Office utilisation can be measured in a GDPR compliant way if only the use of space is analysed in anonymised and aggregated form, no personal reference arises in reporting, and the works council and data protection officers are involved before introduction. Whether the works council agrees to the introduction of a measurement system is decided by the body as part of co-determination.
The reason for such a measurement is usually concrete: an expiring lease, a discussion about reducing office space, or complaints about areas that are too full or too empty. Facility Management or Real Estate then need reliable data, not assumptions.
The guiding principle: measure spaces, do not observe people. Booking data shows the plan; measured usage shows reality.
This guide gives you:
- An overview of measurement methods and their personal reference
- The legal guardrails from the GDPR and the German Works Constitution Act
- A discussion guide for coordinating with the works council
- A worked example of utilisation with an open formula
- An assessment of how Seatti supports implementation
Why booking data alone is not enough
Many companies start with desk booking or meeting room booking and use the resulting booking data as the basis for space decisions. The problem: this data only shows planned attendance, not actual usage. A desk can be reserved but never used. A room can be booked, but the meeting cancelled at short notice.
This phenomenon is known as a no-show: booked but not used. For space planning this makes a considerable difference, because decisions about leases or refurbishments based on a booking rate can overestimate real utilisation.
From the perspective of the works council and data protection, there is a further risk: at operational level, booking data can usually be linked to individuals, because a specific person books the desk or room. If this data is not cleanly separated, there is a temptation to analyse individual booking patterns and draw false conclusions about the attendance of individual employees.
The decisive separation lies between two levels:
- Booking level: operationally necessary so that employees can reserve a desk or room. Personal data arises here.
- Analysis level: relevant for space decisions. Here, reporting should be exclusively anonymised and aggregated, focusing on zones, floors and locations, not on individual people.
To obtain reliable and GDPR compliant statements on office utilisation, companies need to choose and design different measurement methods deliberately.
Measurement methods compared: from manual counting to hardware based recording
There are various technical and organisational ways to measure the use of office space. They differ considerably in personal reference, effort and informative value. Not every method is equally suitable for GDPR compliant reporting.
Manual counting
In manual spot checks, a responsible person walks through defined areas of the building and records how many desks or meeting rooms are occupied at a given time. Manual counts are generally unproblematic in terms of data protection, as no digital data is recorded. No personal data arises; the focus is solely on the status of the space: occupied or free.
Typical use cases are an initial assessment of a location before a lease decision or the validation of other data sources. The pitfalls lie in the limited depth of sampling, the high manual effort for large areas and the risk of subjective judgements, for example when a desk is found with a jacket and laptop but no person.
Booking data
Booking data comes from desk booking and meeting room systems, often integrated via Microsoft Teams or Outlook. It shows which desks, rooms or parking spaces were reserved. At operational level, this data is personal, because a specific person makes the booking. For reporting, it should be anonymised early and analysed only in aggregated form.
The main pitfalls: no-shows distort utilisation figures, double bookings distort the picture further, and the data only reflects planning, not reality. If analysed at individual or team level, there is a risk of inadmissible performance assessment.
Access and badge data
Access control systems with cards, badges or turnstiles record entry into the building or into certain zones. This data primarily serves security and is clearly personal, as conclusions about individual people are possible. Its informative value for office utilisation is limited: it shows who entered the building, but not which desk was actually used.
The pitfalls are strict purpose limitation, the high need for protection and the works council's right of co-determination. Repurposing this data for utilisation measurement requires careful legal review.
Network based presence
With this method, actual attendance is detected when devices connect to a defined office network, for example via Wi-Fi or a specific IP range. No manual check-in and no additional hardware are needed. This makes it possible to show whether devices, and thus work, are actually on site at a location, without creating movement profiles.
Anyone working from home does not log on to the office network and is not recorded by this method.
The personal reference arises technically through the network login, because network identifiers of devices can be personal data. For reporting, this raw data must therefore be deliberately anonymised and aggregated. Coordination with data protection and the works council should take place in advance, because even with anonymised network data, conclusions about individuals may remain possible if analyses become too granular.
Hardware based recording
Dedicated hardware in the office, such as presence or occupancy technology on ceilings or under desks, measures the occupancy of desks or rooms directly. It records whether individual desks or areas are occupied and usually provides precise data on desk occupancy. As a rule, no direct personal reference arises if the equipment only records occupancy figures without identifying people.
The pitfalls are the installation effort, the costs, a longer implementation process and the fact that such systems can be subject to co-determination if they would objectively be suitable for monitoring behaviour.
Comparison table of methods
The following table compares the five methods:
| Method | What is recorded? | Personal reference | Typical use | Pitfalls for data protection and co-determination |
|---|---|---|---|---|
| Manual counting | Space status (occupied desks / rooms) | Usually none | Rough location planning, validation | Effort, sampling errors, subjective definition of occupancy |
| Booking data | Reservations of desks, rooms, parking spaces | Indirect to direct (who books) | Plan vs. demand, desk sharing ratio | No-shows, inaccurate planning data, risk of individual analysis |
| Access / badge data | Entry into the building or zones | Directly linkable to individuals | Security purposes, general attendance | Conclusions about individuals, high need for protection, co-determination required |
| Network based presence | Network login of devices in the office | Technically personal, reporting ideally anonymous | Real utilisation, peak and trend analysis | Network identifiers can be personal data, aggregation required |
| Hardware based recording | Desk and room occupancy directly | Usually no direct personal reference | Fine tuning desk sharing | Purchase costs, technical integrity, co-determination right |
Methods in which analysis is anonymous and aggregated at space level are particularly suitable for GDPR compliant utilisation measurement. Hardware based measurement records actual usage directly at the desk, while network based solutions work without additional hardware. In every case, what matters is: analyse spaces and processes rather than monitoring people's behaviour.
What the GDPR requires for measurement
This section offers practical guidance under German law. It does not replace legal advice. Companies should coordinate their assessment with a lawyer specialising in data protection law.
The GDPR serves to protect personal data, and the measurement of office utilisation must be consistent with it. Four principles from Article 5 GDPR are particularly relevant:
Purpose limitation
Purpose limitation requires a clear definition of how the data is used. The purpose must be documented, for example “space efficiency and work organisation”. Data may only be used for facility management and space planning, not subsequently for monitoring performance or behaviour, nor for statements about the productivity or satisfaction of individual employees. It should not be possible to draw conclusions about the work of individual people from the data.
Data minimisation
Data minimisation is a central principle of the GDPR. Only data that is actually needed for the space analysis may be collected. Names, personnel numbers or highly granular time stamps of individual employees do not belong in utilisation reporting. Personal raw data should be anonymised immediately.
Storage limitation
Raw data should be aggregated after a short time and then deleted or irreversibly anonymised. The shorter the retention period for personally identifiable data, the lower the risk. The specific period depends on the purpose and should be set out in a works agreement.
Transparency
Transparency about the systems used and the data collected is mandatory. Employees are entitled to easily understandable information about what is measured, on what legal basis and how it is analysed. The workforce should therefore be informed before the start.
Depending on the design, Art. 6 GDPR may serve as the legal basis. For employee data, employee data protection must also be taken into account, and a works agreement can regulate the processing.
Depending on the method, a data protection impact assessment may be necessary, particularly in the case of systematic monitoring or extensive processing of attendance data. The data protection officer should be involved early in the implementation process.
Attendance data is a special case: it can be classified as behavioural data and is then subject to particularly high requirements for anonymisation and aggregation. The more consistently data is anonymised and aggregated, the lower the data protection risk. Aggregated occupancy data is key to privacy compliant office utilisation measurement.
Practical tip: check before selecting software whether the system supports a clean separation between personal bookings and anonymised reports.
When the works council has co-determination rights and how the conversation succeeds
Under Section 87(1) No. 6 of the German Works Constitution Act, the works council has a right of co-determination in the introduction of technical equipment that is suitable for monitoring the behaviour or performance of employees. What matters is the objective suitability of the system, not the subjective intention of the employer.
In practice, this means: measures without a technical system, such as manual counting, generally do not trigger co-determination. IT based solutions such as booking tools, network based presence detection or hardware based recording, on the other hand, may be subject to co-determination and should be agreed with the works council.
Works council approval is never guaranteed. It is the result of the co-determination process. The works council represents the workforce and ensures that a measurement system does not worsen employees' working conditions.
For the works council's decision, not only the technology is relevant, but also how transparently analysis, access and use of the data are regulated. An early, transparent dialogue generally improves the starting position. The following checklist can serve as a discussion guide.
Checklist for the conversation with the works council
The checklist bundles everything that should be clarified for a first conversation. Facility, IT, data protection and the works council can use it together as an agenda or minutes structure, and each side contributes its own part: Facility the space questions, IT the technical view, data protection the legal assessment and the works council the employees' perspective.
Checklist, point 1: purpose
- Formulate precisely why the measurement is to take place, for example: “clarify space requirements before renewing a lease” or “investigate complaints about overcrowding in certain areas”.
- Make clear that no monitoring of the performance or behaviour of individual employees is planned.
Checklist, point 2: data recorded
- List which raw data arises: booking, network login, time of entry.
- Record which of it flows into reporting and how early personal details are removed or anonymised.
Checklist, point 3: level of analysis
- Define the level at which reports are permitted: desk group, zone, floor, location. Never an individual analysis per person.
- Example of a typical report: utilisation per weekday by floor.
Checklist, point 4: access rights
- Describe the roles that receive access to analyses: Real Estate, Facility, HR, works council, management.
- Determine whether and how the works council gets permanent insight into reports.
Checklist, point 5: deletion periods
- Propose after what time raw data is deleted or irreversibly anonymised.
- Address rules on backups and log data. The works council must be informed about data storage and access.
Checklist, point 6: review after the pilot phase
- Agree a period after which effectiveness, side effects and any adjustments are reviewed together.
- Record the option to restrict or stop use if agreed limits are exceeded.
Details should be set out in writing in a works agreement. A legal review by a specialist lawyer is recommended.
Example: calculating utilisation
Clear calculation logic helps avoid misunderstandings with the works council and data protection. Calculating on a daily basis is transparent and easy to follow.
Formula
Utilisation = desk days used ÷ desk days available
A desk day is one desk actually used on one working day.
Worked example: figures chosen freely, not a benchmark
- 100 desks × 20 working days = 2,000 available desk days
- Booked: 1,100 desk days → booking rate 55%
- Actually used (measured): 800 desk days → real usage 40%
This example shows: the booking rate overestimates actual office utilisation by 15 percentage points. Without measuring real usage, space decisions can be based on a false assumption. The difference is a central argument in the conversation with the works council: the point is to identify empty space, not to control people. Measuring office utilisation is decisive for space decisions.
Typical questions that can be answered with anonymised utilisation figures:
- Which days are peak days?
- Which zones or floors are permanently underused?
- How big is the difference between the booking rate and real usage?
- Which locations have the highest share of unused office space?
What the works council rightly asks
Works council members and data protection officers are rightly sceptical when a system is to be introduced that makes attendance in the office visible. The concern about monitoring is justified, because the line between space measurement and behaviour monitoring is not always obvious. The central objection is almost always: “Is the attendance of individual people being monitored?”
Objection: “Will individual employees be made visible?”
This objection is justified, especially for systems that would technically be capable of logging individual behaviour. Measurement must comply with data protection law, and the data should be used exclusively for space planning.
Companies can address the objection by giving binding assurances on the following points:
- Strict separation of operational booking (personal, for desk reservation) and reporting (anonymous, aggregated by space and time).
- No reports at individual or team level, only at the level of zones, floors, locations and time periods.
- No live monitoring, no GPS tracking, no working time recording as part of utilisation measurement.
These limits should be documented in a works agreement: what is measured, how data is anonymised, who has access, how long data is stored, and that monitoring of performance or behaviour is excluded.
This keeps the focus clearly on the space decision: how much office space do we need, which team zones support collaboration on site, which times are peaks? Companies should measure real usage instead of assuming attendance.
Three further questions on co-determination and data protection often come up.
Who sees the data and in what form?
Role based access rights and clear reporting definitions create trust. Not every manager needs access to utilisation data. Define exactly which roles see which analysis.
How long can data be stored?
Shorter retention periods and early aggregation reduce the risk. The faster raw data is anonymised, the lower the risk of re-identification by combining it with other data sources.
Can the system later be expanded to monitor performance?
This use should be expressly excluded and safeguarded through technical and organisational measures, for example by restricting the system to anonymous usage analyses and contractually defining the purpose of use. Where a system would be suitable for monitoring performance, a works agreement is generally the appropriate instrument.
How to proceed with Seatti
Seatti brings Workspace Management and Office Intelligence together in one system: the office is organised in Microsoft Teams and Outlook, and the related usage data forms the basis for decisions on space and costs. Microsoft Entra Sync takes over users, groups and access automatically, without duplicate data maintenance. The system is built for companies with enterprise structures and 250 employees or more.
Decisions about space and operating costs are made constantly in everyday office life, often without measured usage as a basis. A pure booking tool only answers the question of how the office is run. Only usage data shows how much space is actually needed. The question for companies is therefore less whether they need this data than how much longer they will make space decisions without it.
Step 1: involve data protection and the works council early
Before a demo or pilot project begins, companies should hold the conversation with data protection officers and the works council. Seatti is built to make co-determination easier: analyses are pseudonymised and aggregated, without conclusions about individual people. There is no live monitoring, no geolocation and no working time recording. Hosting and data processing take place in the EU, and Seatti is ISO 27001 certified. Bookings can be anonymous on request, and specifying the work location is optional.
Companies should clarify the legal assessment and the works agreement with their own legal advisers.
Step 2: introduce Workspace Management
In the first step, Seatti Workspace Management covers the operational side of the office: booking desks, meeting rooms, parking spaces and services directly in Microsoft Teams and Outlook. Several locations, entities and rule sets can be managed centrally, and roles and permissions controlled at a granular level. In this phase, processes and booking logic are stabilised before utilisation reporting is added.
Step 3: activate Office Intelligence for real usage
In the next step, Seatti's Office Intelligence combines booking data with IP-based presence and existing infrastructure to obtain a realistic picture of space usage.
IP-based presence detects when a device connects to the defined office network. No additional hardware, no additional check-in and no interaction by employees is needed; there is no GPS, no room level tracking and no movement profiles. Separate networks can be defined for each location.
This makes it possible to answer, in aggregated form, questions about utilisation by floor, area and location, the difference between booked desks and actual usage including identified no-shows, and trends by weekday and time period.
IP-based presence is included in Intelligence Essentials, full usage analysis in Intelligence Enterprise. You can find the details on the pricing page.
Step 4: technical rollout in the Microsoft 365 environment
The technical rollout usually takes less than two weeks. On the first day, the kick-off and technical installation in the Microsoft 365 environment take place; in the first week, admin training and office configuration follow; in the second week, user onboarding and go live. Coordination with the works council comes before the technical rollout, and its duration depends on the company. There are no implementation costs.
Find out more about data analysis in Seatti.
First the conversation, then the demo
In brief: measuring space usage means basing decisions about office rent and costs on real data, without monitoring employees. The GDPR and co-determination can generally be complied with if data is anonymised early, analysed only in aggregated form and designed together with the works council and data protection.
The recommended next step: first an internal conversation between Facility, IT, data protection and the works council based on the checklist outlined above. Then a joint demo in which the works council sees specifically which reports are delivered and which data is deliberately not visible.
Would you like to see how Seatti runs in your Microsoft 365 environment? In a 30 minute walkthrough, we show how Seatti simplifies your office processes and puts your space decisions on a solid data basis.
Author and sources
Author: Saskia Neuner, Chief of Staff at Seatti. As of 4 November 2026.
This content does not constitute legal advice. For legal questions on the GDPR, the Works Constitution Act or works agreements, we recommend consulting a lawyer specialising in data protection or employment law.
Sources:
- IP-based presence
- Data protection
- ISO 27001 certificate
- Pricing
- Workplace analytics
- Office Intelligence
- Office Intelligence without additional hardware
Frequently asked questions
Under Section 87(1) No. 6 of the German Works Constitution Act, the works council has a right of co-determination for technical equipment that is suitable for monitoring the behaviour or performance of employees. As a rule, co-determination applies when technical systems for utilisation measurement are introduced, even if there is no intention to monitor. Whether the works council agrees is the result of the co-determination process and cannot be guaranteed in advance. Early involvement with a clear description of the purpose improves the starting position.
Attendance and utilisation data is typically not processed on the basis of individual consent, but on another legal basis under Art. 6 GDPR, supplemented where appropriate by a works agreement. Prerequisites are a clear purpose, data minimisation, transparency, co-determination and, where necessary, a data protection impact assessment. Consent in an employment relationship is legally sensitive because employees are in a position of dependency, and is therefore not the standard solution.
Anonymised means that it is no longer possible to draw conclusions about a specific person from the processed data, for example by removing identifiers and summarising at group level. Aggregated means that data is summarised by space or time, for example as utilisation per floor and day. This level is exactly what is needed for space decisions. Individual attendance lists are not necessary.
At reporting level, a few KPIs are enough: the number of occupied desks or rooms per area and day, peak days, and a comparison of booked vs. used. Names, personnel numbers or exact working hours of individual employees are not needed to assess space efficiency. Every additional type of data should be critically checked against purpose limitation and data minimisation.
Technically, Seatti is usually live in less than two weeks, from kick-off through configuration to onboarding. Coordination with the works council and data protection comes first; its duration depends on the company and it should be completed before technical implementation.
