
| Rule | Which body of rules | What it requires | The rule in its own words |
|---|---|---|---|
| Access to stored communications, US | US federal interception and stored communications law | no interception or access without consent or another exception | intentionally accesses without authorization a facility through which an electronic… |
| Consumer privacy rights, California | US state consumer privacy law | the regulator explains the requirement | The right to know about the personal information a business collects about them and how… |
| Employee data rulemaking, California | US state consumer privacy law | the regulator explains the requirement | Employee Data –The preliminary comment period closed on May 20, 2026. |
| Impact assessment before high-risk processing, UK | UK data protection | an impact assessment before high-risk processing | Where a type of processing in particular using new technologies, and taking into account… |
| Interception of communications, US | US federal interception and stored communications law | no interception or access without consent or another exception | intentionally discloses, or endeavors to disclose, to any other person the contents of… |
| Lawful basis for processing, UK | UK data protection | a lawful basis for processing | the data subject has given consent to the processing of his or her personal data for one… |
| Monitoring workers, UK regulator guidance | UK data protection | the regulator explains the requirement | It is aimed at all circumstances where there is an employment relationship or otherwise a… |
| Notice of monitoring email and internet use, Delaware | US state electronic monitoring notice law | notice to employees before monitoring | No employer, nor any agent or any representative of any employer, shall monitor or… |
| Prior notice of electronic monitoring, Connecticut | US state electronic monitoring notice law | notice to employees before monitoring | means the collection of information on an employer's premises concerning employees'… |
| Prior notice of electronic monitoring, New York | US state electronic monitoring notice law | notice to employees before monitoring | The notice required by this subdivision shall be in writing, in an electronic record, or… |
The source sentence behind every answer (30)
- Access to stored communications, US, 18 U.S.C. 2701, read 2026-10-28, Which body of rules:
intentionally accesses without authorization a facility through which an electronic communication service is provided; or
- Access to stored communications, US, 18 U.S.C. 2701, read 2026-10-28, What it requires:
intentionally accesses without authorization a facility through which an electronic communication service is provided; or
- Access to stored communications, US, 18 U.S.C. 2701, read 2026-10-28, The rule in its own words:
intentionally accesses without authorization a facility through which an electronic communication service is provided; or
- Consumer privacy rights, California, California Attorney General, CCPA, read 2026-10-24, Which body of rules:
The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them
- Consumer privacy rights, California, California Attorney General, CCPA, read 2026-10-24, What it requires:
The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.
- Consumer privacy rights, California, California Attorney General, CCPA, read 2026-10-24, The rule in its own words:
The right to know about the personal information a business collects about them and how it is used and shared;
- Employee data rulemaking, California, California Privacy Protection Agency regulations page, read 2026-10-24, Which body of rules:
In November 2020, California voters passed Proposition 24, which amended the California Consumer Privacy Act of 2018
- Employee data rulemaking, California, California Privacy Protection Agency regulations page, read 2026-10-24, What it requires:
Below are topics that CalPrivacy is exploring to determine whether regulatory changes are necessary.
- Employee data rulemaking, California, California Privacy Protection Agency regulations page, read 2026-10-24, The rule in its own words:
Employee Data –The preliminary comment period closed on May 20, 2026.
- Impact assessment before high-risk processing, UK, UK GDPR art 35, read 2026-10-28, Which body of rules:
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons
- Impact assessment before high-risk processing, UK, UK GDPR art 35, read 2026-10-28, What it requires:
the controller shall, prior to the processing, carry out an assessment
- Impact assessment before high-risk processing, UK, UK GDPR art 35, read 2026-10-28, The rule in its own words:
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment
- Interception of communications, US, 18 U.S.C. 2511, read 2026-10-24, Which body of rules:
intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication;
- Interception of communications, US, 18 U.S.C. 2511, read 2026-10-24, What it requires:
It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception
- Interception of communications, US, 18 U.S.C. 2511, read 2026-10-24, The rule in its own words:
intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection;
- Lawful basis for processing, UK, UK GDPR art 6, read 2026-10-08, Which body of rules:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
- Lawful basis for processing, UK, UK GDPR art 6, read 2026-10-08, What it requires:
processing is necessary for compliance with a legal obligation to which the controller is subject;
- Lawful basis for processing, UK, UK GDPR art 6, read 2026-10-08, The rule in its own words:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
- Monitoring workers, UK regulator guidance, ICO, Employment practices and data protection: monitoring workers, read 2026-10-24, Which body of rules:
This guidance discusses the monitoring of workers by employers, and how this interacts with data protection.
- Monitoring workers, UK regulator guidance, ICO, Employment practices and data protection: monitoring workers, read 2026-10-24, What it requires:
The guidance provides clarity and practical advice to help employers to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
- Monitoring workers, UK regulator guidance, ICO, Employment practices and data protection: monitoring workers, read 2026-10-24, The rule in its own words:
It is aimed at all circumstances where there is an employment relationship or otherwise a relationship between an organisation and a person who performs work for the organisation, regardless of the nature of the contract.
- Notice of monitoring email and internet use, Delaware, 19 Del. C. s705, read 2026-10-28, Which body of rules:
No employer, nor any agent or any representative of any employer, shall monitor or otherwise intercept any telephone conversation or transmission, electronic mail or transmission, or Internet access or usage of or by a Delaware employee unless the employer either:
- Notice of monitoring email and internet use, Delaware, 19 Del. C. s705, read 2026-10-28, What it requires:
Provides an electronic notice of such monitoring or intercepting policies or activities to the employee at least once during each day the employee accesses the employer-provided e-mail or Internet access services; or
- Notice of monitoring email and internet use, Delaware, 19 Del. C. s705, read 2026-10-28, The rule in its own words:
No employer, nor any agent or any representative of any employer, shall monitor or otherwise intercept any telephone conversation or transmission, electronic mail or transmission, or Internet access or usage of or by a Delaware employee unless the employer either:
- Prior notice of electronic monitoring, Connecticut, Conn. Gen. Stat. s31-48d, read 2026-10-24, Which body of rules:
each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur.
- Prior notice of electronic monitoring, Connecticut, Conn. Gen. Stat. s31-48d, read 2026-10-24, What it requires:
each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur.
- Prior notice of electronic monitoring, Connecticut, Conn. Gen. Stat. s31-48d, read 2026-10-24, The rule in its own words:
means the collection of information on an employer's premises concerning employees' activities or communications by any means other than direct observation, including the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic or photo-optical systems
- Prior notice of electronic monitoring, New York, N.Y. Civil Rights Law s52-c*2, read 2026-10-28, Which body of rules:
Any employer who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employee by any electronic device or system
- Prior notice of electronic monitoring, New York, N.Y. Civil Rights Law s52-c*2, read 2026-10-28, What it requires:
shall give prior written notice upon hiring to all employees who are subject to electronic monitoring.
- Prior notice of electronic monitoring, New York, N.Y. Civil Rights Law s52-c*2, read 2026-10-28, The rule in its own words:
The notice required by this subdivision shall be in writing, in an electronic record, or in another electronic form and acknowledged by the employee either in writing or electronically.
Documents we read but did not count
6 named documents were read and left out because they are not what this board covers; each reason is below. They are counted, never answered.
- New York State Senate: the stored read of this address is New York Civil Rights Law s52-c on sexually explicit depictions; the electronic-monitoring notice section shares the number and is not the text read
- legislation.gov.uk: Data Protection Act 2018 s19, which the stored text shows omitted on 5.2.2026 by the Data (Use and Access) Act 2025: no rule in force to quote
- legislation.gov.uk: UK GDPR art 88, which the stored text shows omitted on 31.12.2020 by the EU Exit Regulations 2019: no rule in force to quote
- legislation.gov.uk: UK GDPR art 89, which the stored text shows omitted on 5.2.2026 by the Data (Use and Access) Act 2025: no rule in force to quote
- European Data Protection Board: an EDPB document listing page carrying the opinion's title, not its text, and EU rather than UK or US law
- https://www.ftc.gov/business-guidance/privacy-security/data-: FTC data-security business guidance, which does not address monitoring or recording workers
How the figures are worked out
Each rule's own statute texts and regulator guidance on monitoring workers and on personal data were read through estate-fetch and stored whole (sha256 on every row).
For every text, three questions were answered from its own words: which body of rules, what it requires, the rule in its own words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question.
A rule with several texts reads 'varies' where they disagree.
10 rules, 10 texts.
16 sources, with links
- ICO (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- legislation.gov.uk (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- Cornell LII, U.S. Code (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- New York State Senate (read, set aside)
- legislation.gov.uk (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- Cornell LII, U.S. Code (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- legislation.gov.uk (read, set aside)
- legislation.gov.uk (read, set aside)
- legislation.gov.uk (read, set aside)
- Delaware Code (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- Connecticut General Statutes (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- California Privacy Protection Agency (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- European Data Protection Board (read, set aside)
- California Attorney General (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
- https://www.ftc.gov/business-guidance/privacy-security/data- (read, set aside)
- New York State Senate (from the publisher's own statute texts and regulator guidance on monitoring workers and on personal data; reproduced for comment)
Take this figure with you
10 UK and US rules on monitoring workers that decide whether event logs about named employees may leave a company, each quoted from the statute or the regulator page, read 28 October 2026.
Which body of rules, by rule: UK data protection 3 of 10, US state electronic monitoring notice law 3 of 10, US federal interception and stored communications law 2 of 10, US state consumer privacy law 2 of 10 (10 rules, read 28 October 2026).
What it requires, by rule: the regulator explains the requirement 3 of 10, notice to employees before monitoring 3 of 10, no interception or access without consent or another exception 2 of 10, an impact assessment before high-risk processing 1 of 10, a lawful basis for processing 1 of 10 (10 rules, read 28 October 2026).
The rule in its own words, by rule: stated 10 of 10 (10 rules, read 28 October 2026).
To cite: "Rules on monitoring workers that reach an event log", updated 2026-10-28, https://sellprocessdatatoai.com/datasets/process-data-employee-monitoring-law/.
Save the CSV (30 answers, compiled 2026-10-28)