More and more companies operating in Poland install cameras, monitor company mailboxes, or use tools that measure team performance. Employee monitoring in Poland, however, is an area where a poorly implemented system can be an expensive mistake — non-compliant monitoring can expose an employer to a financial penalty, a personal-injury claim from an employee, or a breach of personal rights. This article explains the legal basis on which employers in Poland may monitor employees, what formalities must be completed, and where the line runs between lawful oversight and excessive interference with privacy.
1. Legal basis for employee monitoring in Poland
Employee monitoring in Poland rests on two complementary legal sources:
- The Polish Labour Code – Article 22² governs CCTV/video monitoring, while Article 22³ governs monitoring of company email and other forms of employee oversight (e.g. monitoring activity on a company computer or GPS tracking of company vehicles).
- GDPR (Regulation 2016/679) – since video recordings, correspondence content, and activity data are personal data, the employer acts as a data controller and must meet, among other things, the information obligation under Articles 12–13 GDPR and the processing principles under Article 5 GDPR (purpose limitation, data minimisation, storage limitation).
The Labour Code provisions on video and email monitoring were introduced in 2018 as part of aligning Polish law with GDPR. Before that, employers applied monitoring without an explicit statutory basis, which created significant legal uncertainty.
2. CCTV monitoring – when it is allowed
Under Article 22² § 1 of the Labour Code, an employer may introduce special CCTV surveillance of the workplace or the area around it, but only where necessary to ensure:
- employee safety,
- protection of property,
- control over the production process,
- confidentiality of information whose disclosure could damage the employer.
This is a closed list — no other reason (for example, a wish to assess how fast employees work) justifies installing cameras. Importantly, CCTV monitoring under Polish law covers image recording only. The Labour Code gives no basis for simultaneously recording audio — doing so may be treated as an excessive interference with privacy.
3. Where cameras cannot be installed
Monitoring cannot cover premises made available to a workplace trade union organisation. It also cannot cover sanitary facilities, changing rooms, canteens, and smoking rooms — unless this is necessary to achieve one of the four purposes listed above and does not violate the employee's dignity or other personal rights, in particular through the use of techniques that prevent the identification of people present in those rooms. Extending monitoring to sanitary facilities additionally requires the prior consent of the workplace trade union organisation, or, where none operates at the employer, the consent of employee representatives elected under the procedure adopted by that employer.
4. Employer notice obligations
Introducing monitoring comes with several obligations, each with a strictly defined sequence and timing:
- Purpose, scope and method of monitoring must be set out in a collective bargaining agreement, work regulations, or — where the employer is not bound by either — in an official announcement.
- General notice to employees about the introduction of monitoring must be given no later than 2 weeks before it is launched, in a manner customary for that employer.
- Newly hired employees must receive information about the purpose, scope and method of monitoring in paper or electronic form before they are admitted to work.
- Marking the monitored area with clearly visible signs or audible announcements must happen no later than one day before monitoring starts. Pictograms alone are not enough — per the Polish Data Protection Authority's (UODO) position, the employer must still fulfil the information obligation under Article 13 GDPR, which in practice can be done through layered privacy notices (a short notice on-site plus the full text available elsewhere, e.g. in the work regulations).
Covert monitoring is never permitted under Polish law, regardless of the employer's motivation.
5. How long CCTV recordings can be stored
The employer may process video recordings only for the purpose for which they were collected, and may store them for a maximum of 3 months from the date of recording. The exception is where a recording constitutes, or may constitute, evidence in proceedings conducted under the law — in that case, the retention period is extended until those proceedings become final. Once these periods expire, recordings containing personal data must be destroyed, unless separate regulations provide otherwise.
6. Purpose limitation – why recordings cannot be used to assess performance
This is one of the most frequently overlooked aspects of employee monitoring in Poland. Both Article 22² § 3 of the Labour Code and Article 5(1)(b) GDPR establish the purpose limitation principle: data collected for one purpose cannot be used for another. In practice, this means that if an employer installed cameras to protect property, the recordings cannot later be used to assess how long an employee's breaks were or how fast they worked — even if the footage clearly shows this. Using CCTV monitoring to evaluate work performance, when it was not formally introduced for that purpose, constitutes a breach of the law and may expose the employer to a personal-rights claim from the employee.
The real financial scale of such consequences is well illustrated by a decision of the President of UODO of 17 January 2025 against Centrum Medyczne Ujastek, a medical facility in Kraków. For covert video monitoring — of which neither patients nor staff were informed — combined with inadequate protection of the recordings, the authority imposed two fines totalling PLN 1,145,891.25. The Regional Administrative Court in Warsaw dismissed the facility's appeal against that decision. The case did not concern monitoring employee productivity, but it shows clearly how strictly the Polish supervisory authority treats a lack of transparency and inadequate protection of monitoring data — the same rules apply to any employer introducing workplace surveillance.
7. Monitoring company email and other work tools
Alongside CCTV monitoring, the Labour Code separately regulates monitoring of company email (Article 22³). An employer may introduce it only where necessary to ensure work organisation that allows full use of working time and proper use of the work tools provided to the employee — both conditions must be met jointly. Email monitoring cannot violate the confidentiality of correspondence or other personal rights of the employee, which in practice means it covers business correspondence only — private messages, even those sent from a company mailbox, should not be reviewed by the employer.
The same conditions and formal requirements (notice, marking) apply accordingly to other forms of monitoring beyond email, provided they serve the same purpose — for example, monitoring activity on a company computer or GPS tracking of company vehicles.
8. Monitoring vs. performance measurement – where is the line
It is worth distinguishing two concepts that are often confused in practice: monitoring in the Labour Code sense (CCTV, company email, and other forms of oversight introduced under Articles 22²–22³) and systematic activity and performance measurement — workforce management tools that record task duration based on defined norms and parameters, rather than image or correspondence content.
This second category of tools is also subject to GDPR, since work-pace and activity data can be linked to a specific person — but the risk of a privacy breach can be reduced already at the system-design stage. A good practice is anonymising performance data made available to a wider group of recipients, so that detailed information about work pace and completed activities is available only to the employee concerned and their direct supervisor. This approach — aligned with the GDPR data-minimisation principle — is used by the Time Harmony activity and performance tracking system, which measures the time and efficiency of completed tasks while keeping individual employee data confidential. For more on the broader business case for measuring performance, see our related article, "10 reasons why you should measure employee productivity".
It is worth communicating this distinction clearly to the team: a performance-measurement system exists to support work planning and process optimisation, not surveillance — just as CCTV monitoring cannot be used for a purpose it was not formally introduced for (see section 6).
9. Implementing compliant monitoring – a step-by-step checklist
- Define a single, specific purpose for the monitoring that matches the statutory list (safety, property protection, production control, confidentiality — for CCTV; full use of working time and proper use of work tools — for email and other forms).
- Set out the scope and method of monitoring in the work regulations, a collective agreement, or an official announcement.
- Notify all employees no later than 2 weeks before launch.
- Mark the monitored area with visible signage no later than one day before launch.
- Provide written notice to every newly hired employee before they are admitted to work.
- Restrict access to monitoring recordings and data to only those who need it to perform their duties.
- Set and observe the maximum retention period (3 months for video recordings, unless they constitute evidence in proceedings).
- Never use monitoring data for a purpose other than the one declared.
10. Consequences of unlawful monitoring
Breaching the rules on employee monitoring in Poland can trigger several types of liability at once:
- Administrative – financial penalties imposed by the President of UODO for GDPR breaches, with the amount depending on the scale and nature of the violation.
- Civil – claims from an employee for breach of personal rights (such as the right to privacy) in connection with excessive or covert surveillance.
- Employment-related – in extreme cases, monitoring that is selective or applied in a harassing manner may be classified as mobbing, giving the employee grounds for compensation under Article 94³ of the Labour Code.
11. Summary
Employee monitoring in Poland sits at the intersection of the Labour Code and GDPR, which together define a narrow corridor of permissible action: a closed list of purposes, an obligation to notify employees in advance, time limits on data retention, and a ban on using recordings beyond their declared purpose. For employers, this means that before implementing any form of oversight — video, email, or systematic performance measurement — it pays to first define the purpose and legal basis precisely, and only then select the technology that achieves it without compromising the team's privacy.
Optimize working time and efficiency of your team
