Remote Work • Compliance • April 6, 2026

Employee Monitoring for Digital Nomads: Building a Policy That Works Across Borders

Over 35 million Americans now identify as digital nomads (MBO Partners, 2024), and more than 50 countries have launched dedicated digital nomad visas. For employers, this creates a thorny question: how do you maintain productivity visibility without triggering legal liability in a dozen different jurisdictions?

A digital nomad monitoring policy is a formal employer document that defines how employee activity tracking applies to workers who move between countries while employed full-time. It specifies which countries are approved, how long employees may stay, what monitoring applies, and how the company manages the overlapping legal requirements that arise when a US-employed worker is physically sitting in Lisbon, Tbilisi, or Bangkok. Without such a policy, employers face exposure to foreign labor law, data privacy violations, and unexpected tax liability — often simultaneously.

This guide covers the legal foundations, practical policy components, and country-specific nuances you need to get this right in 2026.

How Large Is the Digital Nomad Workforce, and Why Does It Create Monitoring Challenges?

The numbers are hard to ignore. MBO Partners' 2024 State of Independence report found 35 million Americans identify as digital nomads — a figure that has grown 131% since 2019. Globally, Statista estimates the nomad workforce at 40 million people. The majority work for traditional employers, not as freelancers.

This creates a specific problem: most employee monitoring software is deployed against a stable legal backdrop — typically the employment laws of the country where your company operates. The moment an employee works from a different country, that backdrop changes.

The practical monitoring challenges are significant:

• Jurisdiction uncertainty: Which country's privacy and labor laws govern the employee's activity data?
• Consent fragmentation: Some countries require explicit written consent for monitoring. Others require works council approval. Your standard employment contract likely covers none of this.
• Data transfer restrictions: GDPR and similar frameworks restrict transferring monitoring data outside certain regions.
• Time zone incoherence: Productivity comparisons across time zones are meaningless without timezone-aware reporting.

Which Country's Laws Govern a Nomad Employee's Monitoring Data?

This is the most commonly misunderstood aspect of nomad employment law, and getting it wrong is expensive.

The general rule across most legal systems is the place-of-work principle: employment law protections apply based on where the employee is physically working, not where the employer is headquartered. A US company employing a worker who is working from Germany for three months must comply with German labor law for those three months — including German rules on works council consultation for monitoring software.

GDPR adds another layer. If an employee is working from any EU country, their activity data is subject to GDPR processing requirements regardless of where their employer is based. The employer must have a lawful basis under Article 6(1) for collecting monitoring data, and employees must receive a GDPR-compliant data processing notice before monitoring begins.

Key country-specific rules that affect monitoring:

• Germany: The works council (Betriebsrat) must be consulted and approve any monitoring software before it can be deployed. Retroactive consent is not valid. If no works council exists, individual consent must be specific and informed.
• Portugal: Law 83/2021 explicitly restricts employers from using technology to monitor remote workers' performance or conduct in ways that infringe privacy or rest periods. Proportionality is required.
• France: Employees must be notified of monitoring tools through the CNIL (data protection authority) consultation process. Covert monitoring is prohibited. Monitoring must be disclosed in the employment contract or a separate addendum.
• US employees working abroad: US federal employment law (ECPA, NLRA) continues to apply to US-employed workers regardless of their physical location. State laws vary — California's CCPA, for instance, gives employees significant rights over their personal data.

What Tax Exposure Does Digital Nomad Work Create for Employers?

Beyond employment law, there is a tax risk that most HR teams do not fully appreciate: permanent establishment (PE) liability.

A permanent establishment arises when a country's tax authority determines that your company has sufficient economic activity within their borders to warrant taxing your corporate profits there. The presence of an employee performing services in a country is one of the most common triggers.

Thresholds vary widely. The OECD's model tax treaty sets a 183-day threshold as a common benchmark, but many countries apply lower thresholds for certain types of economic activity. Germany has assessed PE liability for stays as short as 90 days in some circumstances. The stakes are real: a 2023 EY survey found that 47% of multinational companies had received unexpected tax assessments related to remote work arrangements in the prior two years.

Practical risk management: most employer digital nomad policies cap approved country stays at 60-90 days per rolling 12-month period. This typically keeps employees below PE-triggering thresholds in most jurisdictions while still providing meaningful travel flexibility. Some organizations work with global employment organizations (GEOs) or Employer of Record (EOR) services for nomads who need longer stays.

Your monitoring data creates a secondary benefit here: timestamped activity logs provide audit-ready proof of exactly which days an employee was active, in what time zones, helping you demonstrate to tax authorities where work was actually performed.

What Should — and Should Not — Be Monitored for Nomad Employees?

For nomad employees on company devices, the practical answer is: monitor the same things you'd monitor for any remote employee, with disclosure adjusted for each country they work from.

Standard app and website usage tracking, automated time capture, and activity-based productivity metrics are defensible in most jurisdictions when properly disclosed. These focus on work activity on company-owned devices during declared work hours — which is the core of any legitimate productivity visibility program.

What to avoid:

• GPS location tracking of employees' physical location: This is a legal minefield across virtually every jurisdiction. Tracking where an employee physically is — not just their computer activity — requires much stronger justification, and many countries prohibit it outright for non-field roles. For nomad employees doing desk-based knowledge work, there is rarely a defensible business reason to track GPS.
• Monitoring personal devices: Never require or allow company monitoring software on personal devices. This creates data privacy violations in almost every jurisdiction and mixes personal and professional data in ways that are nearly impossible to manage legally.
• Continuous screenshot capture at high frequency: Some jurisdictions, particularly in the EU, may view frequent screenshot capture as disproportionate monitoring for knowledge workers. Configurable frequency — set to lower rates during standard remote work — is the safer approach.
• Off-hours monitoring: Activity tracking should stop when employees' declared work hours end. In several EU countries, monitoring outside of scheduled work hours is explicitly prohibited.

eMonitor's configurable monitoring settings let administrators set distinct monitoring profiles by team or individual, which is useful for nomad workers subject to different legal requirements depending on their current country. Timezone-aware dashboards ensure that productivity data is reported relative to each employee's local work schedule — not compared against a headquarters time zone that makes a Singapore-based worker look inactive during their productive morning hours.

What Are the Essential Components of a Digital Nomad Monitoring Policy?

A functional digital nomad monitoring policy has six core components. Here is what each should include:

1. Approved Countries List

This is the operational backbone of the policy. The approved list filters countries on four criteria: a legal right to work remotely (via digital nomad visa, tourist allowance, or permanent residency), a manageable permanent establishment risk profile, a reasonable data privacy compliance burden, and no active sanctions or security advisories.

Commonly approved countries in 2026 include Portugal, Estonia, Georgia (the country), Costa Rica, Barbados, and the UAE. Countries that typically require special legal review before approval include Germany (works council requirements), France (CNIL compliance burden), and Indonesia (complex visa conditions).

2. Maximum Stay Per Country

Set a maximum per country per rolling 12-month period. A standard safe-harbor threshold is 60 days per country, which comfortably avoids PE triggers in most jurisdictions. Some organizations use 90 days. Above 183 days in any single country almost always creates both PE risk and full employment law applicability.

3. VPN and Device Requirements

Require VPN use on all non-trusted networks. Specify that company monitoring software runs only on company-owned or IT-managed devices. Mandate full-disk encryption. Prohibit using personal devices for work tasks that involve company data. This section matters for both security and legal compliance — in the event of a data breach, documented device policies significantly reduce employer liability.

4. Monitoring Disclosure Per Country

Rather than a single global disclosure, effective policies include country-specific monitoring addenda. For EU countries, this means a GDPR-compliant processing notice specifying the legal basis, data types collected, retention periods, and employee rights. For Germany specifically, it should reference whether a works council review has been completed. For Portugal, it should explicitly state that monitoring is limited to work hours and does not infringe on rest periods.

5. Notification Requirements

Employees should be required to notify HR at least 14 days before working from a new country, and to confirm their return. This advance notice allows legal and HR to review the destination, issue any required country-specific disclosures, and update system configurations if needed. It also creates a documented record for tax purposes.

6. Data Handling and Storage Rules

Specify where monitoring data is stored, who can access it, and how long it is retained. For nomads working from GDPR-covered countries, data must be stored in a GDPR-compliant environment — either within the EU or via an approved cross-border transfer mechanism (Standard Contractual Clauses or an adequacy decision). eMonitor's data security architecture supports role-based access control and configurable retention periods, which simplifies this compliance requirement.

How Do Specific Countries Handle Employee Monitoring for Nomads?

Let's ground the legal principles in three concrete examples that come up most often.

Germany: Works Council Approval Required

Germany's Works Constitution Act (Betriebsverfassungsgesetz) gives works councils (employee representative bodies) co-determination rights over the introduction of monitoring systems. This means that before deploying monitoring software for German-based employees — even temporarily — you need works council consultation and agreement. If your organization does not have a German works council (most small and mid-size foreign companies do not), you must instead obtain specific, informed individual consent from each employee before monitoring begins.

This has a practical implication for nomad policies: employees heading to Germany should receive the country-specific disclosure and sign an individual consent addendum before departing. The monitoring configuration should also limit screenshot frequency to the minimum necessary for your legitimate business purpose.

Portugal: Performance Monitoring Has Specific Restrictions

Portugal's 2021 labor code amendments (Law 83/2021) were specifically designed to protect remote workers. The law prohibits employers from using technology — including software — to monitor the performance or behavior of remote workers in ways that invade privacy or restrict rest time. It also prohibits employers from contacting remote workers outside of agreed working hours for non-urgent matters.

For monitoring purposes, this means: activity tracking during work hours is defensible, but continuous screenshot capture (especially at high frequency) may be considered disproportionate. Time tracking is generally fine. Keystroke logging requires strong justification.

US Nomad Employees Working Abroad

A US employee working abroad continues to be subject to US federal employment law — including the Electronic Communications Privacy Act (ECPA), which permits employer monitoring of company devices and communications when employees are given prior notice. US state law continues to apply based on the employee's state of employment (where their employment relationship was established), not their current physical location.

This means a California-employed worker traveling to Bali is still protected by California labor law, including strict overtime rules, and by the CCPA's employee privacy protections. Your monitoring disclosure should reflect the state-level requirements of each US employee's employment state, not just the country they are currently in.

Digital Nomad Monitoring Policy Template: Key Sections

Here is the outline of a working policy template your legal team can adapt:

1. Purpose and Scope: Defines what the policy covers and who it applies to (full-time employees working outside their home country on company devices)
2. Approved Country Registry: Current list of approved countries, maintained and updated quarterly by [HR/Legal team]
3. Maximum Stay Limits: 60 days per country per rolling 12-month period unless extended through [specific approval process]
4. Pre-Travel Notification: 14 days advance notice to HR required; confirmation of return required within 5 business days of return
5. Device and Security Requirements: Company devices only; VPN required; encryption required; prohibition on personal device use for company data
6. Monitoring Standards: Standard monitoring applies (app/website tracking, time tracking, activity patterns); country-specific restrictions apply per Appendix A
7. Appendix A — Country-Specific Monitoring Disclosures: Separate disclosure for each approved country, reviewed by local counsel
8. Tax and Legal Responsibility: Employee acknowledges responsibility for individual income tax obligations; company commits to PE risk management
9. Policy Review: Quarterly review of approved country list; annual review of full policy

For full implementation guidance on monitoring distributed international teams, see our resource on monitoring international remote teams and the compliance hub.

How Does eMonitor Support Digital Nomad Workforce Management?

Managing monitoring compliance across a nomadic workforce requires tools that are configurable by individual or team, not just by organization. eMonitor supports several capabilities that are directly relevant:

• Individual monitoring profiles: Set different monitoring intensity levels for different employees, allowing you to reduce screenshot frequency for workers in restrictive jurisdictions while maintaining standard tracking for others.
• Timezone-aware activity reports: Productivity data is recorded against each employee's local timezone, making cross-timezone comparisons meaningful rather than misleading.
• Audit-ready activity logs: Timestamped records of work activity provide the documentation needed to demonstrate where work was performed — useful for both tax and compliance purposes.
• Role-based data access: Only authorized managers and compliance officers can access monitoring data, supporting GDPR's data minimization and access control requirements.
• Configurable data retention: Set retention periods that align with the shortest applicable requirement across your nomad workforce's active jurisdictions.

1,000+ companies use eMonitor to manage distributed workforces across multiple countries. See how remote teams use eMonitor or book a demo to discuss your specific nomad workforce situation.

Frequently Asked Questions

Sources

• MBO Partners, State of Independence in America Report 2024 — 35 million Americans identify as digital nomads
• EY, 2023 Global Remote Work Tax Survey — 47% of multinationals received unexpected tax assessments related to remote work
• OECD, Model Tax Convention on Income and Capital — 183-day permanent establishment threshold benchmark
• Portugal Law 83/2021 — Remote Work Labor Code Amendments
• Germany Works Constitution Act (Betriebsverfassungsgesetz) — Works council co-determination rights for monitoring systems
• EU GDPR, Article 6(1) — Lawful basis for processing employee data
• Statista, Global Digital Nomad Population Estimates 2024 — 40 million global digital nomads