# Can we monitor our network for security on the basis of legitimate interest?

Usually yes, as long as the monitoring is necessary for security and proportionate, and you document the balance. The GDPR allows processing that is necessary for the legitimate interests of the controller, unless those interests are overridden by the rights of the people concerned, and its recitals name network and information security as such an interest, to the extent strictly necessary and proportionate. That means writing down a short balancing test: what you monitor and why, why less intrusive means would not do, what safeguards you apply, and how long you keep the data. Monitoring metadata for signs of attack weighs differently from reading message content or watching individual behaviour. Inform employees in your privacy notice, and check national employment law, which may require consulting or agreeing with employee representatives. NetSenX is built to keep the balance on the safer side: it records metadata, never decrypts traffic, and reports AI use per device and program rather than per person. The legal assessment remains yours.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/can-we-monitor-the-network-under-legitimate-interest

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [How high can GDPR fines be?](https://netsenx.com/en/faq/what-are-gdpr-fines)
- [What is DORA, in plain terms?](https://netsenx.com/en/faq/what-is-dora-in-plain-terms)
- [What does DORA require from the management of a financial entity?](https://netsenx.com/en/faq/what-does-dora-require-from-management)
- [What is the Cyber Resilience Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-cyber-resilience-act)
- [Does the Cyber Resilience Act apply to software companies?](https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies)