The Philippines' National Privacy Commission has said that employers may monitor employees working from home on company-issued devices, with conditions: the employees must be told, the monitoring must be necessary and proportionate to its purpose, and less intrusive options should be considered before methods such as tracking mouse movements, recording keystrokes, taking random screenshots, or turning on webcams. In the same guidance, the Commission said an employer may not require staff to stay on video during working hours as proof of work. An MSP owner who plans to install an activity tracker on every offshore technician's laptop needs to know this before buying the software.
This post sets out what the Philippine rules say, how to separate security monitoring from productivity surveillance, and which measures of technician performance an MSP already has in its PSA and queue. The legal summary is general information and not legal advice, and who the employer is, and what your contract says, affects the details.
What the National Privacy Commission Has Said
The most direct statement is in the National Privacy Commission's updated FAQs on work from home, first issued in June 2020 and last edited in February 2026. It says employers, in exercising a legitimate interest, may monitor employees during work from home through monitoring software on company-issued devices, but must balance that against employees' rights and the general data privacy principles of transparency, legitimate purpose, and proportionality. Employers must tell employees they are being monitored, assess whether the monitoring method is necessary and proportionate to the objective, such as ensuring productivity, and are recommended to carry out a privacy impact assessment of the software and to have clear written policies on monitoring.
The guidance then names what it considers to be on the intrusive end. It says less privacy-intrusive means should be considered rather than excessive mechanisms such as tracking mouse movements, recording keystrokes, taking random photos of the computer screen, or enabling webcams to take a picture of the employee. It also answers directly whether an employer can require employees to stay on video during business hours as proof of work done, and the answer is no, because proportionality requires that data be processed only if the purpose cannot reasonably be fulfilled by other means, and there are other ways of ensuring employees are doing their assigned tasks.
The bulletin builds on an earlier ruling. In Advisory Opinion No. 2018-084, dated 28 November 2018, the Commission said that monitoring an employee using an office-issued computer may be allowed under the Data Privacy Act, but that software which records keystrokes and takes random snapshots of the screen appears excessive and disproportionate, unless the declared purpose of the monitoring necessitates and justifies it. It also said the employer must explain the monitoring to employees, including its purpose, scope, and method. Taken together, the position is that monitoring is not forbidden, secret monitoring is a problem, and the more intrusive the method, the stronger the justification has to be.
The Telecommuting Act points the same way on performance. The text of Republic Act 11165 says telecommuting employees have the same or equivalent workload and performance standards as comparable workers at the employer's premises, and makes the employer responsible for appropriate measures to protect data the employee processes for work, with the Data Privacy Act applying in a supporting role. Whether a particular technician is covered depends on the employment arrangement, which is one more reason to know who the employer is.
Who Sets the Monitoring Policy
If your offshore technician is employed by a provider in the Philippines, that employer carries the obligations described above, and you are the party directing the work and supplying systems. That split can leave the monitoring question unowned. If you install software on a laptop you supplied, or review activity logs in your own systems, someone needs to have told the technician, and the notice needs to cover what is collected, why, who can see it, and how long it is kept. Settle in writing who writes the policy, who gives the notice, who holds the data, and what you can ask the provider to do if you have a concern about performance or conduct.
Where the arrangement is a direct contractor or employer-of-record model, the allocation differs again, so confirm it for your own case. Ask any provider, including us, who is the employer of the technician for these purposes, what monitoring policy applies, and whether the provider has carried out a privacy impact assessment for the tools in use.
Security Monitoring Is Not the Same as Productivity Surveillance
MSP owners often mix two different things under the word monitoring. The first is security monitoring: endpoint protection on managed devices, sign-in and administrative logs, alerts on unusual access, and recording of privileged sessions on client systems. Its purpose is to protect client data and to give you an audit trail if something goes wrong, and most clients and insurers expect it. The second is productivity surveillance: tools that track activity levels, capture screenshots, or measure keyboard and mouse use to judge whether someone is working. Its purpose is to infer effort from behavior.
The Philippine guidance applies the same three principles to both, but they come out differently, because the purpose of security monitoring is specific, narrow, and clearly legitimate, while the purpose of productivity surveillance can usually be met in other ways. The table below sorts common methods. The right-hand column states what the Commission has said where it has said something, and otherwise gives my assessment, which you should treat as a starting point for discussion with counsel.
| Method | Typical purpose | Where it sits |
|---|---|---|
| Ticket, queue, and SLA data from your PSA | Measuring output and service quality | Low intrusion and directly tied to the work. Disclose it in the performance policy. |
| Sign-in and administrative logs, endpoint protection on managed devices | Protecting client data and keeping an audit trail | Clear security purpose. Disclose what is logged and who reviews it. |
| Recording of privileged sessions on client systems | Accountability for high-risk administrative actions | Narrow scope tied to a specific risk. Limit it to those sessions and say so in advance. |
| Mouse tracking, keystroke recording, random screenshots, webcam photos | Inferring effort or presence | The Commission says to consider less intrusive means first, and describes keystroke and random screen capture as excessive unless the purpose justifies them. |
| Required continuous video during working hours | Proof of work | The Commission has said employers cannot require this. |
What Shows Performance in an MSP
The practical case against surveillance is that MSP work produces its own evidence. A technician who is working a queue leaves a record in your PSA: when each ticket was acknowledged, how long it took to resolve, whether it came back, what the notes say, and whether the client was satisfied. Activity trackers measure motion at a keyboard, which tells you little about whether a ticket was resolved correctly. They also reward looking busy, which is a poor habit for a role where the right answer is sometimes to stop and read the documentation before acting.
Set targets from your own baseline rather than from industry averages, since queue mix, client mix, and tooling vary a great deal between MSPs, and published benchmarks are often drawn from very different environments. Start by looking at what your best onshore technician achieves on comparable tickets, then set expectations for the offshore role that fit its scope. The table below lists the signals most MSPs already have and what each does and does not tell you.
| Signal | Where it lives | What it tells you | Limits |
|---|---|---|---|
| Time to first response and SLA compliance | PSA | Whether tickets are seen and acknowledged on time | Says nothing about the quality of the response |
| Resolution rate and reopen rate | PSA | Whether fixes hold and issues are resolved at the first level | Depends on ticket mix, so compare like with like |
| Ticket note quality, from a sampled review | A weekly sample of five to ten closed tickets | Whether the next person can pick the work up and whether the reasoning is sound | Needs a reviewer's time and a written standard |
| Escalation quality | Senior review of escalated tickets | Whether the technician escalates the right things with the right detail | Subjective until you write criteria |
| Client feedback | Ticket surveys and account reviews | How the people being supported experience the service | Low response rates and skewed samples |
| Availability against the agreed schedule | Shift check-ins and PSA or RMM sign-in times | Whether the person is reachable when the coverage plan assumes they are | Presence is not output, so use it with the other signals |
For overnight and low-volume queues, volume is the wrong measure. A technician covering a quiet queue may handle few tickets, and the question is whether alerts and tickets were acknowledged within the agreed time and whether the handoff notes were complete when the day team arrived. Konnect's framework for maintaining service quality across time zones covers how to structure those handoffs and reviews.
How to Run This Fairly
Start with written expectations in the first week, not a dashboard in the third month. Tell the technician which measures you use, how you calculate them, and what good looks like on this team. Share the same dashboard you look at, so there are no surprises in a review. Then hold a regular one-to-one, with the metrics as the starting point and the technician's account of what is getting in the way as the main content. A technician who sees a reopen rate climbing is often the first person to know why, and the cause is usually a tool, a missing runbook, or an unclear client request rather than effort.
When you do use security logging or any other monitoring, put it in a short written notice. Following the Commission's guidance, state what is collected, why, who can see it, how long it is kept, which security measures protect it, and how the technician can raise a concern. Keep the notice specific, because a vague statement that the company may monitor activity does not satisfy a requirement to explain the purpose, scope, and method. Konnect's piece on managing across cultures is a useful companion for the feedback side, since how you deliver a performance conversation matters as much as the numbers behind it.
Where This Does Not Fit
Some situations call for more monitoring than this post describes. Certain client contracts and regulated environments require logging or session recording of privileged access, and in those cases you should implement it properly, with notice and a limited scope, rather than treating it as optional. If you suspect misconduct or a security incident, a targeted and documented review is a different matter from routine surveillance, and you should involve counsel and the technician's employer before collecting anything beyond your normal logs. Finally, metrics only work if the work is measurable. A role with mostly project work or a queue that is empty most nights needs different signals, such as milestone delivery and response to alerts, and you should define them before the role starts.
The legal position can also shift. The Commission's guidance has been updated over several years, and the details turn on facts such as who owns the device and who the employer is. Re-check your policy when you change tools, add a new category of data, or change who employs the technician.
A Setup You Can Complete in Thirty Days
In the first week, decide what you need to know about each technician's performance, and map each item to a source you already have. Pick four or five signals from the table above and write a one-page standard for each, including how it is measured and what range you consider acceptable. In the second week, write the monitoring notice, agree with the technician's employer who gives it, and review whether any tool you plan to use goes beyond security logging and ticket data. In the third week, build the dashboard, share it with the technician, and set the cadence for your one-to-ones and sample reviews. In the fourth week, run the first review using real tickets, adjust the standards where they proved unrealistic, and record what you changed. At the end of the month, you should be able to answer how a technician is doing without having watched them work.
📅 Book a 20-minute call: https://meet.brevo.com/konnectph
✉️ Email us: hello@konnect.ph
If you are weighing whether to install tracking software on offshore staff, bring the tools you are considering and your current ticket metrics to the call, and we will go through which measures fit the role and how to set them up so the technician knows what you see.
About the Author
Vilbert Fermin is the founder of Konnect, a remote staffing company connecting North American and Australian businesses with top Filipino talent. With deep expertise in IT support and remote team management, Vilbert helps MSPs access skilled technical professionals without the overhead of full-time domestic IT staff. His mission is to showcase Filipino excellence while helping businesses stay protected, productive, and competitive through strategic remote staffing.
