Compliance Guide
Employee Monitoring Laws in Switzerland: nLPD, Labour Code Article 26, and What Employers Can Lawfully Monitor
Employee monitoring laws in Switzerland operate under a dual legal framework that is stricter than GDPR in one critical area: Swiss Labour Code (ArG) Ordinance 3 Article 26 explicitly prohibits monitoring systems directed at continuously observing employee behavior or performance. This categorical prohibition, combined with obligations under the revised Federal Act on Data Protection (nLPD, effective September 1, 2023) and the Code of Obligations Article 328b, creates a precise set of permitted and forbidden monitoring practices. This guide covers what Swiss law allows, what it prohibits, how the nLPD compares to GDPR, the EDOB's position on home office monitoring, and the practical steps employers must take before activating any workplace monitoring program in Switzerland.
7-day free trial. No credit card required.
What Is Switzerland's Legal Framework for Employee Monitoring?
Employee monitoring laws in Switzerland rest on three interconnected legal sources that every employer must apply simultaneously. The Swiss Code of Obligations (OR) Article 328b governs what employee data employers may process at the employment relationship level. The Swiss Labour Act (ArG) and its implementing Ordinance 3 Article 26 impose a categorical prohibition on behavior surveillance systems. The revised Federal Act on Data Protection (nLPD, or nDSG in German) establishes data processing obligations, employee rights, and enforcement mechanisms. Together these three instruments create a framework that is GDPR-compatible but adds one unique restriction that has no direct GDPR equivalent.
Switzerland is not an EU member state, which means GDPR does not apply directly to Swiss employers monitoring employees within Switzerland. Swiss employers apply the nLPD instead. However, Swiss companies processing personal data of employees who are EU residents, or transferring monitoring data to EU countries, must simultaneously satisfy GDPR requirements. The European Commission recognized Switzerland as an adequate jurisdiction under GDPR's adequacy mechanism, meaning Swiss data protection standards are considered equivalent to the EU's baseline, though that status does not exempt Swiss employers from compliance when EU residents are involved.
The nLPD entered into force on September 1, 2023, replacing a 1992 law that had not kept pace with modern workplace monitoring practices. The revised act introduced data protection impact assessments, strengthened individual rights, created mandatory breach notification obligations, and aligned terminology with GDPR. The Federal Data Protection and Information Commissioner (FDPIC, also referred to as EDOB from its German initials) oversees nLPD enforcement and publishes guidance on workplace monitoring.
What makes Switzerland's framework distinctive is that the behavior monitoring prohibition in ArG Ordinance 3 Article 26 sits entirely outside the nLPD. Even if a monitoring tool met every nLPD requirement for lawful data processing, it would still violate Swiss law if its purpose or effect is to continuously observe employee behavior or performance. This means compliance analysis in Switzerland always requires checking both data protection law and labour law independently.
Swiss Labour Code Article 26: The Behavior Monitoring Prohibition Explained
ArG Ordinance 3 Article 26 is the most consequential provision in Swiss employee monitoring law. It states that surveillance and control systems in the workplace that are directed at or achieve a continuous monitoring of employee behavior or performance are prohibited. This prohibition is categorical: it does not require a showing of harm, it does not permit a business justification to override it, and it applies regardless of whether employees were notified.
What Does "Behavior Monitoring" Mean Under Article 26?
Swiss labour authorities and courts interpret behavior monitoring as surveillance aimed at observing how employees carry out their work rather than what they produce. The distinction matters because the prohibition targets purpose and effect, not the technical method. A system that produces behavioral data as a byproduct of an operational function does not automatically fall within the prohibition. A system designed or configured to observe employee conduct does.
The following practices fall within the behavior monitoring prohibition and are not lawful under Swiss law, even with employee consent and full nLPD compliance:
- Continuous screen recording configured specifically to observe how employees work through their computers
- Keystroke logging with behavioral profiling, where keystroke data is analyzed to assess individual work habits or detect disengagement patterns based on typing behavior
- Permanent webcam activation to watch employees at their workstations throughout the working day
- Real-time activity feeds that display second-by-second employee actions for supervisors to observe behavior in progress rather than review output after the fact
- Emotion detection or biometric behavioral analysis systems that infer employee states from physical or digital behavioral signals
What Does Article 26 Permit?
The behavior monitoring prohibition does not bar all workplace monitoring. Swiss law explicitly permits monitoring that serves operational, safety, security, or output measurement purposes, provided those systems are not directed at or structured to achieve behavioral observation. Permitted monitoring under ArG Ordinance 3 Article 26 includes:
- Time tracking systems recording when employees start, pause, and end work
- Application and website usage logging for project billing, client cost allocation, or IT resource management
- Access and security logs recording which systems or files were accessed, for data protection and IT security purposes
- Output measurement tools that record tasks completed, projects delivered, or productivity scores derived from work results rather than behavioral observation
- Attendance systems including geofence-based clock-in for field employees attending client sites
- Quality assurance systems in client-facing roles such as call recording for BPO and service organizations, where the monitoring purpose is verifying service delivery rather than observing employee conduct
The practical test Swiss employers should apply before configuring any monitoring tool is this: does the system measure what employees produce, or does it observe how they behave? Output measurement is permitted. Behavioral observation is not.
Why Article 26 Matters More Than nLPD for Most Monitoring Decisions
A common compliance mistake is running nLPD analysis on a monitoring tool, concluding that data processing is lawful, and then deploying the system. If that system achieves continuous behavioral surveillance, it violates ArG Ordinance 3 Article 26 even though the nLPD analysis was correct. Swiss law requires sequential compliance checks: first, does the monitoring constitute prohibited behavior surveillance under Article 26? If no, then does the data processing satisfy nLPD requirements? Both questions must have satisfactory answers before deployment.
nLPD Obligations for Swiss Employee Monitoring Programs
The nLPD (revised Federal Act on Data Protection, in force from September 1, 2023) imposes six core obligations on Swiss employers who monitor employees. These obligations apply to all monitoring programs that pass the ArG Ordinance 3 Article 26 behavior monitoring test.
1. Legal Basis for Processing
The nLPD requires a documented legal basis before processing employee personal data. For workplace monitoring, Swiss employers typically rely on one of three bases: the employment contract (processing necessary to execute the contract), a legitimate interest (employer's interest outweighs employee's privacy right), or a legal obligation (industry-specific compliance requirements). Consent is recognized under the nLPD but carries the same problems it does under GDPR: employment relationships create power imbalances that make freely given consent difficult to establish. Swiss data protection authorities and labor inspectors treat consent-based monitoring programs with greater scrutiny than legitimate interest programs supported by a documented proportionality assessment.
2. Code of Obligations Article 328b: The Employment-Specific Necessity Test
Code of Obligations Article 328b adds an employment-specific necessity test that operates separately from nLPD requirements. It states that employers may only process employee personal data that relates to the suitability of the employee for the job or that is necessary for the performance of the employment contract. This provision is significant because it creates a narrower necessity test than the general nLPD lawfulness requirement. Monitoring data that serves a general business interest but does not relate to the employee's suitability or contract performance fails the Article 328b test, even if it would pass nLPD scrutiny on its own.
3. Data Minimization and Purpose Limitation
The nLPD requires that personal data be collected only to the extent necessary for the stated purpose and used only for that purpose. For monitoring programs this means employers must specify in advance which data types they will collect and why, and then not use that data for other purposes without a new legal basis. An employer who collects application usage data for client billing purposes cannot later use the same dataset to evaluate employee productivity scores without re-establishing a separate legal basis for the productivity analysis purpose.
4. Privacy Notice Before Monitoring Begins
The nLPD requires employers to inform employees before collecting their personal data. A compliant monitoring privacy notice must state the identity of the data controller, the categories of data collected, the specific monitoring purposes, the legal basis relied upon, the retention periods, who has access to the data, and the employee's rights including access, correction, and deletion. Swiss practice recommends delivering this notice through the employment contract, a standalone monitoring policy attached to the contract, or a works agreement where employee representation bodies exist. The notice must be given before monitoring begins, not after deployment.
5. Data Protection Impact Assessment for High-Risk Processing
The nLPD introduced a Data Protection Impact Assessment (DPIA) obligation for processing that carries a high risk to the rights and freedoms of data subjects. Employee monitoring that involves systematic data collection, automated analysis of employee behavior, or large-scale processing of productivity data meets this threshold. A Swiss DPIA must document the processing purpose, the types of data collected, the risks identified, and the measures taken to reduce those risks. The EDOB may be consulted when a DPIA identifies residual risks that cannot be fully mitigated internally.
6. Data Subject Rights
Under the nLPD, employees have the right to access the monitoring data held about them, request correction of inaccurate data, request deletion when the processing purpose no longer applies, and object to processing based on legitimate interest. Employers must respond to access requests within 30 days. Providing employees with self-service access to their own monitoring data through an employee dashboard is both a practical way to reduce the volume of formal access requests and a transparency measure that supports the nLPD's accountability principle.
Output Monitoring vs. Behavior Monitoring: How Swiss Law Draws the Line
The most consequential compliance decision Swiss employers make is whether their monitoring program falls on the output side or the behavior side of the Article 26 line. Swiss law does not define the categories in a simple list; it applies a purpose-and-effect test that requires judgment. Understanding how regulators and courts have applied this test is more useful than memorizing definitions.
The Purpose Test
A monitoring system fails the purpose test when its primary design objective is to observe employee conduct. This is why continuous screen recording is typically prohibited: the reason most employers deploy it is to see what employees are doing on their computers moment by moment, which is behavioral observation. By contrast, application usage logging that records which software categories were active during work hours is permitted because its purpose is resource accounting or billing, not watching behavior.
The Effect Test
A monitoring system can also fail under Article 26 even when the employer's stated purpose is operational, if the system's actual effect achieves continuous behavioral surveillance. An employer who claims to monitor application usage for billing but configures the system to log individual keystrokes, capture real-time activity feeds, and generate second-by-second behavior scores has crossed into prohibited territory through effect, regardless of stated intent. Swiss labor inspectors evaluate both what a system is configured to do and what data it actually produces.
| Monitoring Practice | Swiss Law Status | Legal Reference |
|---|---|---|
| Automated time tracking (clock-in/out) | Permitted | ArG Ordinance 3 Art. 26 — output measurement |
| Application category usage (productive/neutral/non-productive) | Permitted | ArG Ordinance 3 Art. 26 — operational data |
| Task and project time allocation | Permitted | OR Art. 328b — employment contract performance |
| Access logs for IT security (which systems accessed) | Permitted | nLPD legitimate interest — data security |
| Periodic screenshots (configurable interval, blur enabled) | Permitted with conditions | Proportionality required; nLPD privacy notice required |
| Call recording for QA in client-facing roles | Permitted with conditions | nLPD legal basis required; employee notification required |
| Continuous screen recording to observe behavior | Prohibited | ArG Ordinance 3 Art. 26 — behavior monitoring ban |
| Keystroke logging for behavioral profiling | Prohibited | ArG Ordinance 3 Art. 26 — behavior monitoring ban |
| Permanent webcam activation during work hours | Prohibited | ArG Ordinance 3 Art. 26 — behavior monitoring ban |
| Real-time supervisor dashboard showing second-by-second activity | Prohibited | ArG Ordinance 3 Art. 26 — continuous surveillance effect |
| AI behavioral scoring from passive observation signals | Prohibited (pending AI bill review) | ArG Ordinance 3 Art. 26 + forthcoming AI governance |
The gray area sits in the middle rows. Periodic screenshots and call recording are neither categorically permitted nor categorically prohibited. They require individual assessment of purpose, configuration, proportionality, and nLPD compliance. A QA-focused call recording program in a BPO environment is more defensible than screenshots taken every 30 seconds across all employees in an office setting. Swiss law rewards specificity of purpose and minimalism of configuration.
Remote and Home Office Monitoring Under Swiss Law: The EDOB Position
Remote work monitoring in Switzerland receives heightened scrutiny from the EDOB because monitoring employees in their home environments intersects with constitutional protections for the inviolability of the home and private life under Article 13 of the Swiss Federal Constitution. The EDOB's published guidance on home office data protection treats the home workplace as a context where employer monitoring rights are more limited than in a company office, not less.
The EDOB's core position is that proportionality requirements for home monitoring are stricter than for on-site monitoring. Monitoring that might be defensible in an employer-owned office environment requires additional justification when applied to employees working from their personal homes. Continuous monitoring of home workers, including always-on screen feeds, webcam activation, or real-time activity dashboards that display current behavior, is viewed as disproportionate regardless of productivity management objectives.
What the EDOB Considers Proportionate for Home Office Monitoring
The EDOB has consistently identified output-focused monitoring as the proportionate approach for home workers. Tracking daily hours, recording which application categories were used and for how long during scheduled work hours, measuring task completion rates, and logging project time allocation are all considered proportionate because they measure work results without entering the employee's domestic sphere. These approaches satisfy both the nLPD data minimization principle and the ArG Ordinance 3 Article 26 behavior monitoring prohibition simultaneously.
Periodic screenshots at reasonable intervals, with personal content blurred and monitoring limited to working hours, occupy a middle position. The EDOB does not categorically prohibit them for home workers but requires documented justification that screenshots are necessary for the specific monitoring purpose and that a lower-intrusion alternative would not achieve the same result. An employer who can achieve adequate supervision through application usage reporting alone cannot justify screenshots as a proportionate addition.
Family Members and Third-Party Data in Home Monitoring
Home monitoring creates a specific nLPD risk that does not arise in office settings: the risk of capturing personal data belonging to family members or other household members. Screenshots of home screens may contain private messages, financial information, or images of children. The nLPD requires that employers not collect personal data of third parties without a separate legal basis. This concern reinforces the EDOB's preference for application category logging over screenshot-based monitoring for home workers, because category logging records software names rather than screen content.
How Swiss Employee Monitoring Rules Compare to GDPR
Swiss employee monitoring law and GDPR share the same foundational principles but differ in three specific areas that matter practically for employers managing cross-border workforces or evaluating software designed with GDPR compliance in mind.
Where Swiss Law and GDPR Align
Both frameworks require a documented legal basis for processing employee data, proportionality between the monitoring purpose and the data collected, advance notification of employees before monitoring begins, a data protection impact assessment for high-risk processing, and recognition of data subject rights including access, correction, and deletion. Software built to satisfy GDPR compliance principles and data minimization requirements will generally address most nLPD obligations with limited additional work.
Where Swiss Law Is Stricter: The Article 26 Categorical Prohibition
GDPR imposes a proportionality requirement but does not contain any provision that explicitly prohibits behavior monitoring systems as a category. Under GDPR, behavior monitoring could theoretically be justified through a legitimate interest assessment if the employer could demonstrate proportionality. Under Swiss law, ArG Ordinance 3 Article 26 closes that door. A Swiss employer cannot justify continuous behavioral surveillance through any balancing test. The prohibition is not subject to override by consent, legitimate interest, or contractual necessity. This makes Swiss law stricter than GDPR specifically in the behavioral surveillance dimension.
Where GDPR Is Stricter: Enforcement Mechanism and Penalty Scale
GDPR's administrative fine structure, with maximum penalties of 20 million euros or 4% of global turnover, is considerably more severe than the nLPD's individual-focused criminal fines capped at CHF 250,000. GDPR supervisory authorities across EU member states issue large fines regularly. The EDOB's enforcement approach has historically focused on recommendations and guidance rather than financial penalties, though the nLPD's 2023 entry into force signals a more active enforcement posture going forward. For multinational employers, GDPR enforcement risk currently exceeds Swiss enforcement risk in monetary terms, but Swiss labour law violations carry additional consequences through cantonal labour inspectorates.
Practical Implications for Cross-Border Employers
A monitoring configuration designed to satisfy Swiss ArG Ordinance 3 Article 26 will typically be more conservative than one designed solely for GDPR compliance, because the behavioral observation prohibition is absolute in Switzerland. Employers who configure monitoring to Swiss standards first will find that GDPR requirements are generally also met, with the addition of any country-specific national provisions required in EU jurisdictions — including Germany's strict monitoring rules requiring works council approval — where they operate.
Swiss Employee Monitoring Compliance Checklist: What to Configure and What to Avoid
Swiss employee monitoring compliance requires action across three phases: before deployment, at configuration, and during ongoing operation. The following checklist consolidates requirements from ArG Ordinance 3 Article 26, the nLPD, and Code of Obligations Article 328b.
Before Deployment
- Apply the Article 26 behavior test: For each monitoring function you plan to activate, determine whether it is directed at or achieves continuous behavioral observation. Prohibited functions must not be activated regardless of other compliance steps.
- Apply the Article 328b necessity test: Confirm that each data type to be collected relates to the employee's suitability for the job or is necessary for the employment contract. Remove any monitoring function whose data serves only general business interest without connecting to job suitability or contract performance.
- Document a legal basis under the nLPD: Identify which nLPD basis supports the monitoring program (employment contract, legitimate interest, or legal obligation) and document the analysis in writing before deployment.
- Complete a Data Protection Impact Assessment: For any systematic monitoring program covering multiple employees, complete a DPIA documenting purpose, data types, risks, and mitigation measures. Consult the EDOB if residual risks cannot be fully mitigated internally.
- Draft and deliver a monitoring privacy notice: Provide employees with a written notice covering all nLPD-required elements before monitoring begins. Attach the notice to employment contracts for new hires and deliver it separately to existing employees.
- Inform employee representation bodies: If the company has a workers' representation body under the Mitwirkungsgesetz, consult that body before deployment. Inform them of the monitoring scope, data collected, and purpose.
At Configuration
- Set work-hours-only activation: Configure monitoring to activate when employees begin work and stop when they finish. Monitoring outside scheduled work hours has no valid legal basis under OR Article 328b and violates nLPD data minimization.
- Disable continuous screen recording: If your software supports screen recording, do not configure it for continuous capture directed at observing employee behavior. Periodic screenshots at reasonable intervals, with blur enabled for personal content, require separate justification but are not categorically prohibited.
- Disable keystroke content logging: Keystroke activity intensity measurement (measuring engagement without accessing typed content) occupies a different position from keystroke content logging. Confirm that any keystroke-related feature measures activity intensity, not content, before enabling it.
- Configure role-based access controls: Restrict monitoring data access to managers who have a documented need. Employees should be able to access their own data. Individual-level data visible to a manager's manager requires additional justification.
- Set data retention and auto-deletion: Define retention periods for each data type: 30 to 90 days for detailed activity logs, 60 days for screenshots, 12 months or less for aggregated reports. Configure automatic deletion to enforce these limits.
- Enable employee dashboards: Provide employees with self-service access to their own monitoring data to fulfill nLPD access rights proactively and reduce the volume of formal data subject access requests.
During Ongoing Operation
- Review the DPIA annually: Revisit the DPIA whenever the monitoring scope changes, new software features are activated, or the workforce size or composition shifts materially.
- Respond to access requests within 30 days: Employees may request access to their monitoring data under the nLPD. Designate a person responsible for handling these requests and track response timelines.
- Monitor the AI regulation bill: Switzerland is developing AI governance legislation expected by late 2026. Employers using AI-powered productivity scoring should track Federal Council publications through the EDOB website for new requirements affecting automated employee evaluation systems.
- Review after cantonal labour inspections: Cantonal labour inspectorates enforce ArG Ordinance 3 Article 26 independently of the EDOB's nLPD enforcement. Following any inspection, review monitoring configurations against Article 26 requirements and update documentation accordingly.
How eMonitor Supports Swiss Employee Monitoring Law Compliance
eMonitor is built around output monitoring principles that align with what Swiss law explicitly permits under ArG Ordinance 3 Article 26. The platform's default configuration tracks time worked, application categories, and task output without deploying the continuous behavioral observation that Swiss law prohibits. Swiss employers can activate the monitoring capabilities they need while avoiding prohibited configurations through eMonitor's granular control settings.
Work-Hours-Only Activation
eMonitor activates monitoring when employees clock in and stops when they clock out. This means no personal data is collected outside scheduled work hours, which satisfies both the nLPD data minimization principle and removes the risk of capturing home environment data about family members during non-work periods. The work-hours-only boundary also addresses the EDOB's proportionality guidance on home office monitoring specifically.
Application Category Tracking: Output Without Behavioral Observation
eMonitor's productivity classification engine records which application categories were active during work hours and for how long, without continuous behavioral observation. Managers see time allocation across productive, non-productive, and neutral categories derived from application usage, which measures output patterns rather than observing moment-by-moment conduct. This approach falls squarely in the permitted zone under ArG Ordinance 3 Article 26 because it measures work results rather than surveilling employee behavior.
Configurable Screenshot Intervals with Blur
For organizations where periodic screenshots are justified by a specific compliance or QA purpose, eMonitor supports configurable screenshot frequency and blur options that protect personal content visible on screen. Blur ensures that personal information on screen is not captured, directly addressing the nLPD requirement to minimize personal data collection and the EDOB's concern about home monitoring capturing third-party data.
Employee-Facing Dashboards for nLPD Access Rights
eMonitor includes employee-facing dashboards where workers can view their own time logs, application usage data, and productivity summaries. This proactive transparency mechanism fulfills the nLPD's data subject access right in a way that reduces the administrative burden of formal access requests and supports the trust-based workplace culture that Swiss labour law is designed to protect.
Role-Based Access Control
Access to monitoring data in eMonitor is restricted by role. Direct managers see their team's data. Broader access requires administrative authorization. This role-based structure supports the nLPD's data minimization and access control requirements and aligns with the proportionality principle that monitoring data should be visible only to those with a documented operational need for it.
Switzerland's AI Regulation Bill: What Employers Should Expect by 2026
Switzerland's Federal Council is developing an AI governance framework expected to produce concrete legislative proposals by late 2026. While the bill is not yet enacted, its draft direction carries implications for monitoring software that uses AI components, particularly products that generate automated productivity scores, engagement risk assessments, or attrition predictions from employee monitoring data.
The draft framework focuses on high-risk AI applications in employment contexts. Systems that use AI to make or influence decisions about employee performance, productivity classification, or continued employment status are expected to face transparency and documentation obligations. These include requirements to inform employees when AI is involved in evaluating their work output, to document the data sources and logic behind AI-generated scores, and to provide a mechanism for employees to contest automated assessments.
What This Means for Monitoring Software Users
Employers currently using AI-powered monitoring tools should take three preparatory steps. First, document which monitoring features involve automated decision-making or AI scoring, and what data those features process. Second, review whether the AI components in use generate outputs that influence employment decisions, since that is where regulatory attention is likely to concentrate. Third, ensure that the existing monitoring program's privacy notice discloses the use of automated analysis, even before the formal AI bill requirements take effect, because nLPD transparency obligations already require disclosure of automated processing that significantly affects individuals.
The EDOB publishes commentary on upcoming regulatory developments through its official website (edoeb.admin.ch). Employers with Swiss operations should treat EDOB guidance as authoritative ahead of formal legislation, since EDOB positions typically anticipate the direction of formal regulatory action.
Frequently Asked Questions: Employee Monitoring Laws in Switzerland
Is employee monitoring legal in Switzerland?
Employee monitoring is legal in Switzerland under specific conditions. The Swiss Labour Code (ArG) Ordinance 3 Article 26 permits output monitoring and time tracking but explicitly prohibits surveillance systems designed to monitor employee behavior or performance on a continuous basis. Employers must also comply with the revised nLPD, effective September 1, 2023, which requires a documented legal basis, data minimization, and a privacy notice before monitoring begins.
What does Swiss Labour Code Article 26 prohibit?
ArG Ordinance 3 Article 26 explicitly prohibits monitoring systems directed at or achieving continuous surveillance of employee behavior or performance. This covers systems designed to track behavioral patterns, continuous screen recording to observe conduct, and keystroke logging used for behavioral profiling. The prohibition is categorical and cannot be overridden by employee consent, legitimate interest, or contractual justification.
What is the nLPD and how does it affect employee monitoring?
The nLPD (revised Federal Act on Data Protection) entered into force on September 1, 2023, replacing Switzerland's 1992 data protection law. It aligns Swiss data protection with GDPR principles. For employee monitoring, nLPD requires a lawful basis, data minimization, a privacy notice before collection begins, a DPIA for high-risk processing, and recognition of employee data subject rights including access and deletion. The EDOB (Swiss FDPIC) enforces the nLPD.
What is the difference between behavior monitoring and output monitoring in Swiss law?
Swiss law draws a clear line using a purpose-and-effect test. Behavior monitoring, prohibited under ArG Ordinance 3 Article 26, is directed at observing how employees carry out their work, including continuous screen recording and keystroke behavioral profiling. Output monitoring, which is permitted, measures what employees produce: time worked, tasks completed, applications used for billing, and files created. The test is whether the system targets conduct or results.
Does the nLPD require employee consent for monitoring in Switzerland?
The nLPD does not require consent as the legal basis for workplace monitoring. Swiss employers typically rely on employment contract necessity or legitimate business interest. Consent under nLPD must be freely given, which is difficult to establish when employees may feel pressure to agree as a condition of employment. Legitimate interest with a documented proportionality assessment is the more defensible legal basis for most monitoring programs.
What is the EDOB's position on home office monitoring?
The Swiss EDOB (Federal Data Protection and Information Commissioner) takes a strict proportionality position on home office monitoring because the home is constitutionally protected private space. The EDOB considers output measurement, time tracking, and application category logging during work hours proportionate for home workers. Continuous screen feeds, always-on webcam, and real-time behavioral dashboards for home workers are viewed as disproportionate regardless of business justification.
How does Swiss employee monitoring law compare to GDPR?
Both frameworks share core principles: lawful basis, data minimization, transparency, and individual rights. The key difference is that Swiss ArG Ordinance 3 Article 26 contains a categorical prohibition on behavior monitoring that has no direct GDPR equivalent. GDPR allows behavior monitoring if it passes a proportionality test. Swiss law closes that option entirely. GDPR carries higher financial penalties; Swiss law adds labour inspection enforcement through cantonal authorities.
What are nLPD penalties for unlawful employee monitoring?
The nLPD introduces individual criminal fines up to CHF 250,000 for intentional violations of specific nLPD provisions. Unlike GDPR, liability falls on individuals rather than organizations. The EDOB can issue recommendations and refer persistent non-compliance to federal authorities. ArG Ordinance 3 Article 26 violations are enforced separately by cantonal labour inspectorates, which can order monitoring systems to be shut down.
Does the Swiss Code of Obligations restrict employee data processing?
Yes. OR Article 328b restricts employer data processing to data that concerns the employee's suitability for the job or is necessary for the employment contract. This creates a narrower necessity test than nLPD alone. Monitoring data that serves general business interest without linking to job suitability or contract performance fails Article 328b, even if the nLPD analysis would otherwise permit the processing. Both tests must be satisfied independently.
Can Swiss employers monitor employee emails and messages?
Swiss employers may monitor work email and messaging accounts when monitoring is proportionate to a specific security or operational purpose, employees receive advance notification, and personal communications are excluded. The EDOB recommends that acceptable use policies clearly distinguish work and personal communications before any message monitoring is implemented. Monitoring personal communications has no valid legal basis under OR Article 328b or the nLPD.
What is coming for Swiss monitoring law with the AI regulation bill?
Switzerland is developing an AI governance framework with proposals expected by late 2026. Draft direction suggests transparency and documentation requirements for AI systems that influence employment decisions, including automated productivity scores and behavioral risk assessments from monitoring data. Employers using AI-powered monitoring should document which features involve automated decision-making and review disclosure obligations under the existing nLPD transparency requirements in advance of formal legislation.
Do Swiss works councils have approval rights over monitoring decisions?
Switzerland does not have works councils with the same co-determination rights as German Betriebsrat. Companies with employee representative bodies under the Mitwirkungsgesetz must inform and consult those bodies before introducing monitoring systems that affect working conditions. The obligation is consultative rather than requiring formal approval, but ignoring it creates legal exposure in collective labor disputes and undermines the good-faith employment relationship obligations under OR Article 328.
Is screen recording permitted for Swiss employees?
Periodic screenshots at reasonable intervals, with blur enabled for personal content and monitoring limited to work hours, may be lawful in Switzerland when employees are notified and the purpose is proportionate to a specific business need. Continuous screen recording designed to observe employee behavior is prohibited under ArG Ordinance 3 Article 26. eMonitor supports configurable screenshot intervals with blur options, addressing Swiss proportionality requirements for screen-based monitoring.
How does eMonitor support compliance with Swiss employee monitoring law?
eMonitor is designed around output monitoring principles that align with what Swiss ArG Ordinance 3 Article 26 permits. It tracks time worked, application categories, and task output without continuous behavioral surveillance. Work-hours-only activation, configurable screenshot frequency with blur, and employee-facing dashboards address nLPD data minimization, transparency, and access rights simultaneously. Swiss employers configure eMonitor to avoid the behavior monitoring prohibition while retaining full productivity visibility.
Related Employee Monitoring Compliance Guides
Switzerland's ArG Ordinance 3 Article 26 behavior monitoring prohibition is one of the strictest national provisions in Europe. For a broader view of how monitoring law differs across jurisdictions, these guides cover the key national frameworks that international employers most frequently need to navigate alongside Swiss requirements.
- Employee Monitoring Laws in Norway: Norway applies GDPR alongside the Norwegian Working Environment Act, which includes employee data protection provisions with similarities to Switzerland's dual-framework approach. See the full guide at /compliance/employee-monitoring-laws-norway.
- GDPR Employee Monitoring Compliance: For employers who operate in both Switzerland and EU member states, the GDPR compliance guide covers lawful bases, DPIA requirements, country-specific national additions, and common enforcement mistakes across the EU. See the full guide at /compliance/gdpr-employee-monitoring-compliance.
- Employee Monitoring Laws Worldwide Map: A jurisdiction-by-jurisdiction reference covering the US, EU, UK, Asia-Pacific, and the Americas, with framework summaries and key legal references for each region. See the full guide at /compliance/employee-monitoring-laws-worldwide-map.