Can Your Employer Monitor Your Laptop, Emails and Teams Messages in India?

Introduction

You are working from your office laptop.

You send a message to a colleague on Microsoft Teams.

You browse a website during lunch.

You log in from home.

Later, your manager seems to know:

• which websites you visited;
• when you logged in;
• whom you emailed;
• how long you were active;
• and what you wrote in a company Teams conversation.

Can your employer legally monitor all of this?

Does using a company laptop mean you have no privacy at all?

Can an employer secretly read every email and chat message?

What if the laptop belongs to you but the company installed monitoring software?

And can an employer track your location, webcam, screenshots or keystrokes throughout the working day?

The answer under Indian law is not:

“Employers can monitor anything because they own the laptop.”

Nor is it:

“Employees have an absolute right to privacy at work.”

The legal position is more nuanced.

Employers can have legitimate reasons to monitor company systems for purposes such as:

• cybersecurity;
• prevention of data theft;
• investigation of misconduct;
• protection of trade secrets;
• compliance;
• productivity administration;
• prevention of harassment;
• and preservation of business records.

But the existence of a legitimate business interest does not automatically justify unlimited surveillance.

The constitutional right to privacy recognised by the Supreme Court, India’s existing Information Technology framework and the emerging Digital Personal Data Protection regime all point toward a common principle:

workplace monitoring should have a legitimate purpose, be appropriately limited, and avoid unnecessary intrusion into employees’ private lives.

This issue is becoming particularly important in 2026 as Indian workplaces increasingly use:

• endpoint-monitoring software;
• AI productivity tools;
• facial recognition;
• geofencing;
• employee analytics;
• email scanning;
• and collaboration-platform monitoring.

The Short Answer

Yes, an employer in India may monitor activity on:

• company laptops;
• corporate email;
• Microsoft Teams;
• Slack;
• company networks;
• VPNs;
• office systems;
• and other employer-controlled digital infrastructure,

particularly where monitoring is connected to a legitimate employment, security or compliance purpose.

However:

ownership of the device does not create unlimited surveillance rights.

The legality becomes much more questionable where monitoring is:

• secret without justification;
• unrelated to employment;
• disproportionately intrusive;
• extended to private devices or personal accounts without authority;
• continuous when occasional monitoring would suffice;
• used for an unrelated purpose;
• or involves unnecessary disclosure of private employee information.

Is There a Specific “Employee Monitoring Act” in India?

No.

India does not currently have a single comprehensive statute titled something like:

Workplace Surveillance Act.

Instead, the legal position comes from several overlapping sources, including:

• Constitution of India;
• Information Technology Act, 2000;
• employment contracts;
• workplace IT policies;
• confidentiality obligations;
• sector-specific regulation;
• Digital Personal Data Protection Act, 2023;
• Digital Personal Data Protection Rules, 2025;
• and judicial privacy principles.

The applicable law can also differ between:

• private employers; and
• Government or public-sector employers.

The Starting Point: Right to Privacy

The Supreme Court’s nine-judge Bench in Justice K.S. Puttaswamy (Retd.) v. Union of India recognised privacy as a constitutionally protected right forming part of:

• liberty;
• dignity;
• and personal autonomy.

Privacy protection can include informational privacy—the ability of individuals to retain meaningful control over information about themselves.

But privacy is not absolute.

Restrictions can be justified where supported by law, directed toward a legitimate purpose, proportionate and accompanied by safeguards.

This proportionality framework has become particularly important as technology allows organisations to collect increasingly granular information about individuals.

Does an Employee Lose Privacy by Entering the Workplace?

No.

Employment does not erase personal autonomy.

A person does not cease having privacy interests merely because:

• they entered an office;
• connected to corporate Wi-Fi;
• or received a company laptop.

However, the employee’s reasonable expectation of privacy may be reduced when using infrastructure that the employer:

• owns;
• administers;
• secures;
• and expressly states may be monitored.

For example, an employee should ordinarily expect less privacy in:

employee@company.com

than in:

the employee’s privately owned personal email account.

Company Laptop vs Personal Laptop

This distinction is crucial.

Company-owned laptop

The employer has significantly stronger grounds to:

• manage the device;
• install security software;
• maintain logs;
• restrict websites;
• monitor malware;
• investigate security incidents;
• and inspect business files.

Employee-owned laptop

If an employee uses their own computer under a BYOD arrangement, the employer’s legitimate interest will usually be narrower.

The employer may legitimately manage:

• corporate applications;
• company files;
• work email;
• company VPN;
• or a segregated work profile.

But claiming unrestricted access to:

• personal photographs;
• private WhatsApp;
• personal email;
• family documents;
• banking records;
• or unrelated browser history

would raise much more serious privacy concerns.

Company Ownership Does Not Mean “No Privacy”

Suppose an employer gives an employee a laptop and says:

“This belongs to us, therefore we can activate your webcam whenever we want.”

That conclusion does not necessarily follow from ownership.

Ownership of physical hardware does not automatically justify every possible use of surveillance technology.

The relevant questions include:

• Why is the monitoring being conducted?
• Was the employee informed?
• What data is being collected?
• Is that data necessary?
• How long is it retained?
• Who can access it?
• Is a less intrusive method available?
• Does monitoring continue outside work?
• Is monitoring occurring inside the employee’s home?

These questions matter increasingly under modern privacy law.

Can Your Employer Read Your Work Emails?

Potentially, yes.

Corporate email systems are commonly operated and administered by the employer.

Depending on:

• company policy;
• IT architecture;
• administrator permissions;
• cybersecurity tools;
• and legal requirements,

the organisation may have technical access to work emails.

Legitimate reasons can include:

• investigating data leakage;
• responding to litigation;
• recovering business records after an employee leaves;
• investigating harassment;
• cybersecurity review;
• fraud investigation;
• or regulatory compliance.

But access should still be connected to a legitimate organisational purpose.

“Work Email” Is Not the Same as “Personal Email”

Suppose an employee opens Gmail in a browser on the company laptop.

Does the company automatically acquire the right to read their private Gmail inbox?

No such blanket proposition follows merely because the hardware belongs to the company.

An employer may technically log:

• network traffic;
• websites visited;
• device activity;
• or security events,

depending on its systems.

But intentionally accessing the contents of an employee’s private account raises a much more serious legal issue.

There is an important distinction between:

monitoring corporate infrastructure

and

taking over a person’s private communications.

Can an Employer Read Microsoft Teams Messages?

Potentially, yes, particularly where the Microsoft Teams account is provided and administered by the employer.

Employees should not assume that a corporate Teams conversation has the same level of privacy as:

• a personal encrypted messaging account;
• or a private conversation on a privately controlled device.

Depending on the organisation’s technical configuration and retention/compliance systems, company administrators may be able to preserve or retrieve:

• messages;
• meeting information;
• files;
• recordings;
• timestamps;
• account activity;
• and related metadata.

Therefore, as a practical rule:

Do not treat corporate collaboration platforms as private personal messaging spaces.

That does not mean every manager is entitled to casually browse every conversation.

Access should still follow:

• company authority;
• role-based permissions;
• policy;
• legitimate business purpose;
• and applicable privacy principles.

Can Your Boss Secretly Read Every Teams Chat?

That becomes considerably more problematic.

There is a difference between an organisation maintaining records for:

• cybersecurity;
• legal compliance;
• HR investigations;
• or business continuity

and a supervisor routinely reading private employee conversations merely out of curiosity.

Monitoring that is:

• arbitrary;
• voyeuristic;
• retaliatory;
• discriminatory;
• or unrelated to business purpose

is much harder to justify.

Can Employers Monitor Slack, Zoom or Other Work Platforms?

The same broad principles apply.

Where an account belongs to the organisation and is used for business activity, employees should anticipate a degree of:

• administration;
• logging;
• retention;
• security monitoring;
• and authorised investigation.

The precise technical capability differs across services and subscription plans.

But from a legal perspective, the question remains:

Was the monitoring legitimate, transparent enough, necessary and proportionate to the business purpose?

Can Employers Track Which Websites You Visit?

On a company device or network, yes, this is often technically possible and may have legitimate purposes.

For example:

• malware prevention;
• blocking gambling or pornography;
• preventing data exfiltration;
• detecting phishing;
• bandwidth management;
• enforcing workplace policy.

An employer may therefore legitimately maintain network logs.

However, storing a detailed lifelong profile of every employee’s browsing behaviour for no defined purpose would raise different concerns.

What About Browsing During Lunch?

The fact that activity occurs during a lunch break does not automatically take it outside corporate-system monitoring if the employee is still:

• using a company device;
• connected to company Wi-Fi;
• or using corporate systems.

But employers should still distinguish between legitimate infrastructure security and intrusive monitoring of unrelated personal behaviour.

Can Your Employer Monitor Incognito Mode?

Incognito/private-browser mode principally affects what is stored locally in the browser.

It does not necessarily hide activity from:

• employer network administrators;
• VPNs;
• endpoint-security tools;
• internet gateways;
• or other enterprise monitoring systems.

So:

Incognito mode does not create legal or technical privacy from a corporate network.

Can an Employer Take Screenshots of Your Screen?

Employee-monitoring software can technically be configured to take periodic screenshots.

Whether doing so is legally justified depends heavily on context.

Occasional screenshots used to investigate:

• suspected data theft;
• cybersecurity incidents;
• or serious misconduct

may be easier to justify than continuous screenshot capture of every employee every minute.

Continuous screenshots may capture:

• private messages;
• banking activity;
• passwords;
• medical information;
• family conversations;
• privileged communications;
• or unrelated personal data.

That substantially increases privacy risk.

Can Employers Monitor Keystrokes?

Keystroke logging is among the most intrusive forms of workplace surveillance.

It may capture:

• passwords;
• personal communications;
• financial credentials;
• medical searches;
• private conversations;
• and confidential information unrelated to work.

Accordingly, routine continuous keylogging requires especially strong justification.

Installing such tools merely because:

“We want to know exactly what employees type”

would raise serious proportionality concerns.

Can the Employer Activate Your Webcam?

This is an even more intrusive scenario.

Remote activation of webcams inside an employee’s home can potentially reveal:

• family members;
• children;
• private living spaces;
• intimate activity;
• religious practices;
• medical circumstances;
• and other information wholly unrelated to employment.

Such monitoring would be difficult to justify merely as ordinary productivity supervision.

If video attendance is genuinely required, a transparent and narrowly confined process is significantly different from covert continuous webcam surveillance.

Can the Employer Listen Through the Laptop Microphone?

Continuous covert audio monitoring would raise similar—and potentially even stronger—privacy concerns.

A microphone can capture conversations involving:

• spouses;
• lawyers;
• doctors;
• clients;
• family;
• and people who are not employees at all.

Those third parties have privacy interests too.

The fact that monitoring software is technically capable of doing something does not establish that doing it is legally appropriate.

Can an Employer Track Employee Location?

Potentially, particularly where location is genuinely connected to:

• attendance;
• delivery;
• field work;
• employee safety;
• logistics;
• fleet operations;
• or another legitimate function.

But 24-hour location tracking is significantly harder to justify merely because an employee uses a company phone.

Delhi High Court 2026: ONGC Facial Recognition and Geofencing Case

A particularly relevant recent development is ONGC Officers Association v. Oil and Natural Gas Corporation Ltd., decided by the Delhi High Court on 23 April 2026.

ONGC had introduced its SAMAY attendance system through the iXpert mobile application.

The system involved:

• geofenced attendance;
• facial recognition;
• and liveness checks requiring employees to smile and blink.

Employees challenged the arrangement on privacy grounds.

The Delhi High Court declined to strike down the system on the material then before it.

A critical factual consideration was that ONGC represented that the system was being used to verify:

• location at punch-in; and
• location at punch-out,

rather than continuously tracking employees throughout their workday.

Limited Verification vs Continuous Surveillance

The Court expressly recognised that:

• facial recognition;
• location information;
• and liveness checks

involve collection of personal data and engage privacy concerns.

But the Court distinguished:

limited attendance verification

from

continuous or roving surveillance.

It noted that there was no evidence at that stage that employees were continuously tracked through:

• lunch areas;
• restrooms;
• or other workplace locations.

This distinction is extremely useful beyond biometric attendance.

The Court Left the Door Open for Future Challenges

The Delhi High Court made an important qualification.

It stated that dismissal of the challenge was based on the system as described by ONGC.

If actual implementation later involved:

• continuous tracking;
• excessive data collection;
• or use beyond attendance verification,

employees could seek appropriate legal relief.

That is perhaps the most important 2026 workplace-privacy development.

It suggests a practical principle:

A legitimate employment objective does not automatically justify unlimited data collection.

Facial Recognition Is Not Automatically Illegal

Employers increasingly use:

• facial attendance;
• fingerprint readers;
• iris systems;
• location verification.

These technologies are not automatically unlawful merely because they process biometric information.

But proportionality becomes important.

Employers should ask:

• Is biometric attendance necessary?
• Is there a less intrusive alternative?
• Is the biometric template stored securely?
• Who processes it?
• How long is it retained?
• Can it be reused for another purpose?
• Is third-party access controlled?

The ONGC judgment expressly recognised concerns regarding:

• data ownership;
• access control;
• retention;
• third-party service providers;
• and security.

What Does the DPDP Act Say About Employment?

The Digital Personal Data Protection Act, 2023 is highly significant because Section 7(i) specifically contemplates processing personal data:

• for purposes of employment; or
• for safeguarding the employer from loss or liability.

The statute gives examples including:

• prevention of corporate espionage;
• maintaining confidentiality of trade secrets;
• intellectual property;
• classified information;
• and providing employee services or benefits.

This means Parliament expressly recognised that employers can have legitimate reasons to process employee data without treating every employment-related processing operation identically to consumer consent.

But There Is a Major 2026 Commencement Caveat

This point must be stated accurately.

The DPDP Rules were notified in November 2025, and the Data Protection Board was established.

However, the Central Government’s commencement notification provides that substantive provisions including:

• Sections 3–5;
• most of Section 6;
• Section 7;
• Sections 8–17;
• and several enforcement provisions

will commence 18 months after publication of the November 2025 Gazette notification.

Similarly, many of the operational DPDP Rules commence after the same 18-month transition period.

Therefore, as of October 2026, employers should be preparing for this framework, but it is legally inaccurate to assume that every substantive DPDP employment-processing obligation is already fully operative.

Why Section 7(i) Will Matter Once Operative

Once the relevant provisions commence, Section 7(i) is likely to become particularly important for:

• internal fraud investigations;
• cybersecurity monitoring;
• trade-secret protection;
• employee administration;
• access controls;
• business continuity;
• and certain compliance monitoring.

But Section 7(i) should not be read as:

“Employers may collect anything they want.”

The broader DPDP framework imposes responsibilities on Data Fiduciaries.

For example, Section 8 requires organisations to implement technical and organisational measures and reasonable security safeguards for personal data under their control.

“Employment Purpose” Should Not Become a Blank Cheque

Imagine an employer says:

“We track employees 24 hours a day because they are employees.”

That interpretation would stretch the employment purpose far beyond its natural scope.

A defensible monitoring programme should be connected to identifiable purposes such as:

• attendance;
• information security;
• compliance;
• investigation;
• or protection of company property.

The more remote the data is from the stated purpose, the harder the surveillance is to justify.

Data Minimisation

A good privacy principle is:

Collect what you actually need—not everything technology allows you to collect.

Suppose attendance requires knowing whether an employee arrived at the office at 9 a.m.

An app that checks location only at:

• punch-in; and
• punch-out

is less intrusive than an app that records GPS coordinates every 30 seconds throughout the day.

That distinction closely resembles the reasoning in the 2026 ONGC case.

Purpose Limitation

Suppose an employer collects facial information solely for office attendance.

Two years later it quietly uses that database to analyse:

• employee emotions;
• behaviour;
• social interactions;
• or marketing characteristics.

That involves a substantially different purpose.

Privacy-compliant governance should ask whether new uses are legitimately connected to the original purpose and legal basis.

Storage Limitation

Employers should also ask:

How long do we actually need these logs?

Keeping:

• login history;
• email archives;
• CCTV;
• location records;
• screenshots;
• biometric templates

forever simply because storage is cheap increases:

• breach risk;
• misuse risk;
• employee profiling;
• and compliance exposure.

The notified DPDP framework expressly emphasises responsible data handling, security and accountability.

Security Becomes Especially Important

If an employer monitors employees, the employer itself creates a highly sensitive database.

It may contain:

• communications;
• behavioural patterns;
• identity data;
• location;
• access credentials;
• performance records;
• internal complaints.

A breach of the monitoring platform could therefore be more damaging than the misconduct the system was designed to detect.

Employers must consider:

• encryption;
• access controls;
• role-based permissions;
• audit logs;
• vendor security;
• deletion schedules;
• and incident-response plans.

Third-Party Monitoring Vendors

Many employers do not build monitoring technology themselves.

They use outside vendors providing:

• endpoint monitoring;
• employee analytics;
• attendance apps;
• biometric verification;
• cloud email;
• HR systems;
• productivity scoring.

The Delhi High Court specifically noted that third-party involvement in ONGC’s attendance application raised legitimate questions regarding data protection and access to sensitive information.

An employer cannot safely say:

“The vendor collected it, therefore we are not responsible.”

Information Technology Act Still Matters

Section 72A of the Information Technology Act addresses disclosure of personal information obtained while providing services under a lawful contract where disclosure occurs without consent or in breach of contract, with the prescribed wrongful-loss/wrongful-gain element.

The provision has been amended into a civil-penalty framework, and current India Code materials show a penalty exposure extending up to ₹25 lakh under Section 72A.

This provision is particularly relevant to unauthorised disclosure of personal information.

Monitoring and disclosure should therefore not be treated as identical questions.

An employer may have legitimate access to information internally but still face issues if that information is unnecessarily circulated outside the permitted purpose.

Can HR Share Your Private Messages With Everyone?

Usually there should be no legitimate reason for indiscriminate publication.

Suppose HR lawfully obtains relevant Teams messages during an investigation into harassment.

That does not necessarily justify forwarding them to:

• the entire company;
• unrelated employees;
• social media;
• or external parties with no legitimate role.

Access should ordinarily follow a need-to-know structure.

Employment Contracts Matter

A clear employment agreement or IT policy can significantly affect expectations.

Policies commonly state that:

• company systems are for business use;
• network activity may be logged;
• email may be monitored;
• company files remain company property;
• security tools may inspect devices;
• communications may be retained.

Such policies can help demonstrate transparency.

However, an employment contract cannot necessarily validate conduct that is independently unlawful or grossly disproportionate.

A clause saying:

“Employee waives every privacy right forever”

should not be treated as magic language permitting any imaginable surveillance.

Employee Consent Can Be Complicated

Employment relationships involve unequal bargaining power.

An employee may have little genuine ability to say:

“I refuse the monitoring clause but still want the job.”

That is why modern privacy frameworks increasingly focus on:

• necessity;
• legitimate use;
• proportionality;
• and accountability

rather than relying entirely on boilerplate consent.

The DPDP Act’s express employment-related legitimate-use provision reflects this practical reality.

Can Employers Monitor Productivity?

Potentially.

Examples include tracking:

• attendance;
• work applications used;
• task completion;
• corporate system activity;
• ticket resolution;
• project hours.

But there is an important distinction between:

measuring work

and

monitoring every movement of the worker.

An employer may legitimately measure whether assigned work is completed.

That does not necessarily justify:

• constant webcam recording;
• every keystroke;
• every mouse movement;
• or continuous GPS tracking.

“Mouse Jiggler” Detection

Remote-work systems increasingly measure:

• keyboard activity;
• mouse movement;
• idle time;
• active applications.

Employers may have legitimate reasons to detect:

• time fraud;
• fake attendance;
• automated activity.

But treating absence of mouse movement as automatic proof of non-work can be unreliable for employees whose tasks involve:

• calls;
• meetings;
• reading;
• thinking;
• presentations;
• or offline work.

Monitoring evidence should therefore be interpreted carefully.

Can Monitoring Be Used to Fire an Employee?

Potentially.

Digital logs can become evidence in disciplinary proceedings involving:

• data theft;
• harassment;
• unauthorised access;
• confidential-information leaks;
• time fraud;
• policy violations.

But employers should still follow:

• contractual procedure;
• applicable service rules;
• principles of natural justice where required;
• disciplinary policy;
• and relevant labour/employment law.

A monitoring report is evidence—not necessarily conclusive proof.

Example: Data Theft

An employee downloads thousands of confidential customer records immediately before resigning.

The company’s security system logs:

• USB access;
• file copying;
• cloud upload.

Monitoring aimed at identifying potential data exfiltration falls close to the legitimate employer-loss and confidentiality interests expressly contemplated by Section 7(i) of the DPDP Act’s future operative framework.

Example: Reading Personal WhatsApp

An employee logs into personal WhatsApp Web on the office laptop.

The employer deliberately opens private family conversations unrelated to work simply to learn about the employee’s personal life.

This is materially different from identifying:

• malware;
• network traffic;
• or corporate data leakage.

The more unrelated the surveillance is to employment, the more difficult it becomes to justify.

Example: Teams Harassment Complaint

An employee alleges sexual harassment through Teams.

The organisation retrieves the relevant corporate chat history for an internal investigation.

That is much easier to justify than routinely reading all Teams conversations of every employee.

Example: Continuous Webcam Monitoring From Home

A remote employee must keep the laptop camera active eight hours a day so management can confirm that they remain physically at their desk.

The system captures:

• spouse;
• children;
• private home;
• meals;
• personal movements.

This is highly intrusive.

The employer would need a much stronger justification than ordinary productivity supervision, particularly where less intrusive methods exist.

Example: Security Logs

A company records:

• login time;
• IP address;
• suspicious file downloads;
• failed password attempts.

This is comparatively easier to justify because it directly relates to:

• information security;
• access control;
• and system integrity.

Can Employer Monitoring Continue After You Resign?

The employer may legitimately preserve business records created during employment where necessary for:

• litigation;
• compliance;
• investigation;
• business continuity;
• statutory retention.

But continuing to monitor an individual’s new personal devices or accounts after employment ends would require an independent lawful basis.

An old employment relationship does not authorise perpetual surveillance.

Can Employers Access an Ex-Employee’s Work Mailbox?

Potentially, yes.

A corporate mailbox is generally part of the employer’s business infrastructure.

After departure, businesses may require access for:

• continuity;
• retrieving customer correspondence;
• litigation;
• regulatory requirements.

But employers should avoid impersonating the former employee in a misleading manner.

A better practice is to:

• disable login;
• preserve required records;
• redirect legitimate business enquiries;
• and use an automated notice informing senders that the employee has left.

What About Personal Messages in the Corporate Mailbox?

This illustrates why employees should avoid using work email for deeply personal matters.

If an employee uses a corporate mailbox for personal communications, those messages may become mixed into a system the employer legitimately administers.

That does not necessarily eliminate every privacy interest, but it can substantially reduce practical confidentiality expectations.

Can Employers Monitor Personal Phones Connected to Office Wi-Fi?

The employer may be able to monitor network-level information transmitted through infrastructure it controls.

But connecting a private phone to Wi-Fi does not automatically grant the employer unlimited authority to:

• enter the device;
• copy its photographs;
• read WhatsApp;
• access personal banking apps;
• or install spyware.

Network administration and device takeover are legally very different activities.

BYOD Policies Are Essential

Bring Your Own Device arrangements should clearly define:

• what company software can access;
• whether remote wipe is possible;
• whether only work containers are managed;
• what happens when employment ends;
• what data is logged;
• whether location is collected.

Without clear boundaries, BYOD programmes can create significant disputes.

Remote Wipe

Suppose an employer installs enterprise management software on a personal phone.

When the employee leaves, IT triggers a full-device wipe and deletes:

• family photos;
• personal files;
• private contacts.

If the employee had been told only that company data would be removed, this could create serious legal and contractual issues.

Work data should ideally be segregated technically from personal data.

Can the Employer Monitor You Outside Working Hours?

Sometimes legitimate interests extend beyond fixed working hours.

For example:

• a corporate laptop may still need antivirus protection at midnight;
• security systems may log unauthorised login attempts;
• company information remains confidential outside office hours.

But monitoring an employee’s unrelated personal activities after work is much harder to justify.

A company-security tool continuing to detect malware is different from a manager tracking:

• where the employee goes for dinner;
• whom they meet;
• what they watch;
• or what they say at home.

Workplace CCTV

CCTV is another common form of workplace monitoring.

Legitimate purposes may include:

• physical security;
• theft prevention;
• access control;
• employee safety.

But camera placement matters.

Surveillance in ordinary:

• entrances;
• warehouses;
• cash areas

is very different from surveillance in highly private spaces such as:

• toilets;
• changing rooms;
• or similar intimate environments.

An employer should never treat CCTV permission as unlimited.

Audio Recording Through CCTV

Audio surveillance can be more intrusive than video because it can capture the content of conversations.

Employers should therefore separately assess whether sound recording is actually necessary rather than assuming that a camera automatically justifies microphone recording.

Workplace Biometrics in 2026

The ONGC judgment makes biometrics especially topical.

The Delhi High Court acknowledged that systems collecting:

• facial images;
• location information;
• and liveness signals

raise real privacy concerns.

It nevertheless declined to interfere where the available evidence showed limited attendance verification rather than continuous movement tracking.

For employers, the message is:

design the system around the narrow business purpose.

Less Intrusive Alternatives Matter

Suppose the employer’s objective is simply attendance.

Potential mechanisms could include:

• ID card;
• fingerprint;
• facial recognition;
• mobile GPS;
• permanent tracking.

These alternatives have very different privacy consequences.

The Delhi High Court expressly acknowledged in the ONGC matter that the existence of a less intrusive functional alternative can be relevant to proportionality, even though it did not invalidate the system on the facts before it.

Can Employees Demand to Know They Are Being Monitored?

A strong compliance approach is to tell employees clearly:

• what monitoring occurs;
• why;
• what information is collected;
• who can access it;
• retention period;
• whether vendors receive it;
• and how grievances can be raised.

The DPDP Rules’ future notice framework requires clear, standalone information about personal-data collection and purpose once the relevant provisions come into force.

Employers should therefore begin implementing transparent notices before the mandatory transition deadline.

Secret Monitoring May Sometimes Be Justified

Transparency does not mean that every investigation must warn the employee immediately.

Suppose the company has credible evidence that an employee is:

• stealing trade secrets;
• committing fraud;
• sabotaging systems.

Telling the employee:

“Tomorrow we will secretly monitor whether you steal the files”

could defeat the investigation.

Limited covert investigation may be easier to justify where:

• suspicion is concrete;
• monitoring is targeted;
• duration is limited;
• authorisation is senior-level;
• and evidence is preserved securely.

But permanent covert surveillance of the entire workforce is a different proposition.

Can AI Analyse Employees?

Employers increasingly use software to produce:

• productivity scores;
• risk scores;
• behaviour analysis;
• attrition predictions;
• communication sentiment;
• performance rankings.

These systems create additional concerns.

Automated tools can:

• misunderstand context;
• reproduce bias;
• incorrectly label employees;
• convert weak behavioural indicators into disciplinary evidence.

Employers should therefore be cautious about making serious employment decisions solely on opaque algorithmic scores.

Can Employers Analyse Teams Messages With AI?

Technically, workplace systems may increasingly permit analysis of corporate communications.

But using AI to scan messages for:

• malware;
• data leaks;
• harassment

is different from using AI to infer:

• political beliefs;
• health status;
• emotional state;
• personal relationships

without a genuine workplace need.

The more sensitive the inference, the stronger the privacy and fairness concerns.

Privileged Communications

Monitoring policies should also account for legally privileged communications.

Suppose an employee communicates with their lawyer through a webmail service.

An employer’s monitoring system should not automatically assume that every captured communication can be freely used merely because it passed through a company device.

Privilege questions can require separate legal analysis.

Whistleblowers

Monitoring should not be weaponised to punish:

• lawful whistleblowing;
• protected complaints;
• workplace harassment reporting;
• or legitimate regulatory disclosures.

If monitoring is used selectively to identify and retaliate against complainants, the organisation may face legal exposure beyond privacy law.

Union Activity and Collective Rights

Similar concerns can arise where monitoring targets legitimate:

• employee association;
• collective representation;
• or lawful workplace organising.

The lawfulness will depend on the applicable employment framework and conduct involved.

Monitoring should not become a pretext for prohibited retaliation.

What Employers Should Include in a Monitoring Policy

A well-designed policy should cover:

1. Devices covered.
2. Systems covered.
3. Types of monitoring.
4. Business purpose.
5. Categories of information collected.
6. Whether emails may be accessed.
7. Whether chats are retained.
8. Network logging.
9. CCTV.
10. Location collection.
11. Biometrics.
12. Remote-work monitoring.
13. BYOD.
14. Vendor access.
15. Retention periods.
16. Internal access controls.
17. Investigation procedure.
18. Employee grievance contact.
19. Security safeguards.
20. Exit/deletion procedures.

The policy should be readable.

Hiding surveillance terms inside a 150-page employee manual undermines meaningful transparency.

Employee Checklist

Before using company systems, check:

• employment agreement;
• IT policy;
• acceptable-use policy;
• privacy notice;
• BYOD policy;
• Teams/email retention policy;
• remote-work policy.

Assume that work systems may generate logs.

Keep genuinely private activity on personal systems where lawful and practical.

Do not use company devices to store:

• private financial documents;
• highly personal photographs;
• unrelated sensitive files

unless genuinely necessary.

Warning Signs of Excessive Monitoring

Employees may want legal advice where they discover:

• secret webcam activation;
• continuous microphone recording;
• spyware on a private phone;
• 24-hour GPS tracking unrelated to work;
• personal-account access;
• recording inside intimate areas;
• monitoring continuing after resignation;
• public disclosure of private messages;
• monitoring used for harassment or retaliation.

These situations are very different from ordinary corporate cybersecurity logging.

Can You Sue Your Employer?

Potential remedies depend heavily on the employer and conduct.

Possibilities may include:

• internal grievance;
• employment proceedings;
• contractual action;
• Information Technology Act remedies;
• constitutional proceedings against State/public authorities;
• data-protection remedies once applicable provisions are operational;
• or other civil/criminal remedies depending on conduct.

A private-company dispute and a public-sector surveillance challenge can follow very different procedural routes.

Government Employer vs Private Employer

This distinction is important.

Where a Government authority or instrumentality is responsible for surveillance, Article 21 privacy principles can be invoked directly through constitutional review.

That is why proportionality was directly relevant in the 2026 ONGC litigation.

Private employment disputes may rely more heavily on:

• statutory duties;
• contracts;
• information-technology law;
• employment law;
• and the developing DPDP framework.

Common Myths

Myth 1: “If the laptop belongs to the company, employees have zero privacy.”

Incorrect.

Company ownership strengthens legitimate administrative control but does not automatically justify unlimited surveillance.

Myth 2: “Employers can never read employee email.”

Incorrect.

Corporate email may legitimately be accessed for security, business continuity, investigation and compliance.

Myth 3: “Teams messages are private because they are direct messages.”

Not necessarily.

Corporate Teams environments can be subject to employer administration, retention and authorised compliance access.

Myth 4: “An employer can read my personal Gmail simply because I opened it on a work laptop.”

Too broad.

Monitoring corporate infrastructure is not equivalent to unlimited authority over private accounts.

Myth 5: “Employee monitoring is illegal without consent.”

Too broad.

Legitimate employment and security purposes can justify certain processing; the DPDP Act itself expressly contemplates employment-related legitimate use once Section 7 becomes operative.

Myth 6: “The DPDP Act is already fully enforceable against all workplace monitoring in October 2026.”

Incorrect.

The commencement notification phases in the substantive provisions, including Section 7 and Sections 8–17, after an 18-month transition period.

Myth 7: “Face-recognition attendance is automatically unconstitutional.”

Incorrect.

The Delhi High Court declined to strike down ONGC’s limited geofenced facial attendance system in April 2026, while expressly preserving the possibility of challenge if it became continuous or excessive surveillance.

Myth 8: “If monitoring is technically possible, it must be legal.”

Incorrect.

Technical capability and lawful justification are different questions.

Frequently Asked Questions

Can my employer monitor my office laptop?

Generally, yes, particularly for legitimate:

• security;
• compliance;
• administration;
• and investigation

purposes.

But monitoring should not become unrelated or disproportionately intrusive surveillance.

Can my employer read my company email?

Potentially yes.

A corporate email account is generally administered by the employer and may be subject to lawful business access and retention.

Can my employer read Teams messages?

Depending on the corporate account configuration and authorised administrative systems, work Teams communications may be retrievable or retained.

Employees should not assume corporate Teams messages are personal private communications.

Can my employer monitor private Gmail?

The mere fact that Gmail was opened on a company laptop does not automatically grant unlimited authority to access a private account.

The analysis differs from network or endpoint logging.

Can the company see my browser history?

On employer-managed systems or networks, this is often technically possible.

Whether collection is justified depends on purpose and scope.

Can my employer track my location?

Potentially where location is genuinely necessary for:

• attendance;
• field work;
• logistics;
• or security.

Continuous off-duty tracking is much harder to justify.

Can employers use facial recognition for attendance?

Potentially.

The Delhi High Court upheld ONGC’s system at the interim factual level in April 2026 because the evidence showed geofenced punch-in/punch-out verification rather than continuous employee tracking.

Can my employer record me through my webcam all day?

Such continuous monitoring would be highly intrusive and would require significantly stronger justification than ordinary productivity management.

Can the company monitor my personal phone?

A BYOD arrangement may allow limited management of company data or applications.

It does not automatically justify unrestricted access to the entire personal device.

Is the DPDP Act relevant to employees?

Yes.

Section 7(i) expressly addresses employment and safeguarding the employer from loss or liability.

However, the Government’s commencement notification provides that Section 7 and many other substantive provisions become effective after the prescribed 18-month transition period.

Practical Test: Is Workplace Monitoring Reasonable?

Ask six questions.

1. Purpose

Why is the information being collected?

2. Necessity

Is monitoring actually needed?

3. Scope

Is the employer collecting more than necessary?

4. Transparency

Has the employee been adequately informed?

5. Security

Who can see the information and how is it protected?

6. Retention

How long will it be kept?

An employer that cannot answer these questions has a much weaker compliance position.

The Most Important Distinction: Managing Company Systems vs Monitoring Private Life

The simplest way to understand workplace surveillance law is to separate two scenarios.

Legitimate workplace management

The employer:

• secures corporate systems;
• logs access attempts;
• monitors malware;
• preserves business email;
• investigates genuine data theft;
• checks attendance;
• reviews relevant corporate communications during a misconduct inquiry.

These activities can have strong legitimate justification.

Intrusion into private life

The employer:

• secretly activates home webcams;
• records family conversations;
• tracks employees throughout weekends;
• reads unrelated private messages;
• copies personal banking information;
• monitors former employees after resignation.

These activities move far beyond ordinary management of employment.

The fact that both involve “technology” does not make them legally equivalent.

Conclusion

Can your employer monitor your laptop, emails and Microsoft Teams messages in India?

Yes—but not without limits.

Employers have legitimate interests in protecting:

• cybersecurity;
• trade secrets;
• intellectual property;
• confidential information;
• business records;
• workplace safety;
• and organisational assets.

Corporate devices and accounts therefore carry a lower expectation of privacy than purely private systems.

Employees should reasonably expect that:

• corporate email;
• Teams;
• company VPNs;
• work laptops;
• and office networks

may generate logs and may be accessed under authorised company procedures.

But employer ownership is not a blank cheque for unlimited surveillance.

The constitutional privacy framework recognised in K.S. Puttaswamy emphasises legitimacy, necessity, proportionality and safeguards.

That approach is particularly visible in the Delhi High Court’s ONGC Officers Association v. ONGC decision of 23 April 2026.

The Court accepted a geofenced facial-recognition attendance system on the facts before it because it was represented as operating only at punch-in and punch-out rather than constantly tracking employees. At the same time, it expressly recognised that biometric and location collection raises real privacy concerns and allowed for future challenge if the system were used for continuous tracking, excessive collection or purposes extending beyond attendance.

The DPDP Act will make workplace data governance even more important.

Section 7(i) specifically contemplates processing for employment and protection of employers against loss or liability, including corporate espionage, trade secrets and intellectual property.

However, the timing must be stated accurately.

Although the DPDP framework and Rules were notified in November 2025, the commencement notification provides an 18-month transition for many substantive provisions—including Section 7 and Sections 8–17. As of October 2026, those provisions are therefore part of the approaching compliance framework rather than a fully operative set of employee-monitoring duties.

The practical rule for employers is:

Monitor the work where genuinely necessary—not the employee’s entire life simply because technology makes it possible.

And for employees:

Treat corporate devices and accounts as business systems, but do not assume that joining a company requires surrendering every expectation of privacy.

This article reflects the Constitution of India, Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Digital Personal Data Protection Rules, 2025, relevant commencement notifications and publicly available judicial developments up to October 2026. The DPDP framework is subject to phased commencement, and individual monitoring arrangements must be assessed according to their purpose, technical design, employment terms and applicable sectoral rules. This article is intended for general legal information and academic discussion and does not constitute legal advice.