Smart Glasses at Work Are Not Your Employee's Private Business

On 13 October the European Data Protection Board (EDPB) adopted its first statement on smart glasses and named the workplace as one of the sensitive settings. Once an employee uses glasses with a camera and an AI assistant for work, the GDPR applies and responsibility points to the company. Most internal rules, meanwhile, still assume the only recording device in the room is a phone on the table.

The meeting nobody knew was being captured

Picture a negotiation over a new supply contract. Your side of the table has the commercial director, a buyer and an engineer from R&D. The engineer wears glasses that look entirely ordinary. They have a camera, microphones and an AI assistant that will summarise the discussion on request and translate the passages in German. The images and audio are processed in the glasses provider's cloud.

After the meeting, nobody on your team knows for certain what was captured. The supplier never finds out at all. And your internal rules say nothing, because the recording ban in your staff handbook was written when recording meant putting a phone on the table.

This is a hypothetical. But glasses with cameras and AI features are on general sale, which is why the EDPB treats them as a practical problem rather than a technology curiosity.

What the EDPB said on 13 October

Statement 1/2026 is preliminary. It creates no new obligations; it explains how existing GDPR obligations apply. Four points matter for businesses:

• The household exemption is narrow. The GDPR does not apply only where the wearer uses the glasses for purely personal purposes, such as filming family or translating a menu in a private setting. Professional or commercial use falls outside the exemption.
• The workplace is named explicitly. According to the EDPB, use at work may raise concerns about employee monitoring and the confidentiality of the organisation's information, including trade secrets and intellectual property. The statement also notes that some establishments already restrict smart glasses on their premises.
• The AI provider enters the picture. The device manufacturer or the provider of the AI features can be an independent or joint controller, typically when it analyses camera images that show other people. The data leaves your control and may be transferred outside the EU.
• Bystander consent is hard to obtain and cannot be collected after the fact. For legitimate interests, the EDPB expects a careful balancing exercise and sufficient safeguards. It adds that breaching labour, civil or criminal law can also call into question the fairness of the processing under Article 5(1)(a) GDPR.

Three assumptions your policies rest on

"They are the employee's own glasses, so it's not our concern"

An employee who wears the glasses in a negotiation, during a service visit at a customer site or in an internal meeting is acting in the course of their work. Under EDPB Guidelines 07/2020 on the concepts of controller and processor, the controller is generally the organisation on whose behalf the employee acts, not the employee as an individual. When a regulator or a business partner asks what happened to the footage, the company will be the one answering.

National civil law adds its own layer. In Czechia, for example, Section 84 of the Civil Code allows a person's likeness to be captured in an identifiable way only with their consent, unless a statutory exception applies. The exceptions exist, but they were not written for a more convenient set of meeting notes. A business partner who was never told has arguments well beyond data protection.

"The recording ban in our handbook covers it"

A typical rule reads: "Audio and video recording is prohibited without management approval." With smart glasses it has two weaknesses.

First, a breach is invisible. The EDPB itself observes that the indicator lights on current smart glasses leave many bystanders unaware that anything is being processed. Second, some features are not recording in the formal sense. Real-time translation or object recognition processes images and sound continuously, often on the provider's servers, and the wearer genuinely feels they are not filming anything.

A rule that holds up therefore addresses devices with a camera or microphone and their functions, not "making recordings". And it defines places and situations, not just an activity.

"If it's risky, we'll ban it for everyone"

A blanket ban is the simplest option, but it has gaps. Some people wear prescription smart glasses instead of ordinary ones, and the EDPB lists assistance for people with disabilities, such as audio alerts about hazards nearby, among the legitimate uses. A company that overlooks this invites a discrimination claim. A ban on employees also does nothing about visitors, suppliers and service technicians who come in from outside.

Then there is the reverse case: the company itself wants to deploy glasses, for remote assistance to field technicians, warehouse checks or documenting service jobs. At that point the company is the controller in every respect:

• If the glasses make it possible to monitor employees' work, national labour law sets the conditions. In Czechia, Section 316(2) of the Labour Code requires a serious reason arising from the specific nature of the employer's activity, and Section 316(3) requires employees to be informed directly about the scope and method of monitoring.
• Systematic processing of images and audio of staff and customers will often call for a data protection impact assessment (DPIA) under Article 35 GDPR.
• If the software were to infer people's emotions, it would run into the ban on emotion recognition in the workplace under Article 5(1)(f) of the AI Act. The ban has applied since 2 February 2025, with exceptions only for medical or safety reasons.

You can weaken your own trade secret protection

This is the point that hurts R&D and manufacturing most. Under the EU Trade Secrets Directive (2016/943), information is protected only where its holder has taken reasonable steps to keep it secret; in Czechia, Section 504 of the Civil Code requires the owner to keep it confidential in an appropriate manner. If a company lets devices that can discreetly capture images and sound into its development workshop or a pricing meeting, with no rule at all, it weakens its own position in any later dispute over leaked information. The other side will ask what measures you had in place. "Nobody thought it was possible" is not a strong answer.

Zones free of recording devices, a visitor policy that mentions wearable cameras explicitly and a clause in supplier NDAs cost very little. In a dispute, they give you evidence that you took confidentiality seriously.

What to put in place now

You do not need a new policy. You need the existing one to reflect the devices people actually wear.

• Decide where yes and where no. Typical restricted zones: R&D, production areas with know-how, HR and payroll, board meetings, pricing negotiations. Elsewhere, allow use with conditions.
• Rewrite the wording. Replace "making recordings" with "using devices with a camera or microphone, including smart glasses and their AI features".
• Set a rule for meetings with external parties. Anyone wearing glasses with active features says so in advance, and others may object.
• Update the visitor policy and contracts. Wearable devices belong in the visitor rules and in NDAs with suppliers and service partners.
• Add the glasses to your AI tools register. If you already have rules for ChatGPT and similar tools, an AI assistant in a pair of glasses is one more entry: where the data goes, who the controller is, and whether the provider uses it for training.
• Plan for exceptions. Describe a procedure for medical and assistive use so that each line manager does not improvise their own.
• Deploy your own glasses only after a DPIA. Impact assessment first, then employee information and a contract with the provider. Switch off storage and training on your data wherever they are not needed.
• Train people briefly, and keep proof of attendance. Twenty minutes, three situations: an internal meeting, a visitor on site, a meeting at a customer's premises.

Where companies usually get stuck

The legal side of smart glasses is fairly legible. Operations are where it stalls. HR owns the staff handbook, reception owns the visitor rules, IT owns the AI tools policy, legal owns the NDAs, and attendance sheets from training sit in someone's inbox. When something goes wrong, the company struggles to show which version of the rules applied and who knew about it. It is the same lesson as in A Subpoena Is Not a Permission Slip: what you can defend later depends on the process and the records behind the document, not the document itself.

VPoint keeps internal policies, your AI tools register, GDPR records and training in one place. When a rule changes, you can prepare AI-generated training for staff, and completion leaves an audit trail. Adding wearable devices to your rules then flows into the policy, the training and the register at once, instead of travelling by email through five departments.

Summary for management

• Smart glasses used for work fall under the GDPR. The household exemption does not cover business meetings.
• Responsibility generally sits with the company, not with the employee wearing the glasses.
• A ban on "recording" does not cover AI features. Write rules about devices with cameras and microphones, and about specific zones.
• Without rules on recording devices, you weaken the protection of your own trade secrets.
• If the company deploys glasses itself: national labour law on monitoring, a DPIA, and no emotion recognition.

Want to see what a policy update, the related training and an AI tools register look like in one place, at a price that does not grow with your headcount? Request a VPoint demo.