Notice, consent, and monitoring: a deployment checklist for MSPs

The most common MSP mistake is deploying monitoring before disclosure. Almost every other mistake is recoverable. This is not.

What usually creates an obligation

Requirements are triggered by what is collected, the device, and location. Obligations attach when:

• Activity is tied to an identifiable individual, not aggregated
• Screen contents are captured, as with screenshots
• Collection continues off-hours or off company premises
• A jurisdiction has a notification statute, or treats monitoring as processing personal data
• A works council, union agreement, or employment contract applies

Some jurisdictions require notice, some consent, some consultation first. One does not satisfy another.

Who has to be told

Employees on monitored devices, obviously. Often forgotten:

• Contractors and temporary staff, covered by different rules
• Staff in other countries, where the home-jurisdiction notice may not apply
• New joiners, as part of onboarding
• Anyone who shares a monitored device, including occasional support staff

What a notice usually covers

A workable notice states what is collected, what is not, when, who can see it, how long it is kept, and who to ask.

SnitchOS publishes a notice template and an employee FAQ. Both are starting points for counsel.

What to document before you deploy

• Devices are company-owned or company-controlled
• Date notice was given, and to whom
• Where consent was required, how captured
• Named people who may view screenshots and activity
• Retention period, a platform default, not per-client
• Anyone whose monitoring is paused, and why
• Who approved the deployment

If a dispute arrives later, this list answers it.

Order of operations

1. Confirm devices are eligible for monitoring
2. Have counsel confirm notice and consent
3. Give notice, and capture consent where required
4. Set client access to policy, pause anyone excluded
5. Install on one test device and confirm behavior
6. Expand in controlled groups

Step two gets skipped under pressure. It costs money.

Limits

We do not publish a state-by-state or country-by-country table. A stale table read as current is worse than none. Your client's counsel is the right source.