Is employee computer monitoring legal? GDPR and KVKK basics
In most of Europe and in Türkiye you can measure how work computers are used — if you do it proportionately and transparently. Here is what that means in practice.
This guide is general information, not legal advice. Check the specific rules in your country with a lawyer or your data protection officer.
The short answer
Monitoring company computers is generally allowed in the EU (under the GDPR) and in Türkiye (under the KVKK, Law No. 6698), but not unconditionally. Data protection authorities and courts expect monitoring to be:
- based on a legitimate purpose (for example, measuring workload or ensuring working-hours compliance),
- proportionate — the least intrusive way to reach that purpose,
- transparent — employees are told before it starts.
Secret or excessive monitoring (keylogging, reading private messages, constant screenshots, webcam recording) is where employers most often get into trouble.
Who is responsible for what?
When you use a time tracking service:
- Your company is the data controller. You decide why and how employee data is processed.
- The service provider is the data processor. It processes data only on your instructions, under a data processing agreement.
A compliance checklist
- Define the purpose in writing. “Understanding where working time goes and balancing workload” is a clear purpose; “keeping an eye on everyone” is not.
- Choose a legal basis. For most employers this is legitimate interest — and consent is rarely valid in an employment relationship because of the power imbalance.
- Do a balancing test or DPIA. Systematic monitoring of employees usually calls for a data protection impact assessment under the GDPR.
- Inform employees before you start. Give them a privacy notice explaining what is collected, why, for how long and who can see it.
- Minimise the data. Collect only during working hours. Prefer app names over window titles if titles are not needed. Do not collect message contents, keystrokes or screenshots.
- Limit access. Department managers should see only their own team. Log every access to personal data.
- Set a retention period and delete data automatically when it expires.
- Answer access requests. Employees can ask for a copy of their data.
How Zaman Takip supports this
- Data is collected only during working hours; nothing is collected outside them.
- No screenshots, keystrokes, emails or message contents.
- Window titles can be switched off with one setting; then only the app name is stored.
- Role-based access and an access log for every view of personal data.
- A configurable retention period, after which data is deleted.
- A privacy notice template you can adapt and give to employees.
Frequently asked questions
Do I need employee consent to monitor work computers?
Usually not — and consent is often not a valid basis in employment. Most employers rely on legitimate interest, combined with transparency and a balancing test.
Can I monitor employees without telling them?
In general, no. Covert monitoring is only acceptable in exceptional cases, such as a specific suspicion of a crime, and even then strict conditions apply.
What is the difference between KVKK and GDPR here?
The principles are very similar: purpose limitation, proportionality, transparency and security. KVKK applies to processing in Türkiye; the GDPR applies to processing related to people in the EU.