Can Your Employer Monitor Your Work Laptop in Malaysia?

Yes, an employer can generally monitor a company-owned laptop for legitimate business purposes such as cybersecurity, compliance, productivity or protecting confidential information. However, owning the laptop does not give the employer an unlimited right to collect, read and store everything an employee does.

Where monitoring involves identifiable employee information, the Personal Data Protection Act 2010 may apply. The employer should be transparent about what is being monitored, collect only what is reasonably necessary for a proper purpose, protect the information collected and avoid using it for unrelated purposes.

Does a company laptop mean you have no privacy?

No.

A company-owned laptop belongs to the employer, and that gives the employer a legitimate interest in controlling how the device and its systems are used. The degree of control an organisation exercises over how, when and on what equipment someone works is also one of the factors courts weigh when deciding whether that person is an employee or an independent contractor in the first place.

An employer may restrict websites, monitor cybersecurity threats, record login activity, control software installation and investigate suspected misuse of confidential information.

However, ownership of the hardware and ownership of personal information are different issues.

If tracking software records an employee's browsing history, screenshots, IP address, application usage, location, emails or other activity linked to an identifiable individual, that information can amount to personal data.

The question then becomes whether the employer is collecting and using that information consistently with Malaysian data protection law.

How does the PDPA apply to employee monitoring?

The Personal Data Protection Act 2010 regulates the processing of personal data in connection with commercial transactions.

For private-sector employers, employee data and workplace monitoring can therefore engage the PDPA.

Section 6 requires personal data to be processed for a lawful purpose connected to the organisation's activities. The processing must also be necessary or directly related to that purpose, and the amount of data collected must be adequate but not excessive.

This is important for workplace surveillance.

An employer may have a proper reason to monitor whether staff are downloading malware or copying confidential documents. That does not necessarily justify recording every keystroke, continuously activating a webcam or collecting an employee's personal activity outside working hours.

The more intrusive the surveillance, the stronger the employer's justification should be.

Employees should normally know what is being monitored

The PDPA's Notice and Choice Principle requires organisations processing personal data to provide written notice explaining what information is collected, why it is collected and how it will be used or disclosed.

In practice, workplace monitoring should therefore be covered by documents such as:

• an employee privacy notice;
• an IT or acceptable-use policy;
• a cybersecurity policy;
• a work-from-home or BYOD policy; or
• a specific workplace monitoring policy.

An employee should not have to discover by accident that software has been taking screenshots every 30 seconds or recording location data continuously.

A clear policy should explain what is monitored, the reason for monitoring, how long the data is kept, who can access it and whether any external software provider receives the data.

What kind of monitoring is usually easier to justify?

Monitoring connected directly to work and security is generally easier to justify than broad surveillance of an employee's private life.

Examples may include recording login times, monitoring access to confidential databases, detecting unauthorised USB transfers, scanning for malware, keeping access logs or reviewing use of company email for a legitimate investigation.

The employer should still collect only what it genuinely needs.

For example, monitoring whether confidential documents are being uploaded to an external website is different from recording the contents of every personal message typed on the computer.

Section 6 of the PDPA requires data collection to be necessary and not excessive in relation to its purpose.

This means an employer should be able to answer a simple question: why do we need this particular information?

Can your employer read your work emails and Teams messages?

Potentially, yes, particularly where the accounts belong to the company and employees have been informed that business communications may be monitored.

Employers have legitimate reasons to review company communications in circumstances involving suspected fraud, harassment, information leaks, regulatory investigations or business continuity.

But access should still be controlled.

A recent Industrial Court case, TAR v Bursa Malaysia Berhad [Award No. 582 of 2026], involved a senior IT employee who had privileged system access to employee communications. His role allowed access only for specific authorised purposes, but he accessed private Skype conversations without authorisation and shared them externally.

The Industrial Court upheld his dismissal for serious misconduct.

The case concerned employee misuse rather than employer monitoring, but it illustrates an important principle: having technical access to another person's communications does not mean that access can be used for any purpose.

Employers should similarly have internal controls over who is allowed to review monitoring data and when.

What about personal Gmail or WhatsApp on a work laptop?

This is more sensitive.

Using a personal account on a company device does not automatically turn every private communication in that account into company property.

However, an employee should also understand that company security systems may record some activity on the device, particularly browsing logs, network traffic or screenshots where monitoring software is installed.

The employee's expectation of privacy will also be affected by the company's published IT policy.

If the policy clearly states that company devices are monitored and should not be used for personal purposes, the employee should assume that activity on the device may be visible.

That still does not necessarily justify an employer deliberately opening private accounts or reading personal communications unrelated to any legitimate workplace purpose.

Employees who require genuine privacy should avoid using employer-owned devices for personal communications.

Can an employer install keylogging or screenshot software?

There is no Malaysian law that simply says all keylogging or screenshot monitoring is prohibited.

However, highly intrusive software creates greater PDPA risk.

A keylogger can potentially capture passwords, banking details, private conversations and other information which has nothing to do with employee performance.

Similarly, continuous screenshots may capture medical information, family communications or other sensitive material.

Because the PDPA requires processing to be necessary, relevant and not excessive, blanket monitoring of this kind would be harder to justify than targeted monitoring linked to a genuine security or compliance need.

Employers considering such tools should therefore ask whether a less intrusive method can achieve the same purpose.

What about monitoring employees on their own devices?

The position becomes more sensitive where employees use their personal phones or computers for work.

An employer may reasonably require security measures for company information, particularly where staff work remotely or access confidential systems.

For example, a company may use mobile-device management software to protect a work email account or remotely erase corporate files from a lost phone.

However, employers should distinguish between controlling company information and gaining access to an employee's entire personal device.

A BYOD policy should explain exactly what the company can see, what it cannot see and what happens when employment ends.

Monitoring personal photographs, private messages, personal browsing history or off-duty location simply because a work application is installed on the device would create much greater privacy concerns.

Can your employer track your location after working hours?

Continuous location monitoring is difficult to justify unless the employee's role genuinely requires it.

GPS tracking during working hours may make sense for delivery drivers, field staff or employees using company vehicles where location is necessary for the job.

The justification becomes much weaker once the employee is off duty.

Malaysian employment law has also shown increasing sensitivity to the boundary between work and private life.

In Hyffny Yusof v AirAsia Berhad [Award No. 1676 of 2025], the Industrial Court considered disciplinary action arising from private social media posts made outside working hours. The Court emphasised factors such as whether the comments were publicly accessible and whether the employer could prove actual harm.

That case was not a PDPA monitoring case, but it reinforces the broader point that an employer's managerial authority does not automatically extend without limit into an employee's private life.

What about fingerprint or facial-recognition attendance?

Biometric monitoring deserves greater care.

Malaysia's Personal Data Protection (Amendment) Act 2024 expressly added biometric data to the category of sensitive personal data.

This includes personal data generated through technical processing of a person's physical, physiological or behavioural characteristics.

Fingerprint and facial-recognition attendance systems can therefore involve sensitive personal data.

Employers using these systems should ensure that the legal requirements for sensitive data are satisfied, that access is tightly controlled and that the information is protected against misuse or unauthorised disclosure.

A biometric database creates risks very different from an ordinary staff attendance spreadsheet because a compromised fingerprint or facial template cannot simply be changed like a password.

What if software automatically scores employee productivity?

This is an increasingly important issue.

Monitoring systems can now calculate productivity scores based on mouse movements, login time, applications used, response times and other behavioural information.

Malaysia's 2026 Automated Decision-Making and Profiling Guideline specifically defines profiling to include automated processing used to evaluate matters such as a person's performance at work, behaviour, location or movements.

The guideline also treats automated systems more seriously where the result may have a legal or significant effect on the individual, such as affecting an employment opportunity or terminating a contractual entitlement.

Where artificial intelligence is used, the guideline recommends that employers inform individuals through the privacy notice and states that AI should not be relied upon as the sole factor when making decisions concerning a person.

An employer should therefore be cautious about dismissing or disciplining an employee simply because monitoring software produced a low productivity score without meaningful human assessment.

What can an employee do if the monitoring seems excessive?

Start by checking the employment contract, employee handbook, IT policy and privacy notice.

Find out what monitoring the employer says it carries out and whether the actual monitoring goes beyond what employees were told.

Under the PDPA, individuals may have rights to access and correct their personal data and, in certain circumstances, to prevent processing likely to cause damage or distress.

If personal data is being misused, a complaint may also be made to the Personal Data Protection Commissioner.

If monitoring results in disciplinary action or dismissal, the monitoring evidence may become relevant to an unfair dismissal claim, particularly where the employee says the data is inaccurate, taken out of context or collected contrary to the employer's own policies.

Frequently Asked Questions

Can my employer monitor my work laptop without telling me?

Secret monitoring carries greater legal risk. Where personal data is collected, the PDPA's Notice and Choice Principle generally requires employees to be informed about the processing and its purpose.

Can my employer read my work email?

Potentially, particularly where it is a company account and there is a clear monitoring or IT policy. Access should still have a legitimate purpose and be properly controlled.

Can my employer monitor my personal laptop?

Monitoring a personal device is more difficult to justify. A BYOD arrangement should clearly explain what company software can access and should separate work information from private information where possible.

Can my employer track me after work?

There is no blanket rule, but continuous off-duty tracking would require a strong justification and may be difficult to reconcile with the PDPA requirement that processing be necessary and not excessive.

Final takeaway

An employer can monitor company systems, but workplace surveillance is not unlimited simply because the employer owns the device.

The more closely monitoring relates to a genuine business purpose such as cybersecurity, confidentiality or compliance, and the more clearly employees are informed about it, the easier it is to justify.

The risk increases where monitoring becomes secret, excessive or unrelated to work, particularly where it captures private communications, off-duty activity, biometric information or uses automated systems to make important employment decisions.

For both employers and employees, the central questions are straightforward: what is being collected, why is it necessary, was the employee told, and what will the employer do with the information?

Speak to JPP LAW

Justin, Poh & Partners, also known as JPP LAW, assists employers and employees with workplace privacy, employee monitoring, disciplinary investigations, data protection, unfair dismissal and related employment disputes in Malaysia.

If workplace monitoring software is being introduced, or monitoring data has been used as the basis for disciplinary action or dismissal, you may contact us to assess the employment and data-protection position.

---

Disclaimer: This article is for general information only and does not constitute legal advice. Workplace monitoring issues depend on the technology used, company policies, information collected, purpose of monitoring and the circumstances in which the data is later used.