Employee monitoring laws in Netherlands
Yes, but the works council holds a consent right — not merely a consultation right — over any arrangement for monitoring attendance, behaviour or performance, and a decision taken without it can be annulled.
Who has to agree before you start
The fact that decides the timeline, and the one that differs most between countries.
The workforce can say no
Under WOR art. 27 the ondernemingsraad must consent to any arrangement covering facilities aimed at or suitable for observing or monitoring the presence, behaviour or performance of staff. An employer decision taken without that consent can be declared void on the council's written objection.
A works council or union must agree before monitoring starts. Plan these first and plan them long: the agreement is a negotiation, not a form, and in Austria and the Netherlands a rollout without it is void or voidable rather than merely irregular.
GDPR as implemented by the Uitvoeringswet AVG (UAVG), with the Wet op de ondernemingsraden (WOR) supplying the works council's consent right, and Autoriteit Persoonsgegevens guidance on employee monitoring.
The law that applies in Netherlands
Named so you can check us, and so your own counsel has somewhere to start.
| Instrument | What it requires |
|---|---|
| WOR art. 27(1)(l) | Requires works council consent for arrangements concerning facilities intended for, or suitable for, observing or monitoring the presence, behaviour or performance of people working in the business. As in Germany, 'suitable for' is an objective test. |
| WOR art. 27(5) | Lets the works council invoke the nullity of a decision taken without its consent, in writing and within a month of learning of it — the enforcement mechanism that gives the consent right its teeth. |
| UAVG and GDPR Art. 6(1)(f) | Legitimate interests is the workable lawful basis; the Autoriteit Persoonsgegevens has repeatedly said employee consent is not normally valid because of the dependency in the relationship. |
| GDPR Art. 35 | The Dutch regulator's list of processing requiring a DPIA includes systematic monitoring of employees, so the assessment is a starting point rather than an optional extra. |
How a rollout is done here
- Check whether an ondernemingsraad exists — it is mandatory at 50 or more employees — and route the proposal to it before committing to a rollout date.
- Write the arrangement down: purpose, what is collected, who may see it, retention, and the uses that are excluded. The council consents to a document, not to a demo.
- Run the DPIA and the legitimate-interests balancing test, and share the substance with the council.
- Inform employees directly under Arts. 13–14; the council's consent does not discharge individual transparency.
- Re-obtain consent when the arrangement changes materially.
What gets a rollout refused
- Confusing art. 27 consent with art. 25 advice. Monitoring falls under the consent right, and the remedies for skipping it are much sharper.
- Covert monitoring. The AP treats secret monitoring as lawful only in narrowly defined, serious and temporary circumstances, and expects it to have been impossible to achieve the purpose openly.
- Relying on employee consent as the lawful basis.
- Assuming a Dutch branch of a foreign group is covered by a head-office policy; the consent right attaches to the Dutch undertaking.
Monitoring staff in Netherlands — questions
Do we need works council consent if we have fewer than 50 staff?
A works council is only mandatory from 50 employees, so below that there may be no council whose consent is required. The GDPR obligations — lawful basis, DPIA for systematic monitoring, transparency, proportionality — apply regardless of headcount.
Can we monitor employees secretly if we suspect fraud?
Only exceptionally. The Autoriteit Persoonsgegevens expects covert monitoring to be a last resort: a concrete suspicion, a narrow and time-limited scope, no less intrusive route available, a DPIA, and disclosure to the individual afterwards. Continuous covert monitoring of a workforce is not defensible on that basis.
Does the works council get to see the actual data?
It consents to the arrangement, not to individual records. In practice councils negotiate hard on who inside the business can see what, and on whether managers see individual-level detail or only aggregates.
Sources and scope
Primary source: Netherlands regulator and statute references, last read 2026-09-17.
This page is a plain-English summary of published law and regulator guidance, not legal advice, and it is not a substitute for advice on your own facts. Employment and data protection law changes; each page states the date its sources were last read. Before monitoring staff anywhere, take advice from qualified counsel in that country.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.