Can your employer see your home internet use?

A general picture from the sources below; your employer's monitoring policy and privacy notice say what actually happens in your job.

A device your employer owns and manages is where it has the most visibility. The ICO's guidance on monitoring methods describes device activity monitoring: software that records what happens on a computer or phone. It lists web browsing, emails and messages, documents, app use, screen captures, webcam captures and keystrokes as things such tools can capture, and warns they are likely to collect excessive personal information.

Because this software records what happens on the device, being on your home Wi-Fi doesn't take your activity out of scope. If you open personal webmail, a shopping site or a medical website on a work laptop, assume it may be recorded like your work.

Phones are managed differently, and the platforms publish what their management tools allow. Apple says profile-based Device Enrolment and Automated Device Enrolment give IT teams the most control; only Automated Device Enrolment, which supervises the device (Apple says supervision generally means the organisation owns it), can force an always-on VPN or set a global web proxy. Apple's table also shows that no enrolment method lets IT query the device's location, collect how often apps are used, or view Safari history, personal mail, iMessage or SMS messages or call logs. Apple notes the table isn't a complete list.

Google says that on a company-owned Android device with a Work Profile, the organisation can enforce policies on the whole device, such as uninstalling specific personal apps, disabling the camera and enforcing the default messages and browser apps, though personal-profile apps and data still aren't visible to it. Google's page doesn't cover company phones with no personal profile, and it points you to your organisation's privacy policy, so that's the document to ask for.

Not every employer does all of this: the ICO says employers should not monitor workers "just in case". But the simplest rule is to treat a work device as work-only.

The Electronic Frontier Foundation (EFF), a US digital-rights group, explains the basic trade-off: a VPN hides your outgoing traffic from your broadband provider and the owner of the local network, but that browsing data is all visible to whoever provides the VPN. For work, the EFF puts it plainly: if you're using a corporate VPN, whoever runs the corporate network will see your traffic. That may be your employer's IT team or a firm it pays.

Which traffic goes through the work VPN depends on how your employer has configured it. Google gives one clear example: a VPN set up in an Android Work Profile doesn't carry traffic from apps in the personal profile, even though the VPN key icon looks the same in both. For a work laptop, ask your IT team.

Work accounts are monitored on your employer's systems, wherever you log in from. The ICO says employers may monitor emails and messages sent to and from work accounts, but must be clear about the purpose, make sure it's necessary and proportionate, tell workers and complete a DPIA. It adds that it would be difficult to justify reading the content of emails and messages if monitoring network traffic data would meet the purpose, and that employers must not access content without a clear policy explaining when that may happen.

Our guide to VPNs on home broadband covers what a VPN hides generally. If websites keep throwing up checks while the work VPN is on, see our guide to websites blocking or challenging your home connection, where VPNs are one cause.

Using your own device for work is often called BYOD (bring your own device). The National Cyber Security Centre (NCSC) describes the split simply in its guidance for organisations: the organisation owns the work data you access or store, but the device belongs to you. It lists protecting the owner's privacy as one challenge organisations must handle.

The ICO says that when workers use their own devices for work, employers should make sure they are not capturing private use of the device. It warns that tools recording activity on workers' own laptops and handheld devices can be particularly intrusive, so what you agree to install matters.

This covers data protection only; for wider employment rights, start with Acas (the Advisory, Conciliation and Arbitration Service). From the ICO's guidance for employers and Acas's guidance on monitoring people who work from home:

• You should be told. The ICO says employers must inform workers about any monitoring in a way that is accessible and easy to understand, apart from very exceptional circumstances where covert monitoring is justified. Acas says employers must tell employees about any monitoring and the reason for it, except in extremely limited circumstances such as suspected criminal activity.
• Covert monitoring is the exception. The ICO says it is unlikely to be justified in most cases. Where it is, for example to prevent or detect suspected crime, it should be authorised by senior management, limited in time, and should not normally capture communications workers would reasonably expect to be private, such as personal emails.
• "You agreed" usually isn't the legal basis. The ICO says consent is not usually appropriate in employment because of the imbalance of power, so the employer must rely on another lawful basis and have a clear purpose.
• A policy isn't a blank cheque. The ICO says excessive monitoring set out in a policy doesn't become lawful just because it's written down, and that workers base their privacy expectations on what actually happens as well as on the policy.
• Risky monitoring needs an assessment first. A DPIA is required before high-risk monitoring, and for homeworkers it should consider the household. Acas says employers should do an impact assessment and consult employees and their representatives before introducing monitoring.
• Personal communications are hard to justify. The ICO says employers should not routinely monitor personal calls, and that even if an employer bans personal use of its devices or systems, it would be difficult to justify accessing workers' personal communications.

Rules may change. As well as the ICO's review, the Government's Make Work Pay consultation on workplace monitoring technologies (England, Scotland and Wales) closed on 30 September 2026; when we checked GOV.UK on 28 October 2026 it was analysing feedback and hadn't published its response. Acas's response supported a principles-based approach. Check GOV.UK and the ICO for anything newer.

The ICO notes that monitoring at home can capture information about family and private life by accident. These are our practical suggestions for keeping it off your employer's systems:

1. Keep personal browsing on personal devices. Banking, health, shopping and personal messages belong on your own phone or computer.
2. Don't sign into personal accounts on a work device, where they're within reach of whatever monitoring runs there.
3. Keep the work laptop for you. If children or a partner use it, their activity is monitored too.
4. Mind the camera and microphone. Close the laptop lid or turn the camera away from the room when you're not on a call, and check what's behind you before you join one.
5. Read the paperwork. Ask for your employer's monitoring policy, privacy notice and acceptable-use policy, and read any enrolment screen on your own phone before accepting it.

If you run your own cameras at home, our guide to home camera and video doorbell privacy rules covers the rules on recording other people.

The ICO says employers must make workers aware of how and what personal information is collected, so clear answers are reasonable to expect.

• What monitoring runs on my work laptop or phone, and what does it record?
• Does any of it capture screenshots, webcam images or keystrokes, and if so, when and why?
• Does the work VPN carry all of my work device's traffic, or only traffic to work systems?
• If I add work email or apps to my own phone, will you use a work profile or user enrolment, or manage the whole device?
• Where can I read the monitoring policy and the privacy notice that covers it?

Ask for the policy and privacy information if you haven't seen them, and raise your concern with your manager, HR or your union or staff representative. Data protection law gives you two further tools.

• A subject access request. The ICO says workers can get information collected about them through monitoring with a subject access request, unless an exemption applies. You don't need a solicitor. Organisations normally have one month to reply, starting once they have what they need from you; the clock can stop while you clarify an unclear request or pay a fee (allowed only in limited cases), and complex or multiple requests can take up to two extra months if they tell you within the first month. The ICO wouldn't expect your employer to ask for ID if you send the request from your work email, and says being specific gets a faster, more useful reply, so name the tools, dates or records you're after.
• An objection. Where your employer relies on "legitimate interests" or "public task" as its lawful basis, the ICO says you can object, giving specific reasons based on your situation. It isn't an absolute right: the employer can refuse if it shows compelling legitimate grounds.

For advice on your own situation at work, go to Acas; we don't give legal advice.

Not to what your employer sees: that comes from the work devices, accounts and VPN it controls, whichever provider supplies your line. Your broadband provider sees something different, which our guide to what your broadband provider can see explains, and our guide to provider security add-ons explains the security extras sold with broadband.

Where your deal does matter is in how well home working runs. Our guide to broadband for working from home covers upload speeds, wired desks, VPN quirks and back-up connections, and who pays for working-from-home broadband covers costs and tax. You can check how your current line performs at your desk with our broadband speed test.

If your contract is ending, look through fibre broadband deals or read our guide to UK broadband providers, then compare broadband deals at your postcode. We compare deals through a partner's comparison tool; we don't switch you ourselves, and we don't review providers' or employers' privacy practices.