Workplace Monitoring Policy — Template
Drafted for India's DPDP Act 2023 · Adapt for other jurisdictions as needed
1. Purpose
This policy explains how [Company Name] ("the Company") monitors workplace activity on company-issued computers and the safeguards we use to ensure monitoring is lawful, proportionate, and respectful.
2. Scope
This policy applies to all employees, contractors, and authorized users of computers issued by the Company. It covers monitoring software installed on those computers (specifically, the Surbhi software).
3. What we monitor
- Screen captures — periodic screenshots taken during work hours, at intervals configured by the Company (typically every 60 seconds)
- Application usage — names of applications opened and time spent in each
- Active vs idle time — to compute productive hours
- Configurable rule violations — alerts when specified keywords or applications are used
4. What we do NOT monitor
- Personal devices (only company-issued computers)
- Activity outside [working hours / your scheduled shift]
- Webcam, microphone, or audio
- Banking, password manager, or other sensitive applications (when configured in the exclusion list)
- Personal email accounts or messaging when accessed from personal devices
5. Why we monitor
- To measure and improve team productivity
- To protect the Company's confidential information and intellectual property
- To investigate misconduct, harassment, or policy violations when there is reasonable cause
- To comply with regulatory obligations specific to our industry
6. Legal basis (DPDP Act 2023)
The Company processes employee personal data under:
- Legitimate use — for purposes of employment, including performance evaluation and protection of company assets, in line with §7(b) of the DPDP Act 2023
- Compliance with law — where industry regulations require record-keeping
- Consent — where required, obtained via the signed acknowledgement form attached to this policy
7. Data security
Captured data is:
- Stored on Company-controlled servers, encrypted at rest with AES-256
- Accessible only to authorized HR and management personnel
- Not sold, shared, or transferred to third parties without your consent or legal compulsion
8. Retention
Captured data is retained for [90 days], after which it is automatically purged. Data flagged in connection with an active investigation may be retained for the duration of the investigation plus [1 year].
9. Your rights
Under the DPDP Act 2023, you have the right to:
- Access the data we hold about you (request via [HR email])
- Correct inaccuracies
- Request erasure (subject to our retention obligations)
- Lodge a grievance with our Data Protection Officer at [dpo@company.com]
- Escalate to the Data Protection Board of India
10. Notice and transparency
The Surbhi software displays a visible notice on monitored computers indicating that monitoring is active. This policy is provided to all new hires during onboarding and posted on the company intranet.
11. Disciplinary action
Data captured by Surbhi may be used as evidence in disciplinary proceedings. Such proceedings will follow due process and the Company's Standing Orders.
12. Misuse of monitoring data
Authorized personnel who access captured data are bound by confidentiality. Misuse — including viewing data without legitimate purpose, sharing it improperly, or using it for harassment — is grounds for termination.
13. Changes to this policy
We will notify all employees in writing at least [30 days] before any material change to this policy.
14. Contact
Questions: [HR Email]
Data Protection Officer: [DPO Email]
Appendix A — Acknowledgement Form
I, ____________________________ (employee name), Employee ID ______________, acknowledge that I have read and understood the Workplace Monitoring Policy of [Company Name] dated [date]. I understand that the company-issued computer assigned to me is subject to monitoring as described above. I have had the opportunity to ask questions, and I consent to monitoring as described.
Signed: ____________________________
Date: ____________________________