Legal Opinions

The Data Protection Act, 2019 imposes a lawful-basis threshold that employers must satisfy before processing employee communications. While courts have recognised a legitimate interest in monitoring company-issued devices, proportionality remains decisive: notices must be clear, scope must be narrow, and any review of private accounts is unlikely to survive constitutional scrutiny. Employers should adopt written monitoring policies, obtain acknowledgement at onboarding, and route any investigation-driven review through a documented approval process.