Responding When Staff Ask to See Their Data

Recognise and record the request

An employee does not necessarily need to use formal legal terminology to ask for information held about them. A request might arrive through a manager, human resources, an information governance contact or another established workplace channel. Someone asking what location records were collected during a particular work assignment may be making a request that requires a formal assessment, even if they do not refer to data protection legislation.

Record the date received, the channel used, the employee's identity, the information requested and the person responsible for coordinating the response. Preserve the original wording where appropriate. If the request is unclear, ask a focused question about the relevant dates, record categories or monitoring activity. Do not automatically require an employee to explain why they want access before assessing their rights under applicable local law.

• Record the date and wording of the request.
• Identify the employee and the requested information.
• Assign a responsible person to coordinate the response.
• Ask for clarification only where it is genuinely needed.

Establish identity and locate the relevant records

Before disclosing personal information, take reasonable steps to confirm that the requester is entitled to receive it. The level of verification should be proportionate to the sensitivity of the records and the circumstances of the request. Avoid collecting unnecessary additional identity documents or personal information simply because a monitoring request has been received. Follow the organisation's established identity-checking procedure and applicable local requirements.

Next, identify where the requested information may be held. Monitoring records may exist in an online dashboard, internal investigation files, exported reports or other authorised business systems. Search by relevant dates and record categories rather than assuming that one screen contains the complete picture. Keep a record of the systems checked, the scope of the search and any practical limitations that could affect the completeness of the response.

• Confirm the requester's identity proportionately.
• Identify the relevant dates and record categories.
• Check the dashboard and authorised secondary storage.
• Record the systems searched and any limitations.

Review what can be disclosed

Finding a record does not automatically mean that every part can be disclosed without review. A monitoring entry may contain information about colleagues, customers or other identifiable people. It may also include confidential business information or material subject to a specific legal restriction. Assess each issue under the rules that apply in the relevant country, and distinguish information about the requester from information that belongs to someone else.

An employee data access request should be handled with a documented disclosure assessment. Consider whether third-party information can be protected through appropriate redaction or another lawful approach. Do not withhold an entire record merely because it contains some information about another person if a more limited disclosure may be appropriate. Equally, do not disclose sensitive information without considering the rights and applicable protections of everyone concerned.

Assess information held by monitoring platforms

Monitoring systems can hold information in several formats, and employers should assess the records actually collected rather than assume that every available feature has been used. mSpy has an online dashboard and an official feature list that includes GPS location tracking with route history, geofence alerts, Wi-Fi network lists, supported messaging and social application monitoring, SMS, email, call logs, browser history and bookmarks. Other listed features include contacts, calendar information, photos and videos. Availability depends on the operating system, version, plan and setup, and some features require permissions on the monitored phone.

The review should also account for particularly sensitive records. Keystroke logging, periodic screen capture, live screen streaming and call recording can involve highly intrusive information. Where an employer monitors company-owned devices, the purpose, employee knowledge and consent, proportionality and applicable legal limits require careful consideration. A monitoring provider cannot decide whether a particular disclosure is lawful, guarantee that all relevant records are present or determine whether the employer's search has been complete.

Explain the response and keep an audit trail

The response should explain what information has been located, what has been disclosed and whether any information has been withheld or redacted where an explanation is required or appropriate. Use a clear format that allows the employee to understand the records without introducing unnecessary technical language. If the organisation cannot locate particular information, explain the limits of the search accurately rather than implying that the information never existed.

Response deadlines, permitted extensions, exemptions and disclosure requirements differ by country. The organisation should check the applicable legal timeframe and seek advice from a qualified lawyer or the relevant data protection authority when necessary. Keep a record of the request, identity checks, systems searched, disclosure assessment, approval and final response. This audit trail helps demonstrate that the request was handled through a consistent process.

• Prepare a clear explanation of the disclosed records.
• Explain any relevant redactions or withholding decisions.
• Check the applicable response deadline.
• Preserve the decision and response documentation.

Maintain transparency before requests arrive

A written workplace monitoring policy should explain what information the organisation collects, why it collects it, who can access it and how employees can exercise applicable data protection rights. Providing notice before monitoring begins makes later requests easier to handle because employees can understand the scope of the records and the organisation can refer to an established process. A request should never be treated as a reason to retaliate against an employee or discourage legitimate questions.

For families, parents and legal guardians using mSpy to supervise their own minor children should explain monitoring through an open, age-appropriate conversation. More intrusive capabilities, including keystroke logging, screen capture, live streaming and call recording, call for particular care, proportionality and compliance with local rules. For employers, written notice and employee knowledge and consent are central to responsible monitoring of company-owned devices. These safeguards do not replace a proper assessment of legal duties.

Questions readers ask