AW002Transparency notice on what is observed

The account of the program’s reach given to the persons subject to it.

Pillar: AW | Awareness and training
Sources cited: 30
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
AW002/BEMandatory	Belgium	Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026	Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own.	What each worker is told at installation is the monitoring policy, the purposes, whether personal data are kept and where and for how long, whether the monitoring is permanent, and what the employer and the supervising staff may do.
AW002/HRMandatory	Croatia	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	At hiring, the employer informs the worker in writing that audio or video surveillance devices will observe them. Premises under video surveillance are marked visibly before the recording perimeter is entered, with the article 13 information, in particular that the space is under surveillance, the controller, and the contact for exercising rights; employees are informed in an appropriate way beforehand and before the decision to install. Workers are informed of a GPS system in vehicles by written internal rules available to all, an oral notice being insufficient.
AW002/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	What the workforce is told after the procedure is the purpose of the monitoring, its introduction, the methods used, and the terms on which electronic mail and the network may be used.
AW002/GRMandatory	Greece	Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026	That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors.	Employees are informed in writing, on paper or electronically, of the installation and operation of CCTV in the workplace; where consent is the basis, the employer informs the employee of the purpose and of the right to withdraw.
AW002/HUMandatory	Hungary	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Before a restriction of the employee’s personality right, the employee is informed in writing of its manner, conditions, and expected duration and of the circumstances supporting its necessity and proportionality; before technical means are used to check the employee, the employee is informed in writing. The notice on cameras states the basis, the place and duration of storage, the security measures, who may view and to whom recordings may go, the rules of review and the purposes of use, and the employees’ rights and remedies, for each camera its purpose and field of view; a general statement that cameras are in use is not accepted.
AW002/ITMandatory	Italy	Provvedimento n. 165, ITAS MutuaGarante per la protezione dei dati personali · read 16 Aug 2026	That mailbox backups and browsing logs are instruments from which remote monitoring may follow, that an answer given in stages and handed over in part without saying what was withheld does not discharge the right of access, and that a five year backup of employee mail has to be disclosed to the people whose mail it holds.	A backup of the mailboxes described in none of the notices given to the staff leaves them unable to know it exists, which is the finding rather than the keeping itself.
AW002/LUMandatory	Luxembourg	Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026	That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence.	Beside the individual information of articles 12 and 13, the staff representation receives collective prior information of the purpose, the modalities, the retention, and the undertaking not to use the data for another purpose. Information is given in two layers, a sign and the full content of article 13. Employees are informed individually, with the controller’s identity and contact details, the DPO’s contact details, the purposes, the legitimate interests or the legal basis, the recipients, the retention per purpose, and their rights.
AW002/NOMandatory	Norway	Arbeidsmiljøloven, sections 9-1 and 9-2Storting · read 29 Aug 2026	That a control measure needs objective grounds in the undertaking and must not be a disproportionate burden, and that it is discussed with the elected representatives, notified with its expected duration, and evaluated with them at intervals.	Before the measure starts, those affected are told its purpose, what it will mean in practice, how it will be carried out, and how long it is expected to last.
AW002/PLMandatory	Poland	Kodeks pracy, article 22(2)Sejm of the Republic of Poland · read 20 Sep 2026Kodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026	That image recording at work is open for four purposes only, one of them keeping secret information whose disclosure could harm the employer, that its purposes, scope and manner are fixed in the collective agreement, the work regulations or an announcement, that it is notified two weeks before it starts and handed to each worker before they are admitted to work, and that recordings are kept three months.	Workers are informed of the introduction of monitoring, in the manner the employer adopts, no later than two weeks before it starts, and the monitored rooms and area are marked visibly and legibly by signs or audible announcements no later than one day before. The code states that the marking does not displace articles 12 and 13 of the General Data Protection Regulation.
AW002/PTMandatory	Portugal	Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound.	The worker is informed of the existence and purpose of the means of remote surveillance; a camera carries the statutory notice. Before processing begins the worker is told the conditions of private use, the forms and methods of control, the data processed, the retention period, the tolerance admitted, and the consequences of misuse; the rules and forms of control stand in an internal regulation.
AW002/ROMandatory	Romania	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026Legea nr. 361/2022 privind protecția avertizorilor în interes public, articolele 7, 9, 10, și 36Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Before monitoring by electronic communications or video surveillance, the employer gives the employees prior information that is mandatory, complete, and explicit. The designated person and the means of internal reporting are brought to every employee’s knowledge by display on the website and at the premises.
AW002/SEMandatory	Sweden	Kamerabevakningslag (2018:1200), 15 §, 21 §, and 22 §Riksdag · read 5 Oct 2026Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026	That notice of camera surveillance is given by clear signage or in another effective way, with a separate notice for sound, that an employer’s decision on camera surveillance of a workplace is subject to the negotiation duty of 11-14 §§ MBL, and that the material is covered by confidentiality.	Employees have the right to clear information in advance of which controls may be made of them. Notice of camera surveillance is given by clear signage or in another effective way, with a separate notice where sound is recorded. Information under article 13 to the persons filmed is owed beside the signage, and a sign without the DPO’s contact details does not discharge it.
AW002/CHMandatory	Switzerland	Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches.	The controller informs the person appropriately of the collection of personal data, whether or not collected from the person. The persons concerned are informed in advance and in detail of the type, aim, and purpose of the processing; an internal regulation sets out their rights and duties under monitoring and control systems and how the internal control is carried out; monitored areas are marked as such. A signed IT usage directive gives general notice that controls may occur; it does not inform of a covert method.
AW002/GBMandatory	United Kingdom	Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	The closed list of purposes for which an employer may intercept communications on its own system, and the four conditions on doing it, of which one is telling everyone who may use the system.	The system controller has to have made all reasonable efforts to inform every person who may use the system that communications transmitted by it may be intercepted. Everyone who may use it, not everyone employed, and reasonable efforts rather than acknowledgement.
Recommended	Irelandwhere written	Guidance on the Use of CCTV, For Data ControllersData Protection Commission · read 5 Oct 2026	That staff monitoring by camera belongs to special circumstances only, that employees are told where cameras are and why, that footage justified for security is not used for attendance or performance, that a case-by-case use for a disciplinary matter has to be shown necessary and limited in scope, that covert surveillance is generally unlawful and exceptionally permitted for offences only under a written policy and after a DPIA, and that a DPIA in the employment context could engage trade union or safety representatives.	Employees are given a clear notification that CCTV monitoring is taking place, and are informed where and why.
Recommended	Norwaywhere written	NSMs grunnprinsipper for IKT-sikkerhet 2.1Nasjonal sikkerhetsmyndighet · read 29 Aug 2026	A set of principles for securing information systems, with the monitoring ones carrying what the collected data may be used for, what employees are to be told about it, and the requirement to verify that the collection is working.	The workforce is informed of what is collected, what it is to be used for, and how the data are to be handled, and that sits alongside establishing which laws apply and deciding how long the data shall and may be stored.
Recommended	United Kingdomwhere written	Employment practices and data protection: monitoring workersInformation Commissioner's Office · read 30 Aug 2026	What the British regulator expects of an employer that watches its workers, told apart as what an employer must do and what it should, and the conditions it sets on watching them without telling them.	Workers must be made aware of how and what personal information is collected. A system could be set up so that they remain aware that monitoring is taking place, through an intranet or signage in the areas it reaches. The privacy information must be kept up to date, and workers must be told when a change is introduced.