This material considers Assimilated Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), and legislative links are to Assimilated Regulation (EU) 2016/679, UK GDPR, except where expressly stated otherwise. For a more detailed introduction to UK GDPR generally, see Practice Notes: The UK GDPR and DPA 2018: key data protection issues for employment lawyers and The UK General Data Protection Regulation (UK GDPR). This Practice Note examines the legal restrictions applicable to monitoring of staff, IT systems and electronic communications in the workplace and the requirements that must be observed in order for such monitoring to be undertaken lawfully. Sector-specific regulation (eg obligations to keep records of transactions in the financial services sector) may apply but are not addressed in this Practice Note in any detail. Interception or retention of communications data at the behest of the state is outside the scope of this Practice Note. For more information, see Practice Notes: The regulation of intelligence gathering—an introductory guide and Acquisition,