Employee monitoring laws in Germany
Yes, but in a company with a works council it is effectively impossible without one signing a works agreement first — German law gives the council a veto over technical systems capable of monitoring performance, and the veto is not a formality.
Who has to agree before you start
The fact that decides the timeline, and the one that differs most between countries.
The workforce can say no
The works council must agree, in a signed Betriebsvereinbarung, before the software is introduced. A system rolled out without one can be ordered switched off, and data gathered through it is exposed to an evidence-exclusion argument in any later dispute.
A works council or union must agree before monitoring starts. Plan these first and plan them long: the agreement is a negotiation, not a form, and in Austria and the Netherlands a rollout without it is void or voidable rather than merely irregular.
GDPR, plus the Bundesdatenschutzgesetz (BDSG) and — decisively — the Betriebsverfassungsgesetz, which puts monitoring technology under co-determination rather than under management prerogative.
The law that applies in Germany
Named so you can check us, and so your own counsel has somewhere to start.
| Instrument | What it requires |
|---|---|
| BetrVG § 87(1)(6) | Gives the works council a co-determination right over the introduction and use of technical devices suited to monitoring employee conduct or performance. The courts read 'suited to' objectively: it is enough that the system could monitor, whether or not you intend to use it that way. |
| BDSG § 26 | Governs processing of employee data for the employment relationship, and expressly recognises a collective agreement as a basis for that processing — which is why the Betriebsvereinbarung does double duty as both labour-law permission and data-protection ground. |
| GDPR Art. 88 and CJEU C-34/21 | Article 88 allows member states to make their own employment rules, but the CJEU's 2023 ruling on the Hessen equivalent of § 26 cast doubt on whether such provisions meet Article 88(2)'s requirements. A dedicated federal employee data act has been drafted but is not in force, so most employers now ground monitoring in Art. 6(1)(f) legitimate interests as well as in the works agreement. |
| GDPR Art. 35 | A data protection impact assessment is expected for systematic monitoring of employees, and German supervisory authorities list employee monitoring on their mandatory-DPIA blacklist. |
How a rollout is done here
- Write the DPIA before you contact the works council, not after. The council's first question is what the system collects, and arriving without a documented answer costs you the meeting.
- Approach the works council with a concrete Betriebsvereinbarung draft: what is captured, what is explicitly not, who can see it, how long it is kept, and what it may never be used for.
- Agree a purpose-limitation clause in writing. Councils concede on capture far more readily than on use; a clause saying the data will not ground individual performance management is usually what closes the negotiation.
- Record the lawful basis under Art. 6(1)(f) and run a legitimate-interests balancing test alongside the works agreement, given the uncertainty over § 26 after C-34/21.
- Inform staff under Arts. 13–14 GDPR in German, and keep the works agreement accessible to them.
- Re-open the agreement when the configuration changes. A council agreed to the settings you showed it, not to the product.
What gets a rollout refused
- Rolling out to a German entity on a global configuration signed off in another country. The works council's right attaches to the system as deployed, and 'it is our worldwide standard' is not an answer to it.
- Any feature the council reads as behavioural scoring. A per-employee productivity percentage is the single most common reason a German rollout is refused, and it is far harder to remove from a negotiation than to leave switched off.
- Treating employee consent as the lawful basis. German authorities and the courts treat consent in an employment relationship as rarely freely given, because of the power imbalance.
- Starting the pilot 'informally' before the agreement is signed. That is exactly the fact pattern that produces an injunction and poisons the negotiation.
Monitoring staff in Germany — questions
Can we monitor if we have no works council?
The co-determination right under BetrVG § 87(1)(6) only bites where a council exists, so a company without one has no veto to clear. The data-protection obligations are unchanged: you still need a lawful basis, a DPIA for systematic monitoring, and Art. 13 transparency. Note also that staff can move to establish a council, and doing so in response to a monitoring rollout is not unusual.
Does a works agreement replace the need for a lawful basis under the GDPR?
It supplies one, but prudent practice since CJEU C-34/21 is not to rely on it alone. That ruling questioned whether national employment provisions of the § 26 BDSG type satisfy Art. 88(2), so most German employers now document a legitimate-interests basis under Art. 6(1)(f) in parallel with the collective agreement.
What makes a monitoring tool easier to get past a German works council?
Narrowness that the council can verify, and irreversibility of the things you promise not to do. Councils respond to what a system cannot do far better than to policy commitments about what you will not do with it. Capture that is limited to application and window metadata, with no screen content, no keystroke content and no productivity score, is a much shorter negotiation than a suite where those features exist and are merely switched off.
Are screenshots ever agreed to in Germany?
Rarely, and generally only in narrow, time-boxed, incident-driven circumstances rather than as continuous capture. Continuous screen capture is close to the paradigm case of a measure councils refuse and supervisory authorities treat as disproportionate.
Sources and scope
Primary source: Germany regulator and statute references, last read 2026-09-17.
This page is a plain-English summary of published law and regulator guidance, not legal advice, and it is not a substitute for advice on your own facts. Employment and data protection law changes; each page states the date its sources were last read. Before monitoring staff anywhere, take advice from qualified counsel in that country.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.