Filtering staff internet use under EU and UK data protection law
You want to block the obvious risks on your company network without breaking data protection law or upsetting your staff. This guide is for employers, HR teams and IT providers in the EU and UK: what the law asks for, what counts as monitoring, and the settings that keep filtering proportionate.
The short answer
- Blocking categories of websites on your network is generally lawful.
- Recording which sites people visit is processing personal data. It needs a lawful basis, usually legitimate interests.
- Tell staff what is filtered and recorded, keep only what you need, and delete it on a schedule.
- Systematic monitoring of individuals is likely to need an impact assessment, and in some countries the works council's agreement.
Blocking and recording are two different questions
Most of the legal weight falls on what the filter records about people, not on what it blocks. Keeping the two apart is the simplest way to stay proportionate.
Blocking
The filter refuses a category or a site. No one looks at what any person did.
- Protects the network, the data and the people on it
- Rarely controversial when explained in a policy
- Works the same for every user of a network
Recording
The filter keeps a log of lookups. If a log can be tied to a person, it is personal data.
- Needs a lawful basis and a notice to staff
- Can reveal sensitive facts about someone's life
- Needs access rules and a retention limit
Filter by network and category instead of watching people
Our managed DNS filter decides by website name and records the website, the time, the network and the result. It never sees page contents, messages or what anyone types, which keeps the record far less intrusive than a monitoring tool.
- Rules per network, not per employee.
- Monthly reports by category for management.
- Staff research access logged as an event, not a browsing history.
Data protection principles, applied to a web filter
The same principles apply under the EU GDPR and the UK GDPR. Each one turns into a concrete filter setting.
| Principle | What it means for filtering | Practical setting |
|---|---|---|
| Lawful basis | Security and acceptable use usually rest on legitimate interests, with a written balancing test | Keep the test with the filtering policy |
| Transparency | Staff must know what is filtered, what is recorded, who sees it and for how long | A short notice in the staff handbook and the policy |
| Data minimisation | Record no more than the purpose needs | Block by category; report by category and network |
| Purpose limitation | A security log is not a performance tool | Write down that logs are not used to rate staff |
| Storage limitation | No fixed period, but no keeping logs "just in case" | Short retention for detail, longer for summaries |
| Security | Logs are sensitive and must be protected | Few people with access, and a record of who looked |
Why web filter logs can hold sensitive data
Data protection law gives special protection to facts about health, beliefs, political opinions, sex life and some others. A list of websites someone visited can reveal exactly those facts, even when nobody intended to collect them.
Six ordinary sites whose visits say something personal
Real rows from our data. Visiting any of them is normal; a log that ties such visits to a named person is what needs care.
| Site | Categories in our data | What a visit can reveal |
|---|---|---|
| webmd.com | Health & Medicine | Health concerns, a special category |
| mind.org.uk | Health & Medicine | Mental health, a special category |
| jw.org | Religion & Spirituality | Religious belief, a special category |
| labour.org.uk | Political | Political opinions, a special category |
| match.com | Dating | Private and sex life, a special category |
| indeed.com | Business, Job Search/Careers | Job hunting, sensitive at work though not a special category |
The legitimate interests test in three questions
Most employers rely on legitimate interests. Consent rarely works at work, because regulators doubt that staff can freely refuse their employer. Write the answers down; they are your evidence.
Purpose
What are you protecting, and is it a real interest?
"Keeping malware, fraud and illegal content off our network."Necessity
Is filtering a reasonable way to get there, and is there a less intrusive option?
"Category blocking achieves this without reviewing individual browsing."Balance
Do staff interests override yours, given what they expect and what you record?
"Staff are told, logs are short-lived, and reports are by category."Country notes
The GDPR lets countries add employment rules, and labour law adds more. Four common cases, as orientation only.
United Kingdom
- UK GDPR and the Data Protection Act 2018 apply.
- The regulator published guidance on monitoring workers in 2023, stressing transparency, necessity and impact assessments.
- Covert monitoring is reserved for exceptional cases such as suspected crime.
Germany
- Technical systems able to monitor employee behaviour or performance are subject to co-determination by the works council.
- Most employers set the rules in a works agreement.
- Allowing private use of the work connection can raise extra questions; take local advice.
France
- Employees must be told about monitoring tools before they are used.
- The works council must be informed and consulted before such tools are introduced.
- The data protection regulator expects proportionate, documented controls.
Netherlands
- Systems that can observe or check staff need the works council's consent.
- The data protection authority expects a clear purpose and a balancing test.
- Impact assessments are expected for systematic monitoring.
A well-known European court ruling, Bărbulescu v Romania (2017), found that monitoring an employee's messages without telling him in advance about its nature and extent breached his right to private life. Prior, clear notice is the thread that runs through all of these rules.
What to tell staff
A good notice is short and specific. Cover these points in the staff handbook or the web content filtering policy.
When an impact assessment is needed, and what it covers
Systematic monitoring of employees is on the regulators' lists of processing likely to be high risk. If your filter records individual browsing and someone reviews it, plan an assessment. A five-step outline:
Describe
What the filter does, which networks, what is recorded and who sees it.
Justify
The purpose, why filtering is necessary, and the less intrusive options you considered.
Assess risk
Sensitive data in logs, misuse by managers, chilling effects on staff.
Reduce risk
Category reports, short retention, access limits, clear notices.
Sign off
Record the decision, the data protection lead's view and the review date.
How the managed filter keeps the record proportionate
Rules apply per network, so no one has to be singled out to enforce them, and the monthly report summarises by category and network. The filter works on website names only, so page contents, messages and keystrokes never reach it.
Six settings that make filtering easier to justify
Each one reduces intrusion without weakening protection.
Block by category
Prevent the risk instead of investigating people after the fact.
Rules per network
Staff, guest and public networks get their own rules without anyone being named.
Report by category
Management sees trends, such as more blocked gambling sites, not individual histories.
Short detail, longer summary
Keep detailed lookups briefly and category totals for longer.
Few people with access
Name who may open detailed logs and in which situations, such as a security incident.
Room for personal life
Leaving reasonable personal use open at breaks makes the whole policy easier to defend.
Intrusive monitoring, or proportionate filtering
Two ways to protect the same network, and how they look to a regulator.
| Question a regulator asks | Monitoring software on devices | Managed DNS filter on the network |
|---|---|---|
| What is collected? | Often pages, screenshots or keystrokes | Website names, times, network and result |
| Is it targeted at people? | Per user by design | Rules and reports per network |
| Less intrusive option? | Hard to argue | Blocking categories is the less intrusive option |
| Special category data? | Likely, in detail | Possible in lookups; keep detail short-lived |
| What staff install | An agent on every device | Nothing; one router setting |
Staff web filtering and data law: frequently asked questions
Is it legal to filter employees' internet use in the EU or UK?
Blocking categories of websites on a company network is generally lawful. Recording which sites people visit is processing of personal data, so it needs a lawful basis, a clear notice to staff, data minimisation and a retention limit.
Can employers rely on staff consent for web filtering logs?
Rarely. Because of the imbalance of power at work, European regulators consider employee consent seldom freely given. Most employers rely on legitimate interests and document the balancing test.
Do we need a data protection impact assessment for web filtering?
If the filter records individual browsing in a way that amounts to systematic monitoring of employees, an impact assessment is likely to be expected. Filtering that only blocks, or reports by category and network, carries much less risk.
Why are web filter logs sensitive?
Visits to health, religious, political or dating sites can reveal special category data such as health, beliefs, political opinions or sex life. Logs that tie such visits to a person need strict access limits and short retention.
Does a works council have to agree to web filtering?
In some countries, yes. In Germany technical systems able to monitor employees are subject to co-determination, in France the works council must be informed and consulted before monitoring tools are introduced, and in the Netherlands such systems need the works council's consent.
Can we look at one employee's browsing if we suspect misuse?
Only for a specific, documented reason that your policy describes, such as a security incident or suspected wrongdoing, and only by the people the policy names. Record why the records were opened and keep the review proportionate.
Does a DNS filter read the content of web pages?
No. A DNS filter only sees the name of the website a device looks up, such as example.com. It does not see which pages are opened, what is typed into forms, or the contents of messages.
How long should web filtering logs be kept?
The law sets no fixed number. Keep detailed logs only as long as the stated purpose needs them, often weeks rather than years, and keep longer summaries by category instead.
This guide gives general information about data protection and employment rules in the EU and UK. It is not legal advice, rules differ between countries and change over time, and you should check your own situation with a qualified adviser.
The managed DNS filter is $99 a month for one site, with groups of sites quoted together. A pilot on one network lets your HR and data protection leads see exactly what is recorded before the policy goes out.
Protect the network without watching people
Tell us where your staff work and which networks you run. We will set up a pilot with rules per network and category reporting, so your notice can be short and true.