TCS monitoring: What are your rights?

• TCS and other IT firms use monitoring for security and productivity
• Indian law allows monitoring of company devices for legitimate use
• Employees have rights to notice and access under the DPDPA 2023

TCS Monitoring And Employee Rights: What Workers Should Understand. Understand the balance between corporate surveillance at major IT firms like TCS and your rights as an employee under current Indian law. Recent reports about monitoring tools at major IT firms like TCS have put a spotlight on a critical question: How much can your employer see, and what are your rights? It’s a delicate balance between security and employee privacy.

Why Companies Monitor Employees

Employers, especially large IT service companies like TCS, have legitimate reasons to monitor activity on their networks and devices. The primary drivers are data security and compliance. These firms handle sensitive client information across sectors like banking and healthcare, making the protection of this data a critical business need. Monitoring helps detect malware, prevent data breaches, and investigate security incidents. Another reason is ensuring productivity and proper use of company assets. In an era of hybrid and remote work, companies use software to manage their IT infrastructure, track attendance, and ensure that company-owned laptops are being used for their intended purpose. This monitoring can range from network performance checks to tracking which applications are being used.

What Can Legally Be Monitored?

Under Indian law, employee monitoring on company-owned devices is generally legal, but it comes with important conditions. Employers can monitor emails, application usage, and network activity on the laptops and systems they provide. Recent reports suggest that a tool deployed at TCS, for example, can show which applications are used and for how long. However, this monitoring must be for a legitimate business purpose. The key distinction lies between monitoring the device for security and monitoring the person using it. Tracking how long an employee spends on an app is different from simply logging that the app was used. Crucially, monitoring an employee’s personal devices, like a personal phone or laptop, requires explicit, individual consent, even if it's used for work. Accessing personal email or messaging accounts is not permitted.

The Legal Framework: DPDP Act and Your Rights

India does not have one single law for employee surveillance. Instead, it's governed by a mix of the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (DPDPA). The Supreme Court has also affirmed the Right to Privacy as a fundamental right, which requires any intrusion to be fair and reasonable. A key principle is transparency. While employers may not always need your explicit consent for routine monitoring related to employment, they must inform you about it. This notice is often included in your employment contract or a company policy. Under the DPDPA, this is considered a “legitimate use,” allowing companies to process employee data for employment purposes or to safeguard the employer from loss or liability, such as preventing corporate espionage.

Know Your Rights as an Employee

The DPDPA grants you several important rights regarding your personal data. You have the Right to Notice, which means your employer must inform you about what data is being collected and for what purpose. You also have the Right to Access, allowing you to see what data the company holds about you. Additionally, the law provides for the Right to Correction, enabling you to fix inaccurate data, and the Right to Erasure, which lets you request the deletion of data that is no longer needed for its original purpose. If you have a concern, you have a right to grievance redressal, which usually starts with the company's Data Protection Officer or designated contact person. These rights form the core of your protection against excessive or unfair surveillance.

Practical Steps to Protect Your Privacy

Given that workplace monitoring is a reality, employees can take proactive steps. First, carefully read your employment agreement and any company policies regarding acceptable use of technology and data privacy. These documents should disclose the company's monitoring practices. Assume that anything you do on a company-owned device—be it a laptop, phone, or network—can be seen by your employer. For personal matters, always use your own personal devices and network. This creates a clear boundary between your work and private life. If you are concerned about the extent of monitoring, you can seek clarification from your HR department or the company’s Data Protection Officer. Understanding the company's stated purpose for data collection is a reasonable first step. Being aware and informed is your best defense.