Lone-worker monitoring, privacy and employee confidence

Is a welfare check "monitoring"?

The ICO's guidance, Employment practices and data protection: monitoring workers, is about how employers collect and use information about workers. A check-in system records who was asked, when, how they responded, and in some cases where they were at that moment. That is personal data about workers, so UK GDPR applies, and it is sensible to treat the system as monitoring even though its purpose is welfare.

The ICO says its guidance is under review because of the Data (Use and Access) Act, so check the current version when you write your paperwork.

Employer duties in plain terms

Choose and record a lawful basis

The ICO says you must identify a lawful basis before monitoring, and warns against a one-size-fits-all approach. It explains that consent is usually a poor fit between employer and worker because of the imbalance of power: consent must be freely given. For lone-worker safety, employers commonly look at legitimate interests (and sometimes legal obligation, given health and safety duties). If you use legitimate interests, the ICO expects a documented assessment of purpose, necessity and balance against workers' rights before you start. Choosing the basis is the employer's decision.

Be proportionate

The ICO's message is to be clear about the purpose and use the least intrusive means to achieve it, and that a tool being available does not make it the right answer. Scheduled check-ins that only ask "are you OK?" are generally less intrusive than constant tracking, which is one reason for NALW's design (see below).

Tell workers

The ICO says you must tell workers about monitoring in a way that is accessible and easy to understand, and keep that information up to date. In practice that means:

• what is collected (name, number, responses, a location at check-in);
• why (welfare and safety);
• who sees it (named managers and escalation contacts);
• how long it is kept;
• how a worker can ask questions or exercise their rights.

Put it in your lone-working policy and staff privacy notice. Our free lone-working policy template has a privacy section to adapt.

Do a DPIA where needed

The ICO says a data protection impact assessment (DPIA) is required before processing likely to result in high risk, and recommends one even where it is not strictly required. See the ICO's DPIA guidance. A DPIA for a check-in service is short if you collect little: describe the processing, assess necessity and proportionality, note risks and the measures you will take. If you add location or voice, say so in it.

Respect reasonable expectations

The ICO says workers' expectations of privacy are significantly greater at home or outside the workplace, and that employers should only monitor in ways workers would reasonably expect. Limit check-ins to working time. Do not use a safety record for unrelated performance management unless you have said so and have a basis for it.

Location data

Location is the part that worries workers most. Two different things are often confused:

• Live tracking follows a person continuously, usually through a device or app running in the background.
• A location snapshot is a single position recorded when the worker chooses to act.

NALW does the second. A worker's GPS position is captured only when they tap to check in on the web link or raise an SOS. There is no background tracking and no app that follows them. In the console, the map shows each worker's last known location from their latest check-in, so a manager knows where to start looking if a check is missed. See shifts and locations.

For comparison, the ICO's guidance on vehicle tracking says you will rarely be able to justify monitoring during private use, and that workers should be able to avoid being tracked outside working hours. A snapshot-at-check-in design avoids that issue by default, though your DPIA should still say what you collect and why.

Who is the controller?

NALW's privacy policy explains the split. For data about the people who administer an account, TNS365 is the controller. For data about the workers you monitor (names, numbers, check history and location at check-in), you, the customer, are the controller and TNS365 acts as your processor, handling the data only to run the service you set up. That means you decide the lawful basis, you inform your workers, and you handle their requests, with our help.

NALW uses a small set of sub-processors to send texts and make calls, convert speech, send email and take payments. They are listed in the privacy policy and on the security page.

What happens to voice and text replies

When Zoe, NALW's AI voice assistant, phones a worker, the call is processed by an AI service to work out whether the worker is safe or in distress. Free-text SMS replies are interpreted the same way. NALW does not store call audio; it keeps a text transcript with the check record so there is evidence of what was said. Tell workers this in your privacy information, and tell them a person is not listening live.

Building employee confidence

Policies and notices matter, but so does how the system feels to the people using it.

1. Involve workers early. Explain the purpose, show them what the check-in looks like and what a manager sees. The product tour shows the worker side.
2. Say what it is not. It is not a clocking-in system, not live tracking and not a way to watch their day.
3. Agree the rules for use of the data. For example, "the record will be used for safety follow-up and review, not for disciplinary action about routine lateness." Write that down if it is true.
4. Keep the schedule sensible. Too many checks breed resentment. See welfare checks that don't annoy your team.
5. Review. Ask workers after a month and again after a year whether it works for them.

Read more in our lone-worker monitoring overview and the standards page.

Frequently asked questions