Notice, consent, and monitoring: a deployment checklist for MSPs

What creates a notice or consent obligation?

An obligation is usually created by what's collected, the device, or the work location:

• Tied to an identifiable person, not aggregated
• Screenshots or other screen capture
• Continues off-hours or off premises
• A jurisdiction has a notification statute, or treats monitoring as processing personal data
• A works council, union agreement, or employment contract applies

None of notice, consent, or consultation substitutes for another.

Who has to be told about monitoring?

Every employee on a monitored device, plus these often-forgotten groups:

• Contractors and temp staff, different rules
• Staff abroad, where home notice may not apply
• New joiners, during onboarding
• Anyone sharing a device, including support

What should a monitoring notice cover?

What's collected, what isn't, when, who sees it, how long it's kept, and who to ask. SnitchOS's notice template and employee FAQ are starting points for counsel.

What should you document before you deploy?

• Company-owned or -controlled devices
• Date notice given, to whom
• Where consent required, how captured
• Who may view screenshots and activity
• Retention period: platform default, not per-client
• Anyone paused, and why
• Who approved the deployment

Order of operations

1. Confirm devices are eligible
2. Have counsel confirm notice and consent
3. Give notice, capture consent where required
4. Set client access, pause anyone excluded
5. Install on one device, confirm behavior
6. Expand in controlled groups

Limits

We don't publish a state-by-state table; a stale one is worse than none. Your client's counsel is the source.

See how SnitchOS supports MSP monitoring deployments, and how screenshot monitoring liability factors into notice.