Monitoring contact centre agents lawfully and fairly: a leader's guide

The UK's data protection regulator recognises that workers expect employers to check the quality and quantity of their work, and that contact centres monitor calls for training and quality. It also warns that excessive monitoring intrudes into private lives, undermines wellbeing and damages trust. Just because a form of monitoring is available, the guidance says, does not mean it is the best way to achieve your aims: you must be clear about your purpose and choose the least intrusive means.

At QVCCS we see recording, analytics, screen monitoring, dashboards and wallboards as excellent tools for understanding the business and the effectiveness of people, processes and technology. They must be used under strong policies that follow the rules where your people and customers are, which are tighter in Europe for call recording and for sentiment or emotion analysis. Use them to understand service delivery, and never beyond what your jurisdiction allows.

A note on names. Since 30 September 2026 the Information Commission has carried out the functions of the Information Commissioner's Office, with the same role and powers. Its guidance on monitoring workers is still published on ico.org.uk and is under review following the Data (Use and Access) Act 2025, so check it for updates before you change a policy. This guide is general information, not legal advice; involve your data protection officer and take legal advice for your own circumstances.

Monitoring is lawful when you can show why you are doing it, that it is necessary and proportionate, and that the people monitored know about it. You need a lawful basis for the processing, and an additional condition if the monitoring is likely to capture special category data, such as health information in a call or an email. Consent is rarely the right basis for employers, because the imbalance of power means workers may feel they have no real choice.

Most monitoring in a contact centre is systematic, and much of it is high risk, so a data protection impact assessment should come first. The guidance expects you to seek and record the views of workers or their representatives when you plan new monitoring, to tell workers what you collect and why before you start, and to keep information only as long as the purpose needs.

• Define the purpose of each kind of monitoring, in writing
• Identify the lawful basis, and a special category condition where needed
• Complete a data protection impact assessment before you start
• Consult agents or their representatives, and record what they said
• Tell agents what is collected, why, who sees it and for how long
• Set retention by purpose and delete on schedule
• Restrict access to the people who need it, and train them
• Review the policy when tools or purposes change

The guidance says it is not usually proportionate to record the content of calls in all cases, but that you can monitor business calls where it is necessary for evidence of transactions, or for training and quality control. Its own example is a customer service contact centre that records helpline calls for training and quality, tells workers through a policy that is regularly brought to their attention, and tells customers during the call with a route to detailed privacy information. Where a regulator requires recording, record what the rules require and no more.

In Genesys Cloud, recording policies decide which interactions are recorded, by criteria such as direction, queue and user, and how long recordings are kept, archived or deleted. Check overlapping policies carefully: when more than one policy matches an interaction, Genesys keeps the recording for the longest retention period among them, which can quietly keep recordings far longer than your schedule says. Quality evaluations should use recordings to coach and reinforce good practice; agents who are coached through fear take it out on the next customer.

Device activity monitoring is the most intrusive kind. The guidance warns that it is likely to capture excessive personal information, that keystroke monitoring is treated as behavioural biometric data, and that capturing webcam images or footage is particularly unlikely to be justified. If a less intrusive way meets the purpose, you must use it.

Genesys Cloud screen recording is tied to interactions: a policy records the agent's desktop while they handle ACD interactions, alongside the call or message, to show why some interactions take longer, how well agents understand the applications and whether a delay is a system problem. That focus makes it easier to justify than continuous capture, but it still needs a clear purpose, an impact assessment and agents who know it happens.

Real-time dashboards, wallboards and adherence views are monitoring too. They are most useful, and least resented, when they help agents and team leaders make decisions in the moment, and when agents can see their own figures. Use them to manage the queue and the plan, not to watch individuals minute by minute.

Speech and text analytics, quality scoring and people analytics can infer performance and wellbeing at scale, which is why the guidance treats them carefully. The Data (Use and Access) Act 2025 reformed the UK rules on decisions made solely by automated means, allowing them in wider circumstances but requiring safeguards: telling people about significant decisions, letting them make representations and challenge them, and giving them human intervention. Whatever the legal position, keep a person meaningfully involved in any decision about an agent's pay, discipline or job.

Europe is stricter for analysing emotion. If your agents or customers are in the EU, the EU AI Act prohibits AI that infers the emotions of people in the workplace, except for medical or safety reasons, so agents' emotions must not be tracked for assessment. Our guide to the EU AI Act and UK GDPR for contact centres explains where the line falls for agents, customers and sentiment features.

Homeworking is still work, so the same rules apply, but workers' expectation of privacy is greater at home, and monitoring there is more likely to capture family life. Outsourcers face a particular trap: the guidance is clear that you cannot justify monitoring workers solely because a client makes it a condition of business. The employer must still be satisfied that the monitoring is necessary and proportionate, and should offer less intrusive alternatives, such as aggregated reports in which individuals cannot be identified.

Covert monitoring, designed so workers do not know it is happening, is unlikely to be justified in normal circumstances. The guidance allows it only in exceptional cases, such as suspected criminal activity or gross misconduct, authorised by senior management, after an impact assessment, targeted and time-limited, and never in places where people expect privacy. Write the circumstances into policy in advance, so nobody has to improvise.