Can we monitor our network for security on the basis of legitimate interest?

Usually yes, as long as the monitoring is necessary for security and proportionate, and you document the balance. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). allows processing that is necessary for the legitimate interests of the controller, unless those interests are overridden by the rights of the people concerned, and its recitals name network and information security as such an interest, to the extent strictly necessary and proportionate. That means writing down a short balancing test: what you monitor and why, why less intrusive means would not do, what safeguards you apply, and how long you keep the data. Monitoring metadata for signs of attack weighs differently from reading message content or watching individual behaviour. Inform employees in your privacy notice, and check national employment law, which may require consulting or agreeing with employee representatives. NetSenX is built to keep the balance on the safer side: it records metadata, never decrypts traffic, and reports AI use per device and program rather than per person. The legal assessment remains yours.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics