Philippines · IT and BPO

Your Client Doesn't Actually Need to Spy on Your Team

Published 17 September 2026 · Updated 24 October 2026 · Wisertrack

Why "proof of work" and "surveillance" aren't the same thing — and what Philippine IT and BPO firms are asked to document.

If you run an IT staff augmentation, software development, IT consulting, or BPO firm in the Philippines — whether that's a dedicated dev team, a contact center, or a back-office processing operation — you're probably caught in a squeeze that nobody's named for you clearly: your overseas clients want proof their money is buying real work, Philippine labor law wants proof you're treating your telecommuting staff fairly, and somewhere in between, many firms reach for the same answer — screenshots, keystroke logs, webcam captures.

That answer often goes further than anyone asked. It isn't automatically illegal, but it's rarely what the client, DOLE or the NPC actually asks for, whether your team writes code, handles claims or works a support queue.

What DOLE asks for

The Telecommuting Act (RA 11165) and its implementing rules (DOLE Department Order No. 237, series of 2022) set out, among other things: a telecommuting program both sides adopt voluntarily, with evidence that they agreed (Sec. 5); notice to DOLE through its Establishment Report System, covering every branch that telecommutes, and keeping the documents that prove the voluntary adoption for at least three years (Sec. 10); and the same treatment as comparable on-site staff, including pay and overtime not lower than the law or any CBA requires, rest days and holidays (Sec. 8). The rules also list topics a program should cover, such as eligibility, safety and health, and data protection (Sec. 6). They count all time an employee is required or permitted to work at the alternative workplace as hours worked, and say telecommuters are not field personnel unless their actual hours cannot be determined with reasonable certainty (Sec. 4). Separately, the Omnibus Rules Implementing the Labor Code (Book III, Rule X) require employers to keep employment records, including time records, for at least three years from the last entry.

None of these provisions mentions activity monitoring. What they ask for is documentation and an accurate time record, whether your telecommuting staff are engineers, customer service reps, claims processors or data entry teams.

What the National Privacy Commission has said

This is the part that gets garbled most in industry conversation. The NPC has addressed workplace monitoring several times. Two advisory opinions are most often cited: one on keystroke logging and random screen capture (Advisory Opinion No. 2018-084), and one on random webcam and microphone recording (Advisory Opinion No. 2024-003, which came from a BPO company). Its 2020 work-from-home FAQ (PHE Bulletin No. 14) also covers remote monitoring. Advisory opinions respond to specific facts and are not binding rulings, but they show how the NPC reasons, and that reasoning isn't limited to software teams.

The 2018 opinion is cautionary. It said software that records keystrokes or takes random screenshots seems to be an excessive and disproportionate way to monitor employees. It said they should be used only when the employer's stated purpose truly requires them and no less intrusive method would work, and that staff should be told about the monitoring through a written policy. The NPC's 2020 work-from-home FAQ makes the same point about keystrokes, screenshots and webcam photos.

The 2024 webcam opinion is more nuanced than the version that circulates informally. The NPC did not ban this kind of monitoring. It said an employer may be able to rely on the employment contract or on a legitimate interest. To rely on a legitimate interest, the employer would need to show a clear purpose, show the monitoring is necessary and can't reasonably be achieved another way, and weigh it against employees' rights. The opinion also recommended a Privacy Impact Assessment before the monitoring software is deployed, and noted that consent may not be the most appropriate basis for recording work meetings. Separately, the NPC's 2020 FAQ said employers cannot require staff to stay on video all day as proof of work. In short, the NPC focuses on the process around a tool, not only on the tool.

What client compliance frameworks say

Here's the point that matters most for IT and BPO alike: SOC 2, ISO/IEC 27001, GDPR, HIPAA and PCI DSS often come up in client conversations as reasons for invasive monitoring. As we read their published requirements, none of them names continuous screen recording or keystroke logging as a required control.

SOC 2 sets criteria rather than a fixed control list. Its security criteria point to logical access controls and monitoring system components for anomalies, not desktop recordings.
ISO/IEC 27001 is a risk-based framework: an organisation selects its controls through its own risk treatment process, rather than following a fixed surveillance checklist.
GDPR asks for lawfulness, data minimisation and accountability. EU regulators (the Article 29 Working Party, Opinion 2/2017) have said keystroke logging and screen capture of employees are very unlikely to have a legal basis.
HIPAA's audit-control requirement (45 CFR 164.312(b)) is about recording and examining activity in information systems that hold electronic protected health information — whether that's a developer touching a database or a claims-processing agent opening a patient record — not about recording someone's screen or keystrokes while they do it.
PCI DSS asks for audit logs of access to the cardholder-data environment, protected from deletion and unauthorized changes and kept on synchronized time, whether the person is an engineer with database access or a payments-support agent handling card disputes.

The pattern is broadly consistent: these frameworks focus on system and access-level audit trails, not on desktop-level behavioral surveillance. (PCI DSS does require camera or badge monitoring of sensitive physical areas such as data centers, which is different from recording someone's screen.) A client asking for "SOC 2-grade proof of work" — for a dev team or a transactional BPO seat — is often asking for something a delivery process can produce without a single screenshot.

That said, none of these frameworks rules out every worker-level control in every circumstance, and the exact answer depends on what's actually written into a specific SOC 2 report, a client's SOW, or a contract. It helps to ask what the actual clause says before defaulting to the most invasive tool available.

Alternatives firms often consider

When firms look for a way to meet what DOLE asks to be documented, what the NPC has said, and what clients need to see, four approaches come up often — for software teams and service operations alike:

Billing anchored to outputs, where a contract allows it. For a dev team, that's closed tickets, pull requests, and signed sprint milestones. For a BPO seat, it's resolved cases, handled calls, processed transactions, and QA scorecards logged in the firm's own systems. It's a negotiation with the client, not a unilateral tooling switch.
A review of MSAs and SOWs for clauses that would commit the firm to processing it may not be able to do lawfully as the Philippine employer.
Standardised DOLE (and PEZA, if applicable) documentation — the ERS notice, the records of voluntary adoption kept for three years, time and payroll records, and the fair-treatment paperwork.
A Privacy Impact Assessment before any tracking tool goes live, as the NPC's 2024 opinion recommends, done as a real check of necessity and proportionality.

Our fuller compliance briefing walks through this in more depth: the statutory citations, four detailed scenarios (the webcam mandate, the "it's for HIPAA" keystroke request, the screenshot billing clause, the GPS-for-ecozone-compliance case), and a quick-reference table of what's generally lower-risk versus what needs real safeguards before it's deployed.