What should employees be told about network security monitoring?
What is monitored, why, what is not, who sees it and how long it is kept, in plain words and before monitoring starts. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). requires controllers to give people clear information about processing of their personal data, and employment law in many countries adds notice or consultation duties. A good notice says: we monitor company devices and network connections to detect attacks; we record connection metadata such as addresses, times, volumes and server names, not the content of messages or files; a small named team sees the alerts; records are kept for a stated period; here is whom to ask. Put it in the IT policy and the privacy notice for staff, and update it when the set-up changes. NetSenX's own description of what it reads helps you write this precisely.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Can HR find out from NetSenX which employee used an AI tool?
- What is insider risk, and how is it different from an outside attack?
- Can employees see what the security tool records about their device?
- What should an acceptable use policy say about security monitoring?
- How long should security logs about employee devices be kept?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).