The Spark: What Happened at TCS?
In August 2026, reports emerged that TCS had installed a 'Digital User Experience Monitoring' tool on company-issued laptops. According to sources mentioned in media reports, the software could track which applications employees use and the amount of time
they spend on them. This development triggered widespread discussion about the line between ensuring cybersecurity and surveilling employees. While TCS stated the reports were "baseless and inaccurate" and that it does not track individual activity, it clarified that it uses tools to monitor network performance for security and user experience. The incident, regardless of the specifics, has placed a spotlight on the broader issue of workplace monitoring in India's massive IT sector.
The Golden Rule: Company Devices vs. Personal Devices
The most important distinction in Indian law is who owns the device. On company-owned laptops, desktops, and phones, employers have broad legal authority to monitor activity. This includes emails sent from a company account, messages on internal platforms like Slack or Teams, and your browsing history on the company network. The legal justification is that the company has a legitimate interest in protecting its assets, ensuring productivity, and maintaining data security. However, when it comes to your personal phone or laptop (a 'Bring Your Own Device' or BYOD scenario), the rules change significantly. An employer cannot legally install monitoring software on your personal device without your explicit, informed consent. A general clause in your employment contract is not enough; the consent must be specific to the monitoring of that device.
What Can Legally Be Monitored on a Work Laptop?
Assuming you are on a company-provided machine, employers in India are generally permitted to monitor several things, provided they have informed you through your employment contract or a clear workplace policy. This includes: application and website usage during work hours, login and logout times, periods of activity versus idle time, and files transferred to and from company systems. They can also monitor your work email account. However, a legal grey area emerges when you access personal accounts (like your personal Gmail or social media) on a company device. While technically permissible if disclosed, employers must be careful, as constant monitoring of personal communications could be seen as an unreasonable intrusion of privacy.
What About Keystroke Logging and Screen Recording?
Keystroke logging—software that records every single key you press—is one of the most invasive forms of monitoring. While not explicitly illegal in India on a company device, it is legally risky for employers. The Digital Personal Data Protection (DPDP) Act of 2023 requires that data collection be necessary and proportionate to the goal. Since keyloggers capture everything from passwords to private messages, it is difficult to argue they are a proportionate way to simply measure productivity. Continuous screen recording throughout the day also falls into a high-risk category. Courts are increasingly focused on whether surveillance is reasonable and respects employee dignity. Covert or continuous monitoring unrelated to job functions may be viewed as unreasonable.
Your Rights Under Indian Law
India does not have one single law for workplace surveillance, but a combination of acts and court rulings protect employees. The Supreme Court has established the Right to Privacy as a fundamental right, meaning any intrusion must be lawful, for a legitimate purpose, and proportionate. The DPDP Act, which came into force in 2023, is your strongest protection. It mandates that employers must provide clear notice about what data is being collected and why. You have the right to be informed. This is typically done via your employment contract or an Acceptable Use Policy. The law also gives you the right to access the data your employer has collected about you and to demand corrections if that data (like an AI-generated productivity score) is inaccurate.
