June 30, 2026

GDPR-compliant employee web filtering: what to log, what to skip

Web filtering logs are employee data. GDPR Article 5 requires data minimization — collect and retain only what is necessary for your documented purpose. Article 6 demands a lawful basis: usually legitimate interest (security and policy compliance) balanced against employee privacy. This post is practical interpretation, not legal advice; consult your data protection officer or legal counsel for your jurisdiction and industry.

Lawful basis: legitimate interest and proportionality

In most EU member states, employers can argue legitimate interest for web-filtering controls: protecting company infrastructure, preventing data loss, ensuring network policy compliance. The key word is proportionality. Blocking malware C2 and phishing is clearly justified. Tracking employee browsing history for profiling or discovery is not — it exceeds proportionality and invites regulatory action.

The proportionality test asks: Is this measure necessary? Is there a less invasive alternative? Can you achieve the same security outcome by logging less? If DNS filtering logs only blocked domains (policy enforcement), not successful resolutions (every page visited), you have minimized data collection. That is proportionate. If you log every page every employee visits (successful or blocked), you have failed proportionality — you can detect malware with less invasive monitoring.

What to log: block events, not browsing history

Log blocked domains when policy is enforced. The audit trail should capture: domain name, policy category (phishing, malware, gambling, etc.), threat-feed source (URLhaus, OpenPhish, PhishTank), timestamp, device ID (not employee name), and the policy rule that applied. This data proves your control worked and satisfies incident investigation without invading employee privacy.

Do not log successful domain resolutions. When an employee visits github.com and the site loads, that is not a security event. It contains no policy enforcement, no threat signal, and no compliance evidence. Logging it violates data minimization: you have expanded your data collection beyond "we block threats" to "we track where employees browse," which is disproportionate.

Similarly, do not log HTTP request bodies, user-agent strings, or referrer headers unless they are part of a specific incident investigation. Those details expand the dataset and rarely contribute to legitimate blocking decisions.

Data retention and employee transparency

GDPR Article 5 also requires storage limitation: do not keep logs longer than needed. If your threat-investigation SLA is 72 hours, retain logs for 90 days (buffer for delayed detection). Do not retain indefinitely. After 90 days, log queries expire and are deleted unless tied to a specific incident or compliance investigation.

Transparency is mandatory. Your privacy policy and employee handbook must disclose: "The company filters web access to block malware, phishing, and policy-prohibited categories. Blocked access attempts are logged with domain, category, and timestamp for 90 days to support incident investigation and compliance audits. Successful page visits are not logged."

Works-council involvement is required in Germany and the Netherlands, and common elsewhere in the EU, when implementing systems that can monitor employees. DNS-level filtering (which blocks at resolution time and does not decrypt traffic) often receives faster approval than TLS-interception proxies (which read plaintext traffic and trigger higher scrutiny). Frame your technical approach to emphasize data minimization: "We log enforcement events, not employee browsing."

BYOD and contractor networks

BYOD (Bring Your Own Device) fleets require extra caution — we covered how a BYOD filtering push becomes a privacy problem. When an employee brings a personal device to work, the employer's jurisdiction over that device is limited. GDPR applies; so do local labor laws. The safer approach: offer a corporate device for company work, and apply web filtering only to that device. If you must filter BYOD, be explicit about the scope (company network access only, no logging of employee personal use) and document works-council approval.

Similarly, contractor networks and guest networks should have separate filtering policies logged separately. Do not aggregate contractor browsing data with employee data; treat each category as a distinct processing context with its own legal basis.

Not legal advice

This guidance interprets GDPR principles and common practice; it is not legal counsel for your organization. Your lawful basis, proportionality test, and retention policy depend on your industry, employee contracts, and local labor law. Consult your data protection officer or qualified legal counsel before deploying web-filtering systems.

Start with the data-minimization principle: log only enforcement events (blocked domains, categories, timestamps), not browsing history. Document your lawful basis in your privacy policy and employee handbook, and get works-council approval if required in your location. To see what the agent logs — and what it deliberately does not — visit the feature overview.