Nearly 80% of U.S. companies use employee monitoring tools and productivity calculations for decision-making, performance analysis, workplace safety, legal liability protection, and defense against sabotage and intellectual property theft ([54]). In Brazil, companies have also adopted monitoring systems, albeit more slowly. According to a Capterra survey ([17]), 55% of Brazilian companies currently use these tools. The six main activities monitored by Brazilian companies today are: i) attendance control; ii) workload management; iii) time management; iv) computer activity; v) desktop analysis; and vi) digital communications analysis ([66]). A summary of these practices can be seen in Table 1 below.

Table 1.Methods companies use to monitor employees.

Companies can use employee data collected by monitoring tools to perform analyses and evaluate teams. These analyses can be used to develop better solutions for recruitment, team well-being, talent retention, and performance management. The process of using software to automatically cross-reference collected data and perform diagnostics, predictions, descriptions, and prescriptions is called people analytics ([21]).

In recent years, this method of people management has become popular because it allows companies to optimize strategic decisions regarding their employees. AI has revolutionized people analytics by simplifying employee monitoring processes and enabling the collection, storage, and analysis of large amounts of employee data. Thus, AI-driven employee monitoring offers significant advantages in terms of performance tracking, risk management, and identifying opportunities for employee development.

One illustrative example of people analytics in action is the use of predictive attrition software powered by machine learning algorithms ([8]). Such tools³ integrate data from multiple sources, including employee demographics, tenure, performance evaluations, engagement surveys, and even patterns of absenteeism. By processing these datasets, the system can generate predictive models that flag⁴ employees with a high likelihood of leaving the organization within a defined period. The analysis not only identifies risk factors—such as lack of career progression or declining engagement—but also provides actionable insights for managers, such as targeted training programs, tailored retention bonuses, or internal mobility opportunities. For employers, the gains are substantial: reducing turnover costs, preserving institutional knowledge, and strengthening workforce stability, all of which directly contribute to improved organizational performance and efficiency.

A 2020 LinkedIn report on key trends in people management ([39]) revealed that 48% of respondents plan to use machine learning to forecast human resources data in the coming years. Additionally, a 2018 Visier survey showed that organizations with advanced people analytics functions outperform emerging organizations, boasting 56% higher profit margins and a 22% higher return on assets ([63]). Given the rise of this new sector, many companies now offer software solutions that use artificial intelligence to implement people analytics. Table 2 below summarizes the main products offered by these companies.

Table 2.Description of people analytics solutions.

As shown in Table 2 above, people analytics tools support decisions related to recruitment, development, performance, organizational climate, and employee turnover. To enable these insights, companies monitor employees’ activities and behaviors during working hours. Many people analytics providers offer real-time monitoring services, generating analyses and visual dashboards to guide decision-making. The main tools used for this type of monitoring are listed below:

Table 3.Description of tools used for real-time employee monitoring.

A deeper analysis of Table 2and Table 3 highlights that the main advantage for employers lies in the ability to better understand their workforce and, from there, tailor management strategies to maximize productivity and reduce organizational risks. By linking the categories of people analytics in Table 2with the monitoring tools in Table 3, it becomes clear that the value of these solutions is not merely in collecting large volumes of data, but in transforming these raw inputs into actionable insights. For instance, retention strategies benefit when attrition-prediction models combine turnover statistics with monitoring data about employee engagement, such as patterns of absenteeism or declines in digital communication frequency. In this way, the employer gains a more accurate diagnosis of which employees are most at risk of leaving and can act preventively, avoiding replacement costs and preserving institutional knowledge.

It is equally important to note that the choice of monitoring tool depends on the specific organizational objective. If the company is concerned with improving training programs and addressing skill gaps, as described in the “Skill Development” category, it may rely more heavily on performance management software and application usage monitoring, which track how employees interact with learning platforms and productivity tools. Conversely, if the focus is on organizational climate and inclusion, surveys and communication monitoring may provide richer insights, pointing to dissatisfaction or discriminatory practices within the workplace. As an example, while keyloggers may be effective in ensuring compliance with cybersecurity policies, they are not the appropriate tool for identifying training needs or promoting diversity, underscoring the necessity of aligning the technological instrument with the employer’s strategic goal.

Finally, the integration of these systems raises concerns about opacity in their operation and the degree of transparency with which they are communicated to employees. Employers may deploy monitoring tools on company-issued devices or indirectly through applications embedded in productivity platforms, often without workers’ full awareness ([8]) of the scope of data collection. This dual characteristic—of being simultaneously a management tool and a surveillance mechanism—amplifies the ethical and legal debates around privacy, consent, and autonomy in the workplace. In practice, while people analytics offers organizations powerful opportunities to optimize decision-making, it also demands careful governance and clear accountability regarding how these systems function, what data they collect, and how the resulting insights are applied to shape employees’ professional lives.

Employers monitor their employees for three main reasons ([7]). First, they want to maintain productivity and track resource usage. Second, employers want to protect their corporate interests and trade secrets to prevent risks of defamation, sabotage, data theft, and hacking. Third, monitoring protects the company from legal liability by providing evidence in legal proceedings. These objectives are all legitimate and demonstrate that monitoring employees is necessary. Employees themselves also expect monitoring as a form of risk management that limits costs, protects value, and maintains service quality (Ibidem: p. 93).

However, problems arise when employee monitoring exceeds what is reasonable or necessary. In other words, problems arise when monitoring becomes excessive and turns into unprecedented surveillance. This occurs in two situations: 1) when employers monitor data outside the workplace, invading a non-professional dimension of the worker’s life and 2) when they collect accurate and precise information on how employees use their time, thereby undermining their autonomy in performing their assigned tasks.

The first scenario—monitoring that extends beyond the workplace—may occur due to an expansion of the workplace beyond a physical location⁵. This makes it difficult to define what should or should not be monitored, which threatens to blur the line between work and non-work ([2]: p. 322). For instance, if an employee works from home and is monitored via webcam or facial recognition systems, information beyond their professional scope may be collected. This could include details such as who they live with, whether they have children, and if they have a medical condition. For instance, a book about cancer on a shelf behind the employee’s webcam could reveal this information. The same problem can arise with geolocation data because it provides access to personal information beyond the employer’s monitoring authority, such as the neighborhood where the worker lives and the places they frequent.

A practical example of this intrusion can be seen when home-office monitoring tools capture data unrelated to an employee’s professional activities. For instance, keylogger software installed on a company laptop may inadvertently record personal banking credentials or private communications conducted during breaks, while application monitoring might reveal frequent use of health-related websites that disclose sensitive medical conditions. Similarly, geolocation tracking could expose visits to religious institutions, political meetings, or even family residences, all of which fall far outside the legitimate scope of workplace oversight. These forms of data collection, though incidental, transform employer surveillance into a mechanism that risks undermining personal privacy and autonomy, highlighting the need for clear boundaries between professional and private life.

Furthermore, the monitoring of employees’ emails, instant messages, file transfers, typing patterns, printed documents, online meetings, and even social media activity—often conducted without meaningful consent (if it is possible to have free consent in an employment relationship, on which the worker is economically dependent)—can expose large amounts of sensitive personal information that go far beyond what is necessary for the employment relationship. Even when employers outline general monitoring practices, workers rarely perceive the full scope or depth of the data being gathered: how many categories of information are collected, which specific details are extracted, and what these ultimately disclose about their private lives. When the criteria for behavioral data collection are opaque, monitoring systems effectively operate as a black box, heightening the risk of capturing intimate and irrelevant information and blurring the boundary between legitimate workplace oversight and intrusive surveillance.

Another problem arises when employers demand and collect precise information about how their employees use their time. This undermines the employees’ autonomy in performing their assigned tasks and can stimulate negative feelings at work (such as fear of performing tasks or even exacerbated competition in relation to colleagues) and illnesses (such as stress, or “technostress”, and anxiety). Supervising work is part of an employer’s managerial authority. This authority includes the power to direct employees’ work ([42]), and it is guaranteed by Brazilian law⁶. This topic will be discussed in more detail in Part IV. The employment contract supports this managerial power by establishing the employee’s subordination to the employer ([42]), which is also legally backed⁷. Given the requirement of subordination, it is reasonable to expect that an employee’s autonomy to be reduced, as it is the duty of the contracting company to monitor the performance of assigned tasks.

However, excessive monitoring can infringe upon an employee’s autonomy to perform their duties. This has negative implications for their ability to perform their tasks creatively. Employees tend to be less creative when they feel that their actions and communications are being monitored because they are concerned about how their actions will be judged ([16]; [38]). This can occur, for example, when employees know that the content of their emails, instant messages, file transfers, typing, printed documents, and online meetings are being monitored.

When employees are acutely aware that every action is being tracked, they may begin to self-censor, avoiding experimentation, risk-taking, or even minor mistakes that are part of the natural learning process. For instance, a software developer who knows their keystrokes and screen activity are being logged might hesitate to test unconventional coding solutions, fearing that failed attempts could be misinterpreted as incompetence rather than innovation. Instead of exploring new approaches or expressing candid opinions, workers may choose the safest course of action, limiting their willingness to innovate or engage openly.

Excessive monitoring can negatively impact employees for two primary reasons. First, it has the potential to compromise employee privacy, especially if employees do not authorize the disclosure of their information, which is then transmitted to unknown third parties ([40]). Second, the use of surveillance technologies can lead to “function creep” ([7]), which occurs when people analytics tools produce more information than intended that can be used for purposes other than the intended monitoring.

This illustrates that the information gathered through employee monitoring can offer insights into not only their professional conduct to their personal lives. This issue is further exacerbated when this information is used to make decisions about compensation or advancement. These developments raise intricate concerns about privacy, personal space, the private sphere, reputation, and employees’ image. Without a clear framework in place, employee monitoring can have serious repercussions, disrupting established work practices and adversely impacting existing levels of control, autonomy, and trust between workers and the company.

Furthermore, employee monitoring software can operate visibly, with employees aware their activities are being tracked, or invisibly, without their knowledge. A report by the Electronic Frontier Foundation ([28]) revealed that many such tools are designed to avoid detection, raising serious concerns about the security and privacy of collected data. However, the use of such software gives rise to concerns regarding the security and privacy of the information companies collect. These risks are heightened when information is gathered without consent, particularly in remote work settings. As corporate surveillance technologies advance, they increasingly challenge the legal boundaries of acceptable monitoring practices.

The use of artificial intelligence tools for employee monitoring is a relatively recent phenomenon, and in Brazil there is still no specific law regulating either AI in general or its application in the workplace. What does exist are broader provisions on the automated processing of personal data contained in the Brazilian General Data Protection Law (LGPD), as well as other data protection rules that may be applied by analogy. In this context, it becomes necessary to examine the current legal framework to determine which monitoring practices could be considered legitimate and which may exceed reasonable limits, particularly when evaluated against the principles and safeguards established by the LGPD.

The Brazilian Federal Constitution provides strong protections for individual rights in this area. Article 5, item X⁹, establishes that intimacy, private life, honor, and image are inviolable, guaranteeing individuals the right to seek compensation for material or moral damages resulting from violations ([14]). More recently, the right to the protection of personal data was expressly recognized as a fundamental right and incorporated into Article 5 under item LXXIX¹⁰ (Constitutional Amendment No. 115, 2022). This constitutional framework reinforces the idea that the handling of personal information—whether by the State or private entities—must respect core principles of privacy and dignity, serving as a foundation for interpreting and applying data protection rules in Brazil.

Under Article 2 of the Brazilian Consolidation of Labor Laws (Consolidaçãodas Leis doTrabalho—CLT, in Portuguese) ([13]), employee monitoring is considered part of the employer’s managerial and supervisory authority¹¹. Paragraph 6 of Article 6 reinforces this by expressly allowing the use of technological tools to supervise work activities¹². Moreover, Article 74, sections 1 and 2¹³, requires companies with more than 20 employees to record and monitor attendance, specifically working hours. Together, these provisions establish a legal basis (or at least a presumption that it is legally possible) for employer oversight, while also setting boundaries on how monitoring should be conducted in practice.

In a 2020 decision, the Superior Labor Court (Tribunal Superior doTrabalho—TST, in Portuguese) held that employers may install surveillance cameras in shared workspaces, provided the equipment is placed in common areas and employees are duly informed in advance (Regional Labor Court of the 15th Region, 2023). The Court, however, imposed clear limits: cameras are strictly prohibited in locations intended for rest, as well as in spaces where privacy could be compromised, such as bathrooms and changing rooms. This ruling underscore the need to balance legitimate managerial interests in supervision with the fundamental right of workers to privacy and dignity in the workplace.

In contemporary office layouts, however, this separation between work and rest areas is not always clear-cut. Open-plan environments often include lounge spaces with sofas, beanbags, or other informal seating arrangements that serve simultaneously as areas for relaxation and as alternative workstations. In some cases, break areas are located within or adjacent to shared workspaces, making it difficult to distinguish where monitoring should legitimately occur. This architectural and functional overlap creates additional challenges for ensuring compliance with privacy protections, as surveillance devices placed in these settings may inadvertently capture moments intended for rest or personal interaction, thereby blurring the boundary between professional oversight and undue intrusion.

This illustrates that, under established legal and organizational traditions, the responsibility for monitoring lies primarily with the employer. Employers are granted the prerogative to adopt measures designed to safeguard company assets, ensure the physical safety of their workforce, and prevent misconduct such as sexual or moral harassment in the workplace. Yet, as noted in the challenges posed by modern office layouts—where rest areas and workstations often overlap—the exercise of this prerogative requires careful calibration. Without clear boundaries, surveillance intended to protect legitimate business and safety interests risks encroaching upon employees’ spaces of rest and informal interaction, thereby intensifying tensions between managerial oversight and the preservation of individual privacy and dignity.

While labor courts and legislation recognize that employers can legitimately monitor their employees, they have also established clear limits on such monitoring. A regional labor court has ruled that companies must compensate employees and even reverse dismissals for cause when personal data is misused or employee privacy is violated ([51])¹⁴. These limits are based on the principles of proportionality and the safeguarding of employees’ constitutional rights to privacy and intimacy.

However, as new technologies emerge, the boundaries of monitoring become increasingly blurred. There are cases in the Superior Labor Court that allow employers to monitor material provided to employees (e.g., company computers and corporate email accounts), but prohibit the monitoring of personal accounts and devices. However, employers must inform their staff that they are monitoring them and make them aware of the risks. On the other hand, there have been discussions about the feasibility of requests for disclosure of employee geolocation data to the contracting company for the purpose of proving compliance with working hours, without reaching a consensus on the matter. Many decisions emphasize the importance of informing employees and, when necessary, obtaining their consent for the processing of personal data. This ensures that such processing complies with established legal and procedural safeguards.

For employees, nevertheless, challenging monitoring practices that exceed what is reasonable under Brazilian law places them in a particularly difficult position. From one perspective, it is often nearly impossible for workers to fully grasp the extent of the monitoring to which they are subjected, especially given the complexity of the technologies involved and the frequent, opaque updates to the tools used by employers. From another perspective, even when employees recognize that surveillance may have crossed legal or judicially recognized boundaries, formally raising a complaint against the employer can be daunting, as it risks straining the employment relationship and exposing them to retaliation. This asymmetry of power underscores the vulnerability of workers in confronting excessive monitoring and highlights the need for stronger institutional safeguards to ensure that employee rights are not undermined by the broad supervisory powers afforded to employers under Brazilian labor law.

In this context, Brazil enacted Law No. 13,709/2018, the General Data Protection Law (Lei Geral deProteçãode Dados—LGPD, in Portuguese), with the objective of establishing clear parameters for the processing of personal data and ensuring the protection of citizens’ fundamental rights, particularly the rights to privacy and informational self-determination. Although approved in 2018, the LGPD only came into full effect in September 2020, marking a significant milestone in the Brazilian legal framework by aligning national data protection standards with global regulatory trends and providing a comprehensive basis for evaluating the legitimacy of data processing practices across both public and private sectors ([33]).

The LGPD establishes principles and regulations for safeguarding personal data, including that of employees. The LGPD requires that data processing be based on a specific legal basis, carried out transparently and proportionately, and that data subjects be informed of the purposes of the processing and given reasons for it.

The LGPD’s scope encompasses public and private companies that process personal data (Art. 1), with the stipulation that monitoring must be confined to work-related data ([55]). Additionally, companies are prohibited from disclosing information obtained through monitoring ([55]). When collecting personal data from its employees, the company generally acts as a controller, meaning it is responsible for making decisions regarding the processing of personal data (e.g., promotion, engagement, etc.). In contrast, HR Techs are responsible for collecting data and utilizing it to make predictions, acting as data processors. In essence, they handle the processing of employee data for the contracting company, while decisions about it are made elsewhere.

In order to process personal data, the controller must establish a corresponding legal basis, which will determine specific legal obligations that must be fulfilled by the controller. This obligation is based on the principle of necessity, according to which the processing of personal data must be restricted to the minimum necessary to achieve the intended purposes ([50]). This means that data must be relevant, proportionate, and not excessive in relation to the purposes of the data processing.

Therefore, any data collected must be necessary to achieve a legitimate purpose, as outlined in Article 6, I of the LGPD. This means that data must be processed for “specific, explicit, and informed purposes, without the possibility of further processing in a manner incompatible with those purposes.” Therefore, the most reasonable understanding is to justify the option for monitoring when the purpose of its processing cannot be fulfilled by other means that are less invasive to the fundamental rights and freedoms of workers (intimacy and privacy).

As discussed in the previous chapter, implementing people analytics may lead to processing unnecessary personal data. For example, rather than monitoring all content accessed and/or typed by the employee to detect productivity bottlenecks and prevent distraction, as many HR tech companies do, information can be collected about which websites the employee accesses and for how long. For example, if an employee accesses their personal email account and receives a medical examination result, health data—which is considered sensitive—will be collected. However, this data is unnecessary to prevent distraction while performing professional tasks.

To avoid exceeding what is necessary, the LGPD requires the controller to identify and justify the applicable legal basis for processing personal data. As outlined in Article 7¹⁵, processing personal data is permitted only when the following conditions are met: i) the data subject must give consent; ii) the controller must comply with a legal or regulatory obligation; iii) public administrations must process and share data to implement public policies outlined in laws and regulations or supported by contracts, agreements, or similar instruments; iv) research organizations must anonymize personal data wherever possible when conducting studies; v) processing is necessary for a contract or preliminary contract procedures in which the data subject is involved, at the data subject’s request; vi) for regularly exercising rights in judicial, administrative, or arbitration proceedings; vii) for protecting the life or physical safety of the data subject or a third party; viii) for protecting health, exclusively in procedures performed by health professionals, health services, or health authorities; ix) when necessary for meeting the legitimate interests of the controller or a third party; and x) for credit protection.

The processing of sensitive data must be carried out with the explicit consent of the data subject, in a clearly defined and easily identifiable manner, for specific and explicit purposes (Art. 11, I). Alternatively, in the absence of consent from the data subject, processing may be conducted only in cases where it is absolutely necessary for the following items: i) the controller must comply with legal or regulatory obligations; ii) data must be shared for the public administration to implement public policies provided for in laws or regulations; iii) research bodies must conduct studies, ensuring the anonymization of data wherever possible; iv) rights must be exercised regularly, including in contracts and in judicial, administrative, and arbitration proceedings; v) protection of the life or physical safety of the data subject or a third party is paramount; vi) protection of health, exclusively in procedures performed by health professionals, health services, or health authorities, is a priority; vii) ensuring fraud prevention and the security of the data subject in the processes of identification and authentication of registration in electronic systems is essential.

A relevant distinction between the LGPD and the General Data Protection Regulation (GDPR) of the European Union lies in the legal bases for processing that are unique to the Brazilian framework. Unlike the GDPR, the LGPD expressly includes credit protection as an autonomous legal basis (Art. 7, X), reflecting the strong role of consumer credit systems in Brazil and the need to regulate data flows connected to financial institutions and credit bureaus. Similarly, the LGPD establishes the implementation of public policies by public authorities (Art. 7, III) as a separate ground for processing, a basis not explicitly present in the GDPR, which addresses public interest in broader terms. Another point of divergence is the explicit mention of the protection of life or physical safety (Art. 7, VII), which, although indirectly encompassed under the GDPR’s vital interests ground, is given independent and specific status in Brazilian law. Finally, in the context of sensitive personal data, the LGPD provides for fraud prevention and the security of the data subject in identification and authentication processes in electronic systems (Art. 11, II, g), which has no direct counterpart in the GDPR. These additional legal bases demonstrate how the Brazilian legislator tailored the LGPD to local economic and social realities, extending its scope beyond the more general grounds found in European regulation.

Therefore, when processing personal data—including sensitive data—companies must comply with the LGPD by grounding such activities in one of the legally recognized bases. As highlighted in the comparison with the General Data Protection Regulation (GDPR), the Brazilian framework offers a broader range of legal justifications, some of which are tailored to local realities, such as credit protection or the implementation of public policies. In the specific context of employee monitoring, however, the most relevant grounds tend to fall within four categories: i) the employee’s consent; ii) the employer’s legitimate interest in managing and supervising the workforce; iii) compliance with legal or regulatory obligations, such as labor law requirements; or iv) the execution of contractual duties arising from the employment relationship. These bases provide the legal foundation for processing data in pursuit of objectives like maintaining productivity, safeguarding corporate assets, and protecting the company against potential legal liability, while ensuring that such practices remain aligned with the principles of necessity, proportionality, and transparency established by the LGPD.

Consequently, legal bases other than consent do not require authorization from the data subject to process their personal data. However, according to the principles of transparency and accountability, individuals must be informed through a privacy notice that they are being monitored. The notice must clearly state what data is collected, the purpose of the processing, and the retention period. It must also be displayed in a prominent, easily visible location. This requirement clarifies that spyware, which monitors employees without their knowledge, violates the LGPD and is not advisable from a data protection perspective ([43]).

Furthermore, employers should not store data indefinitely, but rather for only as long as it serves the original intended purpose. The controller should establish a retention period¹⁶ for personal data collected for monitoring purposes and delete it once the processing purpose has been fulfilled.

Finally, data controllers and processors must maintain detailed records of their processing activities, with special attention to operations based on legitimate interest (Article 37 of the LGPD). Under the Brazilian General Data Protection Law, legitimate interest permits the processing of ordinary personal data without consent, provided that the purposes are lawful, specific, and proportionate, and that such processing does not infringe upon the fundamental rights and freedoms of the data subject. In this respect, the LGPD aligns with the General Data Protection Regulation (GDPR), which also recognizes legitimate interest as a flexible ground for processing. However, while the GDPR requires controllers to conduct and document a balancing test to weigh organizational interests against individual rights, the LGPD goes further by expressly linking legitimate interest to the preparation of a Data Protection Impact Report (Relatório de Impacto à Proteção de Dados Pessoais) whenever the processing may present significant risks. This requirement strengthens the accountability ([60]) framework in Brazil by obliging controllers to justify the necessity of processing and to demonstrate the safeguards adopted. As in the GDPR, legitimate interest under the LGPD cannot be invoked for sensitive personal data, which is subject to stricter conditions and legal bases.

Although the legislator did not determine the minimum content of the record, the LGPD itself provides elements that can be used to define criteria ([60]). These elements include identification of the processing agent and the data subject; nature of the personal data processed; purpose, form, and duration of the processing; information about the shared use of data; legal basis assigned; and information related to the international transfer of personal data (if applicable) ([32]).

Next, we will conduct a more in-depth analysis of the legal basis applicable to processing personal data for monitoring employees using automated people analytics tools. Next, we will explore the role of the Brazilian National Data Protection Authority (ANPD) in this context.

4.2.1. Consent

According to the LGPD, consent is defined as “the free, informed, and unequivocal expression of agreement by which the data subject consents to the processing of their personal data for a specific purpose” (Art. 5, XII). Therefore, an employee’s consent for processing personal data must be given voluntarily and for a specific purpose. Employers must provide information on what data is collected, its intended use, how long it will be stored, who will have access to it, and whether it will be transmitted to third parties ([22]).

An illustrative example in which an employee’s consent in the workplace would not be undermined by subordination is the voluntary participation in a corporate wellness program. Suppose a company offers employees the option to join a mindfulness or fitness initiative that involves collecting basic health and lifestyle data through a mobile app. Participation is entirely optional, no employment-related consequences arise from refusal, and the benefits—such as access to gym facilities or wellness workshops—are additional perks rather than conditions of employment. In this context, the employee’s decision to consent is genuinely free, as declining would not affect their job security, career progression, or daily work activities, thereby ensuring that the consent is valid and not tainted by the inherent power imbalance of the employment relationship.

Although new legal bases for data processing are available, consent continues to be one of the most frequently used because it can simplify the controller’s compliance obligations. When the data subject gives consent, the controller can more easily demonstrate that the processing is lawful, thereby fulfilling the principle of accountability ([60]). However, the scope of consent is limited: it only authorizes the specific controller who obtained it to process the data. If the data is to be shared with third parties, the controller cannot rely on the original consent alone. In such cases, new and explicit consent from the data subject is required—unless another legal basis clearly permits the transfer or disclosure of the data. This limitation underscores the importance of transparency and precision in obtaining consent, as it does not provide a blanket authorization for all forms of data use.

Although consent is recognized as a valid legal basis for processing personal data under the LGPD, in the employment context it is not always the most suitable option. This stems from the inherent power imbalance between employers and employees, where subordination may lead workers to feel that withholding consent could negatively affect their position. As a result, even when consent is formally obtained, it may not be considered truly free or informed, casting doubt on its validity ([10]). For this reason, in scenarios involving workplace monitoring, other legal bases—such as the employer’s legitimate interest or the need to comply with legal obligations—may provide a more appropriate and reliable foundation for processing, while also offering greater protection for employees against potential coercion or misuse of their personal data ([9])¹⁷.

Therefore, the choice of legal basis must take into account the specific circumstances of each case and the nature of the relationship between the parties. When it comes to sensitive personal data—such as information about health, religion, ethnicity, or sexual orientation—consent is generally the most appropriate basis, as it aligns with the heightened expectations of privacy attached to these categories of data. In such situations, employees must be clearly and transparently informed about the purposes of processing so that their consent is both specific and explicit, in compliance with Article 11, I of the LGPD. This ensures that the use of particularly delicate information is strictly limited to the purposes expressly authorized by the data subject, thereby reinforcing both legal safeguards and the trust necessary for legitimate processing.

4.2.2. Legitimate Interest

Legitimate interest is one of the legal bases for processing personal data under the LGPD. It applies specifically to the processing of ordinary personal data, provided that the controller carries out a balancing test between its own interests (or those of a third party) and the fundamental rights and guarantees of the data subject. Article 10 of the LGPD establishes a four-step test for this assessment. First, it must be verified whether the controller’s interest is connected to a legitimate purpose. This purpose cannot conflict with other legal provisions and must be duly justified as necessary for the specific processing of personal data in question (Art. 10, I, LGPD).

Next, determine if the collected data is necessary to achieve the intended purpose (Art. 10, §1, LGPD). Two key questions can guide this step: 1) can the same result be achieved with less data, and 2) could another legal basis justify the processing? If the answer to both is no, proceed to the balancing phase. During the balancing phase, analyze the potential impact of the processing on the data subject and their legitimate expectations (Art. 10, II, LGPD). Determine if the use of the data is consistent with the original purpose. Consider the data subject’s expectations and identify any potential negative effects on their autonomy, including the risk of discrimination.

Finally, to process personal data based on legitimate interest, the company must ensure transparency and minimize risks to the data subject. Measures such as data anonymization can mitigate these risks (Art. 10, §§ 2-3, LGPD).

In the context of collecting personal data through employee monitoring for people analytics, employers have a legitimate interest in ensuring that their employees complete their assigned tasks. Using this data to define metrics and identify risks can improve productivity and reduce costs by enabling effective management of workloads and time allocation. This approach ensures that company resources are used appropriately and provides documentation in case of potential litigation. Additionally, it allows organizations to address reports of workplace harassment. When monitoring is conducted with explicit objectives and quantifiable metrics, it can support high-performing employees who might otherwise be overlooked or affected by human bias.

In the case of Sólides, the legitimacy of the employer’s interest lies in using behavioral and demographic data (e.g., name, email, telephone number, social security number, and self-declared behavioral tendencies) to create profiles that optimize recruitment and talent management. This aligns with a lawful and organizationally necessary purpose. Regarding necessity, the processing of such ordinary personal data is adequate to achieve the stated goals without resorting to more intrusive or sensitive categories of data. Transparency is ensured when employees are informed that their data will be used to generate behavioral profiles and climate surveys, thereby allowing them to understand the scope of processing. Finally, the impact on rights must be carefully assessed: since the data are not sensitive and are directly provided by the data subject, the risks to privacy and autonomy are relatively low, provided the employer avoids discriminatory or opaque use of the profiling outputs. Taken together, these elements support the viability of legitimate interest as a lawful basis under the LGPD.

For Hubstaff, the legitimate purpose is centered on productivity management in remote or hybrid work arrangements. The company collects ordinary data, such as name, email, position, and user activity information (applications accessed, URLs visited, and time spent on tasks), which are directly connected to performance monitoring. From a necessity perspective, this type of monitoring is limited to operational data that serve to identify workflow bottlenecks and ensure accountability, without extending into unnecessary or sensitive areas. Transparency requires clear disclosure to employees that such activity monitoring will occur and how the resulting reports will be used. As for the impact on rights, the monitoring must be implemented in a proportionate way, ensuring it does not lead to constant surveillance or unreasonable pressure on workers. When the scope of processing is clearly defined, limited to operational data, and subject to oversight, legitimate interest stands as an appropriate legal basis for Hubstaff’s processing activities.

By contrast, the practices of WE Controlio, as described in the available documents, suggest that legitimate interest may not be an appropriate legal basis. The company records usernames, email addresses, IP addresses, and browser information, but also engages in far more invasive measures, such as uninterrupted screen recording, access to the content of emails and instant messages, and continuous screenshot capture, often without the employee’s awareness. While employers may claim a legitimate purpose in preventing misuse of company resources, the breadth and intensity of this monitoring appear disproportionate to that objective. The lack of transparency and the high degree of intrusion into employees’ private communications and activities significantly undermine the balance between organizational interests and fundamental rights. In such a case, legitimate interest would struggle to meet the requirements of necessity and proportionality under the LGPD, making alternative legal bases—such as consent in narrowly tailored circumstances or specific legal obligations—more suitable for legitimizing the processing.

Employers are expected to monitor their employees in the workplace as part of their managerial authority, which is recognized as a legitimate purpose under Brazilian labor law. In some cases, such as Hubstaff, where the monitoring is limited to operational data—like time spent on tasks, applications accessed, and websites visited—the legitimate interest of the employer can serve as a valid legal basis under the LGPD. Here, the collection of ordinary personal data is directly connected to productivity management in remote or hybrid work arrangements, and the monitoring can be proportionate, transparent, and limited to what is necessary to achieve organizational goals.

However, the scope and method of data collection must always remain proportionate and reasonable in relation to the purpose pursued. Sólides, for example, collects personal and behavioral data directly provided by employees in order to generate profiles, climate surveys, and performance indicators. When applied transparently and within well-defined boundaries, this type of people analytics can also be supported by legitimate interest, as the processing involves non-sensitive data and seeks to enhance recruitment and workforce management. By contrast, cases like WE Controlio, which involve constant screen recording, access to emails and instant messages, and uninterrupted screenshots without the employee’s awareness, go beyond what is necessary for productivity monitoring. Such practices demonstrate how disproportionate surveillance undermines transparency and fails the balancing test required for legitimate interest to apply.

Finally, even when monitoring falls within managerial prerogatives, legitimate interest cannot serve as a legal basis where the processing involves sensitive personal data. This includes biometric identifiers, health information, and data revealing racial or ethnic origin, religious beliefs, political opinions, or union membership. In such circumstances, the employer must rely on other legal bases under the LGPD—such as the specific and informed consent of the employee or the fulfillment of legal or regulatory obligations—to ensure that the processing is lawful.

4.2.3. Compliance with Legal or Regulatory Obligations by the Controller

The controller may use this legal basis to comply with legal or regulatory obligations when applicable legislation or regulations require monitoring as a legal obligation. Examples of such cases include workplace safety issues, protection of confidential information, and compliance with specific standards for certain professions. Employers are not required to obtain their employees’ consent for processing their personal data in such cases. However, employers must clearly communicate the circumstances under which employee data will be processed in accordance with the transparency principle ([60]).

In this sense, companies like Mywork illustrate how compliance with legal obligations may serve as a legal basis for processing. Mywork collects information regarding employees’ entry and exit times through geolocation and photo registration. Under Brazilian labor law, employers with more than twenty employees must keep accurate records of working hours. The use of digital tools such as Mywork’s time and attendance system directly responds to this legal requirement. In such cases, the employer is not relying on legitimate interest or consent, but rather on the need to comply with Article 74 of the CLT, which establishes the duty to record employees’ working hours. The data processed is therefore justified by law and limited to what is necessary for compliance.

Similarly, Factorial offers attendance and absence management services, including webcam monitoring and the collection of entry and exit times. When these services are used exclusively to meet the employer’s obligation to document employees’ working hours, the processing of personal data falls under the legal obligation basis rather than legitimate interest. The decisive factor is whether the monitoring is restricted to fulfilling the statutory duty to maintain time records, as opposed to broader, discretionary purposes such as performance evaluation. By grounding the processing in legal obligation, employers both comply with labor law and respect the principle of necessity under the LGPD, ensuring that only data strictly required by the regulation are collected and processed.

For employees covered by the CLT, Article 6 establishes that employers may use work supervision measures. However, Article 74 stipulates that companies with more than 20 employees must maintain a manual, mechanical, or electronic record of their employees’ arrival and departure times. Based on this legal basis, such devices could justify the processing of personal data for monitoring purposes.

4.2.4. Contract Performance

The legal basis for executing a contract establishes that personal data may be processed when necessary to fulfill the agreed-upon contractual terms or preliminary procedures related to a contract involving the data subject, at the data subject’s request. Therefore, if collecting and processing personal data is essential to performing an employment contract, the contracting company may proceed without obtaining the data subject’s explicit consent. However, the collection and processing of personal data must be strictly limited to fulfilling the contract or pre-contractual obligations, and it cannot be used for any other purpose.

For instance, Time Doctor collects information such as employee names, emails, and activity records (including time spent on each task, applications used, and websites visited) to generate productivity reports. When an employee’s contract explicitly requires compliance with working hours, task monitoring, or performance evaluations tied to deliverables, the processing of such data is directly linked to fulfilling contractual obligations. In this context, the company does not need to rely on consent or legitimate interest, since the monitoring is necessary to perform the terms of the employment contract itself. The key limitation, however, is that the data collected must remain proportional to the contractual purpose and not be extended to unrelated forms of surveillance.

Similarly, Mywork manages attendance records by collecting employees’ personal data such as full name, personal documents (e.g., RG, CPF, Work Permit), date of birth, and geolocation data at the time of entry and exit. This information is essential to enforce the contractual terms related to working hours, overtime calculation, and payroll management. In this context, processing is grounded on the contractual basis, as the employer must ensure accurate compliance with the agreed-upon work schedule and related obligations. However, if the company were to expand the use of geolocation data to monitor employees outside the scope of contractual duties—such as tracking their movements beyond working hours—such processing would no longer fall within contract performance and would require a different legal basis under the LGPD.

Note that, as with the legal basis of legitimate interest, performance of a contract cannot justify processing sensitive data. Therefore, it is not possible to classify the processing of biometric data, health data, or data revealing racial or ethnic origin, religious beliefs, political opinions, union membership, or membership in religious, philosophical, or political organizations under the legal basis of contract performance.

To monitor employees using people analytics, it is necessary to analyze the role of the National Data Protection Authority (ANPD) in processing personal data. The ANPD is a special autonomous agency affiliated with the Ministry of Justice and Public Security (Decree No. 11,758, 2023). It is responsible for ensuring the security of personal data and supervising the application, regulation, and enforcement of the LGPD in Brazil ([6]). Therefore, the ANPD is a key component in ensuring the efficacy of the LGPD for both data processors and data subjects ([9]).

According to Article 20 of the LGPD, data subjects have the right to request a review of decisions based solely on automated processing of personal data that affect their interests. This includes decisions intended to define their professional profile. Therefore, employers are responsible for providing employees with clear and adequate information regarding the criteria and procedures used in automated decisions within the scope of people analytics, while observing commercial and industrial secrets (§1). If such information is not provided, the ANPD reserves the right to conduct an audit to verify any discriminatory aspects in the automated processing of personal data.

This provision underscores the ANPD’s subsidiary role in this situation. If the controller refuses to provide a detailed report on the criteria and procedures used for the automated decision, the Authority may audit it to verify possible discriminatory aspects and confirm that the data processing complies with the law and the fundamental rights established in the Constitution.

Furthermore, the ANPD may establish specific guidelines and regulations for the collection, processing, and storage of personal data in the context of employee monitoring using artificial intelligence ([35])¹⁸. The ANPD may penalize organizations that fail to comply with the legislation. These penalties may include warnings, fines¹⁹, and suspension or prohibition from activities involving the processing of personal data.

It is important to note that the LGPD, enacted in 2018, is based on the European General Data Protection Regulation (GDPR), which was enacted in 2016. Consequently, many of the powers granted to the ANPD are also granted to European data protection authorities. These authorities have a more consolidated role, so analyzing them will help us understand how the ANPD may position itself in the future.

The General Data Protection Regulation (GDPR) stipulates that European data protection authorities are responsible for enforcing the law to protect the fundamental rights and freedoms of natural persons with regard to the processing of personal data and to facilitate the free flow of personal data within the Union (Article 51 of the GDPR). Furthermore, all authorities from the European Data Protection Board (EDPB) collaborate to ensure enforcement at the national and cross-border levels ([27]).

To gain insight into how European authorities have addressed the issue of personal data processing for employee monitoring purposes, a search was conducted for decisions on the subject since the law was enacted (2016). The research was conducted on the Enforcement Tracker platform ([25]) using the following keywords: Please use the terms “employee monitoring,” “employee,” and “working environment.” A total of 268 decisions were identified, of which eight specifically address the issue of employee monitoring by companies.

Table 6 below provides an overview of the sanctions imposed by European data protection authorities and their respective justifications.

As illustrated in Table 6, companies are primarily found guilty of collecting personal data from their employees through monitoring that fails to comply with general data processing principles, such as necessity, transparency, and accountability. Furthermore, in Europe, punitive measures are becoming increasingly common, with the imposition of heavy fines.

The GDPR explicitly establishes what a company can and cannot do with employee data, restricting the use of personal data for automated scoring and employee profiling purposes. Additionally, data subjects cannot be subject to automated decisions unless they fall under one of the exceptions provided for in the regulation ([58]). In contrast, the LGPD offers greater flexibility than the European regime by not prohibiting the execution of automated decisions. Rather, it establishes safeguards and duties for data processors to follow, including the right of review set out in Article 20.

In Brazil, the Judiciary has the authority to impose sanctions on companies that mishandle their employees’ personal data. However, as the ANPD’s actions align with a global movement by data protection authorities to establish remedial or preventive measures to ensure compliance with privacy and data protection standards by public and private entities worldwide, this scenario may evolve, potentially leading to the ANPD playing a more active role in cases involving the processing of Brazilian workers’ personal data. In this context, it remains to be seen whether the Brazilian authority will follow the European trend of imposing fines and increasing the amounts considered for fines.

Table 6.Decisions by European data protection authorities on real-time monitoring of employees (Source: Elaborated by the authors).

In light of the cases analyzed, our perception is that many of the companies operating in Brazil could significantly improve the quality of the information they provide about how employees’ personal data are processed, as well as their compliance with the principles and rules established by the LGPD. Transparency, proportionality, and accountability often appear insufficiently addressed in the materials and practices disclosed, which creates uncertainty for data subjects and may expose employers to legal risks.

Looking ahead, it is expected that the ANPD will strengthen its institutional capacity in the coming years to guide and, when necessary, sanction organizations, thereby fostering a culture of compliance more closely aligned with international standards and ensuring greater protection of Brazilian workers’ personal data. To enhance the practical implications of this study, it is important to consider future guidelines that the ANPD could issue to clarify the limits of employee monitoring. The Authority could, for example, develop model clauses for employment contracts that address data collection in a transparent manner, or establish specific guidelines for conducting Data Protection Impact Assessments (DPIAs) on monitoring technologies. Such initiatives would provide legal certainty for both employers and employees, aligning market practices with the fundamental principles of the LGPD.