What if commercially available tools are part of our monitoring?

You may choose commercially available tools or services to provide you with the capability to monitor your workers. For example, you could procure a tool that helps to monitor your workers, gathers data about them or helps to store the data (ie a cloud storage provider).

In most cases where you are procuring tools or services from a third-party for the purposes of monitoring your workers, you are the controller for this processing activity and the third-party is a processor. This is because you are deciding the means and purposes of the processing.

As a controller, your UK GDPR responsibilities include:

• complying with the data protection principles; • ensuring that workers and other individuals who may be captured can exercise their rights regarding their personal data; • choosing an appropriate processor who will provide sufficient guarantees that they will implement appropriate technical and organisational measures to ensure their processing meets UK GDPR requirements; and • meeting accountability obligations, such as carrying out data protection impact assessments and adopting a ‘data protection by design and default’ approach.

For a comprehensive list of your responsibilities, see our guidance on What does it mean if you are a controller?

As part of the procurement process, you need to make sure that the provider gives sufficient information about their tool or service so you can carry out your responsibilities. You can do this through a written contract or service agreement between the controller and processor.

In some cases, the third-party you are procuring from may use personal data collected by you for their own purposes. In this case, it is likely that the third party would become a controller for this processing, and you would be a processor.

Further reading outside this guidance

Controllers and processors: in brief

Controllers and processors: in more detail

Contracts and liabilities between controllers and processors