1. Introduction
The modern workplace is no longer confined to the physical office. As businesses increasingly embrace digital systems, remote working arrangements and technology-driven management, employers now have unprecedented visibility into the activities of their workforce. Employee attendance can be recorded through biometric systems; movements can be tracked through GPS-enabled devices; emails and internet activity can be monitored; computer screens can be captured; and sophisticated software can analyse an employee’s productivity, behaviour and patterns of work. What was once limited to a supervisor’s physical observation can now occur continuously, remotely and, in some instances, without the employee’s immediate awareness.
There are, undoubtedly, legitimate reasons for workplace monitoring. Employers have a responsibility to protect confidential information, safeguard organisational systems, prevent fraud, ensure regulatory compliance, promote workplace security and, within reasonable limits, assess employee performance. However, legitimate workplace surveillance may cross into unjustified intrusion where the nature, extent, method or duration of monitoring is neither lawful, necessary nor proportionate to its purpose.
This distinction has become increasingly significant with the emergence of artificial intelligence and sophisticated employee-monitoring technologies, which can extend beyond collecting information to analysing employee behaviour and informing consequential decisions. Against this backdrop, this article examines the legal boundaries of workplace surveillance under Nigeria’s evolving data protection framework, focusing on when legitimate employee monitoring becomes unlawful or disproportionate surveillance, and the practical safeguards employers can adopt to minimise privacy infringement.
2. Understanding Workplace Surveillance
The word “surveillance” can be described as the simple act of observing another individual or person in order to gather data, evidence or information. It is regarded as the systematic observation and monitoring of a person, population or location with the intention and purpose of gathering relevant information.2 It utilises various methods and systems in monitoring the activities of a person.
Workplace surveillance can then be described as the act of employing and utilising various methods, means, strategies, equipment, and software programmes for the purpose of monitoring the activities undertaken by an employee by an employer.3 It is essentially the continuous act of employing traditional and technological mediums for the purpose of monitoring the activities of an employee in order to ensure the adherence to company purposes and job descriptions. Due to the rise in artificial intelligence and technological tools, there are now numerous methods through which companies carry out workplace surveillance.
There are various types of workplace surveillance:
- Physical Surveillance: This involves the use of various technological systems in order to monitor or record the physical presence or attendance of an employee in a particular place or company premises. This involves the use of CCTV systems, access-control points and biometric attendance.
- Digital Surveillance: This involves the use of systems to monitor the digital and online presence, activities and works of an employee. Examples of forms of digital surveillance are email monitoring, browser search histories, monitoring activities of employees on social media platforms and keystroke
- Location Surveillance: This involves the monitoring of the location of the employee, company vehicles or equipment and tools at specific times and periods. Examples of location surveillance are GPS tracking systems, company vehicle tracking and mobile devices.4
- Algorithmic Surveillance: This involves the use of systems such as AI productivity tools, automated performance tools and behavioural analytics in order to create an evaluation on the output or performance of an employee.
It is important to distinguish ordinary processing of employee information from workplace surveillance. The mere collection of an employee’s personal data for purposes such as payroll or leave administration does not, in itself, amount to surveillance. By contrast, continuous location tracking, screen recording or keystroke monitoring involves a substantially greater degree of observation and intrusion. The distinction therefore depends not merely on whether data is collected, but on what is collected, why it is collected, the extent of the monitoring, and its impact on the employee’s privacy. This distinction is particularly significant in the context of remote and hybrid work, where digital tools can extend monitoring beyond the traditional workplace and, potentially, into an employee’s private sphere.
3. The Legal Foundation: Does an Employee Have a Right to Privacy at Work?
The starting point in determining the limits of workplace surveillance is that an employee does not lose the right to privacy by entering into an employment relationship. Although employment necessarily involves a degree of supervision and the processing of employee information, this does not give an employer an unrestricted right to observe or collect information about an employee’s activities.
At the constitutional level, section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) guarantees the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications. This provision establishes the broader constitutional foundation for the protection of privacy in Nigeria and is not extinguished merely because an individual is acting in their capacity as an employee.
This constitutional protection is reinforced by the Nigeria Data Protection Act 2023 (“NDPA”),5 which establishes a framework for protecting personal data and the rights of data subjects. Where an employer collects, records, stores or analyses information relating to an identifiable employee, such processing will generally fall within the scope of the NDPA. Workplace surveillance is therefore not merely an issue of employment management; it is also a data protection and privacy issue.
Additionally, section 24 of the NDPA, sets out the fundamental principles governing the processing of personal data. These include the requirements that personal data be processed fairly, lawfully and transparently, collected for specified, explicit and legitimate purposes; limited to what is adequate, relevant and necessary, retained only for as long as necessary and protected against unauthorised access or misuse.6 These principles provide important safeguards in the context of workplace surveillance. An employer may have a legitimate purpose for monitoring employees, but the existence of that purpose does not, without more, justify the collection of unlimited or excessive information.
The General Application and Implementation Directive 2025 (“GAID”)7 further reinforces these obligations by providing guidance on the application of the principles under section 24 and emphasising privacy by design and by default. The framework therefore requires privacy considerations to be incorporated into the manner in which monitoring technologies are selected, configured and deployed, rather than considered only after surveillance has commenced.
The NDPA also confers various rights on data subjects, including rights relating to access, rectification, objection and, in certain circumstances, protection against decisions based solely on automated processing.8 These protections are relevant where workplace monitoring extends beyond the collection of information and is used to evaluate employees or inform significant employment decisions.
Accordingly, privacy within the employment relationship should not be understood as preventing legitimate workplace monitoring. Employers may have valid reasons to process employee information for purposes such as security, performance management, compliance and protection of organisational assets. However, the legal framework recognises that the employer’s legitimate interests must operate alongside the employee’s right to privacy. The fact that monitoring serves a legitimate business purpose does not, therefore, answer the separate question of whether the particular means adopted are justified.
4. The Employer’s Legitimate Interests vs. The Employee’s Privacy
Workplace surveillance sits at the intersection of two competing interests: the employee’s fundamental right to privacy and the employer’s legitimate interest in managing and protecting its organisation. Employers may have legitimate and compelling reasons to monitor employees, including safeguarding confidential information, preventing fraud, ensuring cybersecurity, complying with regulatory obligations, protecting organisational assets and maintaining operational efficiency. The law does not require employers to relinquish these interests merely because the means by which they are pursued involve the processing of employees’ personal data.
However, the existence of a legitimate purpose does not provide an unlimited licence to employ whatever means may be considered convenient or effective. A legitimate objective and the method adopted to achieve that objective are separate considerations. The fact that an employer seeks to protect its systems, for instance, may justify some form of monitoring. It does not necessarily justify continuous screen recording, unrestricted access to private communications or persistent tracking of an employee’s location. This distinction is consistent with the data protection principles under section 24 of the NDPA, which require personal data to be processed for specified and legitimate purposes and limited to what is adequate, relevant and necessary for those purposes. The GAID further requires controllers relying on legitimate interest to assess the basis for doing so and to identify and eliminate processing that may overreach the fundamental rights and freedoms of data subjects, particularly processing involving behavioural monitoring or profiling.9
The position is not altered merely because an employee has agreed to work for the organisation. By entering into an employment relationship, an employee may reasonably expect a degree of supervision and may provide personal information necessary for the performance of the employment contract. However, consent to employment cannot reasonably be equated with consent to unrestricted surveillance. The fact that an employee has agreed to an organisation’s workplace policies or monitoring arrangements does not, in itself, render every subsequent form of monitoring justified.
Accordingly, the appropriate approach is not to treat employee privacy and legitimate organisational interests as mutually exclusive. Rather, the objective should be to permit justified and appropriately limited workplace monitoring while preserving the employee’s fundamental privacy rights. The employer may monitor where there is a legitimate and identifiable purpose for doing so, but the method of monitoring must remain connected to that purpose and subject to the safeguards imposed by data protection laws.
5. Drawing The Line: Key Considerations For Lawful Employee Surveillance
The importance or need for workplace surveillance cannot be understated. On the other hand, it is important to highlight that the legitimate interests of the employer does not serve as an open blank cheque for utilising any means or method for conducting surveillance. The difficulty, therefore, lies not in determining whether workplace surveillance can ever be justified, but in identifying where legitimate monitoring ends and excessive intrusion begins.
Against this background, five questions or considerations may assist in determining whether a particular form of employee surveillance is justified:
5.1 Purpose - Why is the employer monitoring the employee?
The starting point should be a clearly defined and legitimate purpose. An employer should be able to articulate precisely what it seeks to achieve through the surveillance rather than rely on broad justifications such as “productivity” or “management”. The vaguer the stated purpose, the more difficult it becomes to determine whether the extent of monitoring is justified. For example, monitoring access logs may be reasonably connected to the prevention of unauthorised access to an organisation’s systems. The same objective may be less readily connected to recording every keystroke an employee makes throughout the working day. The purpose of the surveillance must therefore be sufficiently specific to provide a meaningful basis for assessing the necessity of the information being collected.
5.2 Necessity - Is the surveillance necessary to achieve that purpose?
A legitimate purpose does not necessarily require the most extensive form of monitoring available. The employer should consider whether the stated objective can be achieved through a less intrusive means. If an employer's concern is unauthorised access to confidential information, for instance, access logs, authentication controls or other targeted security measures may address the risk without requiring continuous screenshots of an employee’s computer. Necessity therefore requires consideration of whether the surveillance is genuinely required, rather than merely convenient or technologically available. This is particularly important because technological capability can easily outpace organisational necessity. The fact that a monitoring tool can capture a particular category of information does not, without more, establish that the employer needs that information. The GAID requires a Legitimate Interest Assessment, privacy by design and default, identification and elimination of processing that may overreach fundamental rights and freedoms, including behavioural monitoring or profiling, and transparency to data subject.
5.3 Proportionality - Is the extent of the surveillance proportionate to the objective pursued?
In situations where monitoring is regarded as necessary, its scope and intensity must remain proportionate to the purpose for which it is undertaken. Proportionality requires consideration of the nature of the information collected, the frequency and duration of the monitoring, the circumstances in which it occurs and the potential impact on the employee. The distinction may be significant. Monitoring an employee’s use of a company network for cybersecurity purposes is different from continuously tracking the employee’s physical location.
The appropriate degree of surveillance may also depend upon the nature and level of risk involved. A financial institution handling highly confidential information may have stronger grounds for certain forms of monitoring than an organisation where the same risks do not arise. Proportionality requires the surveillance mechanism to be commensurate with the particular risk it is intended to address, rather than applied uniformly simply because the technology is available.
5.4 Transparency - Does the employee know what is being monitored and why?
An employee should not ordinarily be left to discover the existence or extent of workplace surveillance after the monitoring has begun. Transparency requires meaningful information about what information is collected, the purpose of the collection, how it is used, who may access it and, where relevant, how long it will be retained.10 This is particularly important where surveillance is not obvious. An employee may reasonably understand that CCTV operates within an office or that a biometric system records attendance. The same cannot necessarily be assumed where an organisation silently records keystrokes, monitors browsing activity or deploys software that measures periods of inactivity.
Transparency serves more than an informational function. It enables employees to understand the nature and limits of the monitoring to which they are subject and allows them to exercise the rights afforded to them under data protection law.
5.5 Retention and Access — How long should the information be kept, and who should have access to it?
The analysis should not end once information has been lawfully collected. The employer should also consider how long the information remains necessary and who genuinely needs access to it. Continuous monitoring can generate significant volumes of personal information. Retaining months of screenshots, detailed location histories or extensive records of employee activity merely because the information may potentially become useful at some future point may be difficult to reconcile with the principle of storage limitation. Similarly, access to monitoring information should be restricted to persons who have a legitimate need to use it.
For example, an employee’s detailed productivity-monitoring records should not automatically be available to every member of the human resources department simply because the information is held by the organisation. Appropriate retention periods and access controls are therefore essential safeguards against the secondary use or unnecessary exposure of employee information.
These five considerations provide a practical framework for assessing workplace surveillance. A legitimate purpose is the starting point, not the conclusion. The employer must be able to explain why the monitoring is required, why the particular method has been selected, whether its extent is justified, whether employees have been adequately informed, and whether the resulting information is appropriately retained and accessed. This approach preserves the employer’s legitimate interests while recognising that those interests must operate within the boundaries of the employee’s fundamental rights and the principles of data protection law.
6. High-Risk Surveillance: When a DPIA Becomes Important
It is important to highlight that not all workplace surveillance present the same level of risk to employee privacy. While routine processing, such as recording attendance or administering payroll, may ordinarily present limited privacy concerns, more intrusive forms of monitoring can significantly affect an employee’s rights and freedoms. The NDPA therefore requires a Data Protection Impact Assessment (“DPIA”) where processing is likely to result in a high risk to the rights and freedoms of data subjects by virtue of its nature, scope, context or purpose.
The GAID 2025 further identifies circumstances in which a DPIA is mandatory, including evaluation or scoring (profiling), automated decision-making with legal or similar significant effects, systematic monitoring, processing involving sensitive or highly personal data, and the deployment of innovative technologies that may pose significant risks to privacy.11 These requirements are particularly relevant to workplace surveillance involving biometric systems, facial recognition, GPS tracking, extensive employee monitoring and AI-driven performance or behavioural assessment. The significance of a DPIA in this context extends beyond documenting compliance. It provides an opportunity for an employer to assess the necessity, proportionality and potential impact of a proposed surveillance system before it is deployed. The employer can therefore identify whether the proposed monitoring is genuinely required, whether less intrusive alternatives are available, what risks it may create for employees, and what safeguards should be implemented to mitigate those risks.
This is particularly important where surveillance technologies are capable of generating inferences about employees rather than merely recording observable conduct. An AI system that evaluates productivity, behavioural patterns or engagement, for example, may affect an employee in ways that are not immediately apparent at the point of data collection. A DPIA can assist in identifying these risks and ensuring that privacy considerations are incorporated into the design and operation of the system from the outset.
7. Conclusion
Workplace monitoring is not inherently incompatible with employee privacy. Employers have legitimate interests in protecting their organisations, but those interests do not provide an unrestricted licence to monitor employees. The critical question is whether the nature, extent, method and duration of the monitoring are necessary and proportionate to the purpose pursued. As surveillance technologies become increasingly sophisticated, particularly through artificial intelligence, employers must ensure that technological capability does not become a substitute for legal justification. Ultimately, the line between legitimate workplace oversight and unlawful or disproportionate surveillance should be drawn through purpose limitation, necessity, proportionality, transparency and accountability, with appropriate safeguards applied where monitoring presents heightened risks to employee privacy.
Footnotes
1 Chisom Ofoma, Associate, Intellectual Property & Technology Department, S.P.A. Ajibade & Co., Lagos, Nigeria.
2 Information Commissioner’s Office, ‘Data Protection and Monitoring Workers’ available at (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers/?search=example&utm_source=chatgpt.com) accessed on 2 September, 2026.
3 Trade Union Congress, ‘What is Workplace Monitoring’ available at (https://www.tuc.org.uk/i%E2%80%99ll-be-watching-you-what-workplace-monitoring) accessed on 2 September, 2026.
4 AttendanceBot Blog, ‘Navigating the 8 Most Popular Types of Employee Monitoring’ available at (https://www.attendancebot.com/blog/types-of-employee-monitoring/) accessed on 10 September, 2026.
5 Nigeria Data Protection Act, 2023 (Act No. 37, Vol. 110 of the Official Gazette of the Federal Republic of Nigeria).
6 See NDPA 2023, s.24.
7 General Application and Implementation Directive (NDPA GAID) 2025.
8 See NDPA 2023, s 34.
9 GAID 2025, art 26.
10 DLA Piper Africa, ‘Workplace Surveillance and Employee Rights: Where Should Organisations Draw the Line’ available at
(https://www.dlapiperafrica.com/en/nigeria/insights/2025/workplace_surveillance_and_employee_ rights) accessed on 15 September 2026.
11 GAID, 2025 art 28.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
