# Task mining vs process mining: logs are cheap, screens are risky

> Process mining reads logs your systems already keep; task mining records desktops. We mined sample logs of both kinds and read the prices and GDPR texts.

- Published: 2026-10-20
- Author: 28creation Desk
- Format: Analysis
- URL: https://28creation.com/articles/task-mining-vs-process-mining/

## The short read

**EU regulators called software that logs keystrokes and captures screens disproportionate for employers in 2017.**

- Process mining rebuilds a process from timestamped system logs; task mining records clicks, keystrokes and often screenshots on a person's desktop.
- On a 60-invoice sample log we built, 23 lines of free Python found the rework loop and the slowest wait.

### What you can do with this

> Export one process as a CSV with case ID, activity and timestamp, then mine it before buying anything. If you need click-level detail, have one volunteer record one task they choose.

---

Process mining and task mining both promise to show where work goes, but they look at different things. Process mining reads the timestamped records your business systems already keep, such as when an invoice was entered, approved and paid. Task mining records what a person does on their own computer, click by click, and some tools [take a screenshot on each action](https://docs.uipath.com/task-mining/automation-suite/2024.10/user-guide/unassisted-task-minining-introduction).

For a small team that difference decides what data you need and how much legal risk comes with it. When we checked on October 19, every top result for "task mining vs process mining" came from a vendor of one or both.

So we built a sample event log and mined it with a free library. We also priced the tools from their own pages and read what European and UK regulators say about recording employees. Prices and documentation were read on October 20, 2026.

## Process mining starts from records you already have

Process mining needs an event log: one row per step, with three columns. Microsoft's documentation for its process mining tool names them as a [case ID, an activity name and a timestamp](https://learn.microsoft.com/en-us/power-automate/process-mining-processes-and-data). The case is the thing the process acts on, such as an order or an invoice. Optional columns add the person or system that did the step, or an amount.

The catch is getting that log. Microsoft warns that many database tables hold only the current state of a record, not its history, and that "not all events that you're interested in are logged." Some systems keep the history in a separate table; Microsoft names the Activities table in Dynamics apps as one example.

When the log exists, the analysis is cheap. To show how cheap, we built a sample log of 60 invoices with a short Python script, so every number below comes from data we made up on purpose, not from a real company.

Each invoice is received, entered in the accounting system, matched to a purchase order, approved and paid. About one in five fails the match and goes back to the supplier, a few of them more than once. Small invoices skip approval.

## Free code finds the loops and the waits

We ran the log through [pm4py](https://github.com/process-intelligence-solutions/pm4py), an open-source process mining library for Python, version 2.7.23.11. This is the whole analysis, 23 lines:

```python
import pandas as pd, pm4py
df = pd.read_csv("invoice_log.csv")
df["timestamp"] = pd.to_datetime(df["timestamp"])
log = pm4py.format_dataframe(df, case_id="case_id", activity_key="activity", timestamp_key="timestamp")
print("pm4py", pm4py.__version__)
print("\n# Variants (path through the process, number of invoices)")
for path, n in sorted(pm4py.get_variants(log).items(), key=lambda x: -x[1]):
    print(n, " > ".join(path))
print("\n# Directly-follows counts")
dfg, starts, ends = pm4py.discover_dfg(log)
for (a, b), n in sorted(dfg.items(), key=lambda x: -x[1]):
    print(f"{n:3d}  {a} -> {b}")
print("\n# Median wait before each step (hours)")
df = df.sort_values(["case_id", "timestamp"])
df["wait_h"] = df.groupby("case_id")["timestamp"].diff().dt.total_seconds() / 3600
print(df.groupby("activity")["wait_h"].median().round(1).dropna().sort_values(ascending=False).to_string())
dur = df.groupby("case_id")["timestamp"].agg(lambda s: (s.max() - s.min()).total_seconds() / 86400)
rework = df[df.activity == "Ask supplier for fix"].case_id.unique()
print("\n# Throughput time (days), median")
print("all invoices:", round(dur.median(), 1), "| with supplier fix:", round(dur[dur.index.isin(rework)].median(), 1),
      "| without:", round(dur[~dur.index.isin(rework)].median(), 1), "| invoices with a fix:", len(rework))
net = pm4py.discover_petri_net_inductive(log)
print("\n# Inductive-miner model fitness on its own log:", round(pm4py.fitness_token_based_replay(log, *net)["log_fitness"], 3))
```

Guess how many different paths 60 invoices took through a five-step process. Our sample produced seven. The first lines of the real output:

```text
39 Receive invoice > Enter in accounting > Match to PO > Approve > Pay
12 Receive invoice > Enter in accounting > Match to PO > Ask supplier for fix > Enter in accounting > Match to PO > Approve > Pay
5 Receive invoice > Enter in accounting > Match to PO > Pay
```

The other four paths held one invoice each, all with one to three trips back to the supplier. The rest of the output, abridged:

```text
# Median wait before each step (hours)
Approve                 58.0
Enter in accounting     21.7
Pay                     17.3
Match to PO              2.0
Ask supplier for fix     1.4

# Throughput time (days), median
all invoices: 4.7 | with supplier fix: 7.1 | without: 3.7 | invoices with a fix: 16
```

Read it the way you would read a real log. Sixteen invoices went back to a supplier, and those took a median 7.1 days against 3.7 for the rest. The longest median wait sits before approval, at 58 hours. Those are the two questions process mining answers well: where work loops and where it waits.

One honest limit: these patterns are in the output because our generator put them there. The test shows what the method reports, not how real invoice processes behave. The library also prints a license notice when it loads: pm4py is under the [AGPL-3.0](https://github.com/process-intelligence-solutions/pm4py), and its maintainer, a Fraunhofer FIT spin-off, sells a separate license for closed-source commercial use. Running it on your own data is a different case from building it into software you sell or host for others; ask whoever handles licenses before you do that.

## Task mining sees the clicks a log never records

Process mining could not tell us why entering an invoice takes a person ten minutes. The accounting system logs that the invoice was saved, not the copying and pasting that came before. That gap is what task mining fills.

To show the difference, we built a second sample: 341 desktop actions for one clerk's morning, the kind of trail a recorder produces. Again it is made up by our script, not recorded from a person. Thirty invoices each take eight steps, from opening the email to clicking Save, with other work and interruptions mixed in. Then we counted repeated runs of actions:

```text
most frequent run of 8 actions, seen 12 times:
   Outlook | open email
   Outlook | open PDF attachment
   PDF viewer | copy invoice number
   Accounting app | click New supplier invoice
   Accounting app | paste invoice number
   PDF viewer | copy amount
   Accounting app | paste amount
   Accounting app | click Save

app switches: 238 | paste actions: 60
```

The routine ran 30 times, but an exact count of all eight steps found it only 12 times, because an interruption anywhere inside it breaks the match. A four-step prefix showed up 22 times.

That is one reason the commercial tools group similar actions for you (Microsoft's tool now [does this automatically](https://learn.microsoft.com/en-us/power-automate/process-advisor-processes)) and ask for a lot of data. Still, the output names the automation: copy two fields from a PDF into the accounting app, 30 times a morning. Our guide to [getting email data into Excel](/articles/email-data-into-excel/) covers that kind of extraction.

## Task mining needs far more data, and some of it is screenshots

The two task mining tools we read up on differ in who presses Record. In Microsoft's Power Automate, a person starts the desktop recorder, [performs the task and selects Finish](https://learn.microsoft.com/en-us/power-automate/process-advisor-processes), and can pause or delete steps. The recorder stores screenshots and text entries, and Microsoft's documentation shows how to [delete screenshots and remove text](https://learn.microsoft.com/en-us/power-automate/process-advisor-protect) before analysis.

UiPath's unassisted task mining runs in the background instead. It collects "the screenshot and log data upon each user action," such as a [mouse click or keystroke](https://docs.uipath.com/task-mining/automation-suite/2024.10/user-guide/unassisted-task-minining-introduction). Its [best-practice page](https://docs.uipath.com/task-mining/automation-suite/2024.10/user-guide/best-practices-utm) recommends 2 to 7 users per project and at least 10,000 actions before analysis, with 50,000 ideal. It says an active user produces 200 to 1,000 actions an hour.

Work that out for a small team. At 1,000 actions an hour, the 10,000-action minimum takes 10 hours of active recording; at 200, it takes 50. Each analysis also uses 5,000 of UiPath's AI Units. Our 341-action sample is about 3% of the minimum, which is why it took exact matching and a tidy routine to find anything.

## Prices start at $15 a user and jump to $5,000 a month

Here is what each option costs, from its own pages on October 20, 2026:

| Option | What it does | Price shown | Downsides |
|---|---|---|---|
| pm4py (open source) | Process mining in Python | Free under [AGPL-3.0](https://github.com/process-intelligence-solutions/pm4py); commercial license sold separately | Needs someone who writes Python; no task mining |
| Power Automate Premium | Process and task mining | [$15 a user a month](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing), paid yearly, with 50 MB of process mining data per license | Text/CSV upload [needs OneDrive for Business](https://learn.microsoft.com/en-us/power-automate/process-mining-processes-and-data) |
| Power Automate Process Mining add-on | 100 GB of process mining data | [$5,000 a tenant a month](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing), paid yearly, Premium only | Priced for large companies |
| Celonis | Process mining | [No prices published](https://www.celonis.com/pricing); a contact form for sales, free training through its Academy | No way to price it before talking to sales |
| UiPath Task Mining | Background task mining | Not listed on the documentation pages we read; 5,000 AI Units per analysis | Screenshots on every action; 10,000-action minimum |

Our 353-event sample log was 16.6 KB as a CSV. A five-person team on Premium holds 50 MB per license, so a log of that kind fits thousands of times over. Size is rarely the small team's limit. Getting a clean history out of its systems is.

## Recording screens is where the legal risk sits

Process mining logs often name the person who did each step, as ours did in its resource column. Under the GDPR that is personal data, so the usual rules apply even to a spreadsheet. Article 88 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) also lets EU member states set more specific rules for employee data, with particular regard to "monitoring systems at the work place." Check your own country's law and any collective agreement.

Task mining raises the stakes.

In 2017 the EU's Article 29 Working Party, the group of national data protection authorities that preceded today's EDPB, published its [opinion on data processing at work](https://ec.europa.eu/newsroom/article29/items/610169). It describes software that logs "keystrokes and mouse movements, screen capturing (either randomly or at set intervals), logging of applications used." Its verdict: the processing is disproportionate, and the employer "is very unlikely to have a legal ground under legitimate interest" for recording keystrokes and mouse movements. The opinion predates the GDPR, but its reasoning on consent carries over: employees "are seldom in a position to freely give, refuse or revoke consent."

The UK regulator says much the same in its guidance on [monitoring workers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers/). Consent "is not usually appropriate in the employment context, due to the imbalance of power."

Employers must tell workers about monitoring and "select the least intrusive means" for their purpose, and must carry out a data protection impact assessment before processing likely to cause high risk. The ICO's page on [monitoring methods](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/specific-data-protection-considerations-for-different-ways-or-methods-of-monitoring-workers/) adds that keystroke monitoring counts as behavioral biometric data where a worker is identifiable. Covert monitoring is unlikely to be justified "in usual circumstances." The ICO notes that the guidance is under review after the UK's Data (Use and Access) Act.

Our reading: a person choosing to record one task, then deleting what they do not want analyzed, sits far from background capture of a whole team. It is still processing of personal data, and this is not legal advice. Background screenshot capture on every click is the case both regulators describe, and a small company should expect to have to justify it in writing.

## What this means for you: mine the logs first

Most small teams should start with process mining, because it reuses data that already exists and records nobody's screen. Task mining earns its cost only when you already know which task to study and need the clicks inside it.

1. **Export one process.** Ask whoever runs your accounting, ticketing or CRM system for a CSV with three columns: case ID, activity and timestamp. Our sample of 60 cases was enough to show the main paths and the loop.
2. **Drop or replace names.** If you keep the resource column, swap people's names for roles unless you need them. You will see waits and loops without rating anyone.
3. **Run the 23 lines above,** or upload the CSV to Power Automate if your company already pays for Premium. Look at two things: the paths that loop and the step with the longest wait before it.
4. **Study one task, with one volunteer.** If a step looks slow and the log cannot say why, have the person who does it record that task themselves, or keep a [one-week tally](/articles/noticing-what-to-automate/). Tell them what is captured and who sees it. Skip background recording.
5. **Check what the delay is made of** before you build. In our sample the supplier loop added 3.4 days at the median, and most of that was waiting for the supplier, which no automation on your side shortens.

More on choosing and building the automation itself is on the [automation hub](/topics/automation/).

## Sources

- Microsoft Learn, [Prepare processes and data](https://learn.microsoft.com/en-us/power-automate/process-mining-processes-and-data) (process mining data requirements, August 31, 2026)
- Microsoft Learn, [Overview of process mining in Power Automate](https://learn.microsoft.com/en-us/power-automate/process-mining-overview)
- Microsoft Learn, [Overview of task mining](https://learn.microsoft.com/en-us/power-automate/task-mining-overview)
- Microsoft Learn, [Prepare processes and recordings](https://learn.microsoft.com/en-us/power-automate/process-advisor-processes)
- Microsoft Learn, [Protect your data](https://learn.microsoft.com/en-us/power-automate/process-advisor-protect)
- Microsoft, [Power Automate pricing](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing) (read October 20, 2026)
- UiPath documentation, [Unassisted Task Mining introduction](https://docs.uipath.com/task-mining/automation-suite/2024.10/user-guide/unassisted-task-minining-introduction) and [best practices](https://docs.uipath.com/task-mining/automation-suite/2024.10/user-guide/best-practices-utm) (Automation Suite 2024.10)
- Celonis, [pricing page](https://www.celonis.com/pricing) (read October 20, 2026)
- Process Intelligence Solutions, [pm4py on GitHub](https://github.com/process-intelligence-solutions/pm4py) (license and maintainer)
- Article 29 Data Protection Working Party, [Opinion 2/2017 on data processing at work, WP249](https://ec.europa.eu/newsroom/article29/items/610169) (June 23, 2017)
- Information Commissioner's Office, [Data protection and monitoring workers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers/) and [Specific considerations for different monitoring methods](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/specific-data-protection-considerations-for-different-ways-or-methods-of-monitoring-workers/)
- [Regulation (EU) 2016/679, the GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 88
- 28creation test, October 20, 2026: a 60-invoice event log (353 events) and a 341-action desktop log, both generated by seeded Python scripts in our sandbox, analyzed with pm4py 2.7.23.11 and pandas; the output above is copied from that run