At some point during any DEX rollout, someone asks the question out loud: “So is IT watching what I do?”
If you’ve already answered it, that’s a short conversation. If you haven’t, the answer gets made up for you, in a group chat, and it’s worse than the truth. Once “IT can see everything you type” is going round the office, no FAQ fully undoes it.
So answer it before anyone asks.
Write down what’s collected, in plain words
Start with a list a non-technical person can read in a minute. Group it by what it’s for, not by how the vendor names it:
- How well the device is running: startup time, crashes, disk space, battery health
- Which apps are used and how they perform
- How good the network connection and call quality are
- Answers to the short surveys people choose to fill in
- What IT changed on the device, and when
Then say what isn’t collected, but only once your vendor has confirmed it in writing. Ask for the detail field by field. A good vendor will give it to you as part of a security review, and your data protection officer will want it anyway.
Say why, for each item
“We collect app crash data so we can see when an update breaks something, and roll it back” lands far better than “we collect diagnostic data to improve the service”. If you can’t explain why you need something, that’s a strong hint you shouldn’t collect it.
Be clear about who sees what
Most of the useful questions in DEX are about groups, not individuals. Is the Dallas office slower than the others? Did the new laptop model make things better? Say that most reporting is by site, team or device model, say which roles can see a single device, and say why they’d need to (usually because that person has asked for help).
Say how long you keep it
Pick a retention period, write it down, and stick to it. Data you’ve deleted can’t leak, and can’t be misused by whoever has the job after you.
Tell people before, not after
The notice should land before the agent does. In Germany and a number of other countries, works councils have a legal right to be involved before any tool that could monitor employees goes live, and under the GDPR you’ll probably need a data protection impact assessment as well. Even where neither applies, involving employee representatives early is cheaper than unwinding a rollout later.
Promise what it won’t be used for
This is the part people care about most. If the data won’t be used to measure individual performance, say so in so many words, and make sure it’s true. If you can’t make that promise, people will assume the worst, and they’ll probably be right to.
A notice you can adapt
From [date], IT is installing a support tool on company laptops. It checks how well your device is running (things like startup time, crashes, disk space and call quality) so we can fix problems, often before you notice them. It does not read your files, email or messages, and it is not used to measure anyone’s performance. Most reports cover whole sites or teams; support staff only look at a single laptop to help fix it. Data is kept for [period]. Questions: [contact].
Change it to fit what your tool actually does, and check the “does not” sentence against your vendor’s written answer before you send it.
How we handle it at Nanoheal
In Nanoheal, data visibility, anonymisation and retention follow your configuration and the privacy requirements you agree with us, and retention and deletion are set per customer. We offer a data processing agreement on request, share field-level collector detail through our technical and security review, and hold SOC 2 Type I, with Type II in progress. The data and privacy datasheet covers what the agent collects and why.