# Employee Monitoring DPIA Template

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | [Atlas Manufacturing Group] |
| DPIA Reference | DPIA-MON-[YEAR]-[SEQ] |
| Date of Assessment | [DD/MM/YYYY] |
| DPO | [Name, Qualifications] |
| Processing Owner | [Name, Title] |
| Legal Counsel | [Name, Firm] |
| Employee Representative | [Name / Works Council Reference] |

## Section 1: Monitoring System Description

### 1.1 Technology

| Element | Details |
|---------|---------|
| Monitoring type(s) | [ ] CCTV [ ] Email [ ] Internet [ ] GPS [ ] Keystroke [ ] Screen Capture [ ] Productivity Analytics [ ] Biometric [ ] Other: _____ |
| Vendor / Product | [Product name and version] |
| Deployment | [ ] On-premise [ ] Cloud [ ] Hybrid |
| Data centre location | [Location / jurisdiction] |

### 1.2 Scope

| Element | Details |
|---------|---------|
| Employees in scope | [Number and categories — all employees, specific departments, specific roles] |
| Contractors in scope | [Yes/No — if yes, specify] |
| Locations | [Sites / offices / remote] |
| Start date | [Proposed activation date] |

### 1.3 Data Collected

| Data Element | Collected? | Frequency | Retention Period |
|-------------|-----------|-----------|-----------------|
| Email metadata (sender/recipient/time) | [ ] Yes [ ] No | _________ | _________ |
| Email content | [ ] Yes [ ] No | _________ | _________ |
| Internet browsing URLs | [ ] Yes [ ] No | _________ | _________ |
| Internet browsing content | [ ] Yes [ ] No | _________ | _________ |
| CCTV video | [ ] Yes [ ] No | _________ | _________ |
| CCTV audio | [ ] Yes [ ] No | _________ | _________ |
| GPS location | [ ] Yes [ ] No | _________ | _________ |
| Keystrokes | [ ] Yes [ ] No | _________ | _________ |
| Screen captures | [ ] Yes [ ] No | _________ | _________ |
| Application usage | [ ] Yes [ ] No | _________ | _________ |
| Login/logout times | [ ] Yes [ ] No | _________ | _________ |
| Badge/access control | [ ] Yes [ ] No | _________ | _________ |
| Biometric data | [ ] Yes [ ] No | _________ | _________ |
| Productivity scores | [ ] Yes [ ] No | _________ | _________ |
| Other: _____________ | [ ] Yes [ ] No | _________ | _________ |

### 1.4 Lawful Basis

| Data Element | Art. 6(1) Basis | Art. 9(2) Condition (if applicable) | National Law Basis |
|-------------|----------------|-------------------------------------|-------------------|
| _________ | _________ | _________ | _________ |
| _________ | _________ | _________ | _________ |

### 1.5 Data Flow

```
[Data Source] → [Collection Point] → [Storage Location] → [Access by Role] → [Retention Period] → [Deletion Method]
```

## Section 2: EDPB WP248rev.01 Screening

| Criterion | Met? | Justification |
|-----------|------|---------------|
| 1. Evaluation or scoring | [ ] Yes [ ] No | _________ |
| 2. Automated decision-making with legal/significant effect | [ ] Yes [ ] No | _________ |
| 3. Systematic monitoring | [ ] Yes [ ] No | _________ |
| 4. Sensitive data or highly personal data | [ ] Yes [ ] No | _________ |
| 5. Large-scale processing | [ ] Yes [ ] No | _________ |
| 6. Matching or combining datasets | [ ] Yes [ ] No | _________ |
| 7. Vulnerable data subjects (employees) | [ ] Yes [ ] No | _________ |
| 8. Innovative technology | [ ] Yes [ ] No | _________ |
| 9. Processing preventing exercise of rights | [ ] Yes [ ] No | _________ |

**Total criteria met**: _____ / 9

**DPIA obligation**: [ ] Mandatory (2+ criteria) [ ] Recommended (1 criterion) [ ] Not required (0 criteria)

## Section 3: Barbulescu Proportionality Assessment

### Factor 1: Prior Notification
- Has the employee been notified of monitoring? [ ] Yes [ ] No
- What form does notification take? [ ] AUP [ ] Privacy Notice [ ] Individual Letter [ ] Other
- Is the notification specific about scope? [ ] Yes [ ] No
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

### Factor 2: Extent of Monitoring
- Content or metadata? [ ] Content [ ] Metadata [ ] Both
- Continuous or triggered? [ ] Continuous [ ] Triggered
- Individual or aggregate? [ ] Individual [ ] Aggregate [ ] Both
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

### Factor 3: Legitimate Reasons
- Documented legitimate aim: _________
- Specificity of justification: [ ] Specific [ ] General
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

### Factor 4: Less Intrusive Alternatives
- Alternatives considered: _________
- Why alternatives are insufficient: _________
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

### Factor 5: Consequences for the Employee
- Can monitoring lead to disciplinary action? [ ] Yes [ ] No
- Is human review required before action? [ ] Yes [ ] No
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

### Factor 6: Adequate Safeguards
- Access controls in place? [ ] Yes [ ] No
- Retention limits enforced? [ ] Yes [ ] No
- Grievance procedure available? [ ] Yes [ ] No
- Annual review scheduled? [ ] Yes [ ] No
- **Score (1-5)**: _____ **Compliant?** [ ] Yes [ ] Partial [ ] No

**Overall Barbulescu compliance**: _____% **Status**: [ ] Compliant [ ] Partial [ ] Non-compliant

## Section 4: Risk Assessment

| Risk ID | Description | Likelihood | Severity | Risk Level | Mitigation | Residual Risk |
|---------|-------------|-----------|----------|------------|------------|---------------|
| MON-R001 | _________ | _________ | _________ | _________ | _________ | _________ |
| MON-R002 | _________ | _________ | _________ | _________ | _________ | _________ |

## Section 5: DPO Advice

| Element | Detail |
|---------|--------|
| DPO advice provided | [ ] Yes, Date: _____ |
| DPO recommendation | [ ] Proceed [ ] Proceed with modifications [ ] Do not proceed |
| DPO advice followed | [ ] Yes [ ] No — Reason: _____ |

## Section 6: Works Council / Employee Consultation

| Element | Detail |
|---------|--------|
| Works council consulted | [ ] Yes, Date: _____ [ ] Not applicable (jurisdiction) |
| Works council agreement obtained | [ ] Yes [ ] No — escalation: _____ |
| Employee views sought per Art. 35(9) | [ ] Yes, method: _____ [ ] No — reason: _____ |

## Section 7: Decision and Sign-Off

| Decision | Detail |
|----------|--------|
| DPIA outcome | [ ] Processing approved [ ] Approved with conditions [ ] Rejected |
| Prior consultation required (Art. 36) | [ ] Yes [ ] No |
| Conditions: | _________ |
| Next review date | [DD/MM/YYYY] |

### Signatures

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Processing Owner | _________ | _________ | _________ |
| DPO | _________ | _________ | _________ |
| Senior Management | _________ | _________ | _________ |
| Works Council (if applicable) | _________ | _________ | _________ |