Your Client Doesn’t Actually Need to Spy on Your Team

Why “proof of work” and “surveillance” aren’t the same thing — and what Philippine IT and BPO firms actually need to document.

If you run an IT staff augmentation, software development, IT consulting, or BPO firm in the Philippines — whether that’s a dedicated dev team, a contact center, or a back-office processing operation — you’re probably caught in a squeeze that nobody’s named for you clearly: your overseas clients want proof their money is buying real work, Philippine labor law wants proof you’re treating your telecommuting staff fairly, and somewhere in between, most firms end up reaching for the same answer — screenshots, keystroke logs, webcam captures.

That answer is usually wrong. Not illegal in every case, but wrong in the sense that it’s rarely what anyone actually asked for — whether your team is writing code, handling claims, or working a support queue.

What DOLE actually wants

The Telecommuting Act’s implementing rules (DOLE Department Order No. 237-22) require three things from an employer running a telecommuting program: a documented, voluntary agreement with your staff; a notice filed through DOLE’s Establishment Report System; and equal treatment — pay, rest periods, overtime — matching your on-site staff. Separately, general labor-standards rules require you to keep time and payroll records for at least three years.

None of that requires activity monitoring. It requires a paper trail and an accurate time record. That applies whether your telecommuting staff are engineers, customer service reps, claims processors, or data entry teams — and it’s a lower bar than most delivery and operations leads assume.

What the National Privacy Commission actually says

This is the part that gets garbled the most in industry conversation. The NPC has weighed in twice on workplace monitoring — once on keystroke logging and random screen capture (2018), and once specifically on random webcam and microphone recording (2024). Neither ruling is specific to software teams; both apply just as much to a contact-center agent’s workstation as to a developer’s.

The keystroke-logging guidance is genuinely cautionary: raw keystroke capture sweeps up passwords and personal messages indiscriminately, and the NPC has treated that as excessive.

The webcam guidance is more nuanced than the version that circulates informally. The NPC didn’t ban this kind of monitoring — it said this kind of monitoring can be lawful, but only if the employer can show a genuine, specific purpose; that the collection is actually necessary for that purpose; that it’s been disclosed to staff in writing; and, ideally, that a Privacy Impact Assessment was done first. Most firms deploying this kind of tool skip that whole process. That’s where the actual legal exposure sits — not in the tool existing, but in switching it on without doing the work the law asks for first.

What your client’s compliance framework actually requires

Here’s the wedge that matters most, for IT and BPO alike: SOC 2, ISO/IEC 27001, GDPR, HIPAA, and PCI DSS all show up in client conversations as justification for invasive monitoring — whether the client is briefing a software team or a support/back-office operation. Read what they actually specify, and none of them prescribe continuous screen recording or keystroke logging as a default control.

• SOC 2 wants system-level access logs and security-event detection — not desktop recordings.
• ISO/IEC 27001 is a risk-based framework; you select controls through your own risk process, it doesn’t hand you a fixed surveillance checklist.
• GDPR asks for lawfulness, minimization, and accountability — principles that keystroke logging tends to violate, not satisfy.
• HIPAA‘s audit-control requirement is about logging who accessed protected health data in a system — whether that’s a developer touching a database or a claims-processing agent opening a patient record — not about recording someone’s screen or keystrokes while they do it.
• PCI DSS wants time-synchronized, tamper-evident logs of who touched the cardholder-data environment — the same standard whether that’s an engineer with database access or a payments-support agent handling card disputes.

The pattern holds across every one of them: these frameworks want system and access-level audit trails, not worker-level behavioral surveillance. A client asking for “SOC 2-grade proof of work” — for a dev team or a transactional BPO seat — is very often asking for something your delivery process can produce without a single screenshot.

That said, it’s worth being precise here too — none of these frameworks rule out every worker-level control in every circumstance, and the exact answer depends on what’s actually written into your specific SOC 2 report, your client’s SOW, or your contract. The safer move is to ask what the actual clause says before defaulting to the most invasive tool available.

A shorter path than surveillance

If you’re trying to close the gap between what DOLE wants documented, what the NPC will allow, and what your client actually needs to see, four things go a long way — regardless of whether your delivery unit is a software team or a service operation:

1. Anchor billing to outputs where your contract allows it. For a dev team, that’s closed tickets, pull requests, and signed sprint milestones. For a BPO seat, it’s resolved cases, handled calls, processed transactions, and QA scorecards logged in your own systems. Either way, it’s a negotiation with your client, not a unilateral tooling switch — but it’s a stronger evidentiary story than a screenshot.
2. Check your MSAs and SOWs for clauses that would commit you to processing you can’t lawfully do as the Philippine employer.
3. Standardize your DOLE (and PEZA, if applicable) documentation — the ERS filing, the retention records, the equal-treatment paperwork.
4. Run a real Privacy Impact Assessment before any tracking tool goes live — not as a formality, but as an actual necessity-and-proportionality check.

None of this is legal advice, and Philippine regulatory guidance in this space has moved quickly — anything here should be checked against current law before you rely on it for a specific decision.

We put together a fuller compliance briefing that walks through all of this in more depth — the exact statutory citations, four detailed scenarios (the webcam mandate, the “it’s for HIPAA” keystroke request, the screenshot billing clause, the GPS-for-ecozone-compliance case), and a quick-reference table of what’s generally low-risk versus what needs real safeguards before you deploy it.

Download The PH IT/BPO Compliance Squeeze →