AW002Transparency notice on what is observed

The account of the program’s reach given to the persons subject to it.

Pillar: AW | Awareness and training
Sources cited: 9
Added: 30 AUGUST 2026
Updated: 20 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
AW002/BEMandatory	Belgium	Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026	Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own.	What each worker is told at installation is the monitoring policy, the purposes, whether personal data are kept and where and for how long, whether the monitoring is permanent, and what the employer and the supervising staff may do.
AW002/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	What the workforce is told after the procedure is the purpose of the monitoring, its introduction, the methods used, and the terms on which electronic mail and the network may be used.
AW002/ITMandatory	Italy	Provvedimento n. 165, ITAS MutuaGarante per la protezione dei dati personali · read 16 Aug 2026	That mailbox backups and browsing logs are instruments from which remote monitoring may follow, that an answer given in stages and handed over in part without saying what was withheld does not discharge the right of access, and that a five year backup of employee mail has to be disclosed to the people whose mail it holds.	A backup of the mailboxes described in none of the notices given to the staff leaves them unable to know it exists, which is the finding rather than the keeping itself.
AW002/NOMandatory	Norway	Arbeidsmiljøloven, sections 9-1 and 9-2Storting · read 29 Aug 2026	That a control measure needs objective grounds in the undertaking and must not be a disproportionate burden, and that it is discussed with the elected representatives, notified with its expected duration, and evaluated with them at intervals.	Before the measure starts, those affected are told its purpose, what it will mean in practice, how it will be carried out, and how long it is expected to last.
AW002/PLMandatory	Poland	Kodeks pracy, article 22(2)Sejm of the Republic of Poland · read 20 Sep 2026Kodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026	That image recording at work is open for four purposes only, one of them keeping secret information whose disclosure could harm the employer, that its purposes, scope and manner are fixed in the collective agreement, the work regulations or an announcement, that it is notified two weeks before it starts and handed to each worker before they are admitted to work, and that recordings are kept three months.	Workers are informed of the introduction of monitoring, in the manner the employer adopts, no later than two weeks before it starts, and the monitored rooms and area are marked visibly and legibly by signs or audible announcements no later than one day before. The code states that the marking does not displace articles 12 and 13 of the General Data Protection Regulation.
AW002/GBMandatory	United Kingdom	Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	The closed list of purposes for which an employer may intercept communications on its own system, and the four conditions on doing it, of which one is telling everyone who may use the system.	The system controller has to have made all reasonable efforts to inform every person who may use the system that communications transmitted by it may be intercepted. Everyone who may use it, not everyone employed, and reasonable efforts rather than acknowledgement.
Recommended	Norwaywhere written	NSMs grunnprinsipper for IKT-sikkerhet 2.1Nasjonal sikkerhetsmyndighet · read 29 Aug 2026	A set of principles for securing information systems, with the monitoring ones carrying what the collected data may be used for, what employees are to be told about it, and the requirement to verify that the collection is working.	The workforce is informed of what is collected, what it is to be used for, and how the data are to be handled, and that sits alongside establishing which laws apply and deciding how long the data shall and may be stored.
Recommended	United Kingdomwhere written	Employment practices and data protection: monitoring workersInformation Commissioner's Office · read 30 Aug 2026	What the British regulator expects of an employer that watches its workers, told apart as what an employer must do and what it should, and the conditions it sets on watching them without telling them.	Workers must be made aware of how and what personal information is collected. A system could be set up so that they remain aware that monitoring is taking place, through an intranet or signage in the areas it reaches. The privacy information must be kept up to date, and workers must be told when a change is introduced.