Employee surveillance in Australia and your legal obligations

Monitoring what happens at work is lawful in Australia, but only on conditions. If you run CCTV, log internet use, track vehicles or record calls, you take on a set of obligations that overlap: state and territory surveillance laws set notice and conduct rules, listening device laws control audio, the Privacy Act 1988 (Cth) governs personal information where it applies to you, and the Fair Work framework polices how you use the data you collect.

This guide sets out who those obligations fall on, what each one requires you to do, and what happens if you miss a step. It is aimed at employers weighing up surveillance for the first time, or reviewing monitoring that has grown up informally.

Who has to comply, and when

Three factors determine which rules apply to you: where the workplace is, what you are monitoring, and whether the Privacy Act covers your business.

Where the workplace is: Two jurisdictions have dedicated workplace surveillance statutes. The Workplace Surveillance Act 2005 (NSW) applies to employers carrying out camera, computer or tracking surveillance of employees at work in NSW. The Workplace Privacy Act 2011 (ACT) applies to surveillance of workers in ACT workplaces. In every other state and territory, general surveillance devices and listening device legislation does the work instead.
What you are monitoring: Computer and internet monitoring, CCTV, GPS tracking and audio recording each carry different rules. Audio is treated the most strictly, because every jurisdiction regulates the recording of private conversations.
Whether the Privacy Act covers you: The Australian Privacy Principles (APPs) bind most private sector organisations with an annual turnover above $3 million in the previous financial year, under section 6D of the Privacy Act 1988 (Cth). Businesses at or below that threshold are small business operators and are generally outside the APPs, although some activities bring smaller businesses within the Act regardless of turnover, so it is worth confirming your position.

In practice, most employers are caught by at least one regime. Even a small business outside the APPs still has to follow the NSW or ACT workplace surveillance laws if it employs people there, and every employer that records audio must follow its local listening device legislation.

Your situation	What applies
Monitoring staff in NSW	Workplace Surveillance Act 2005 (NSW): advance notice plus conduct rules
Monitoring staff in the ACT	Workplace Privacy Act 2011 (ACT): written notice before surveillance of a worker
Recording conversations anywhere	State or territory listening device laws, which differ on consent
Annual turnover above $3 million	APPs under the Privacy Act 1988 (Cth), subject to the employee records exemption
Annual turnover of $3 million or less	Generally outside the APPs, but state and territory surveillance laws still apply

Give advance notice before monitoring starts

Notice is the first duty, and it is the one most employers get wrong. In NSW, section 10 of the Workplace Surveillance Act 2005 (NSW) provides that surveillance of an employee must not commence without prior written notice, and the notice must be given at least 14 days before the surveillance commences. An employee may agree to a shorter period. If someone is employed after surveillance is already running, or less than 14 days before it is due to start, the notice must be given before they start work.

The NSW notice must state the kind of surveillance (camera, computer or tracking), how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it will run for a limited period or indefinitely. Email counts as notice in writing, so there is no excuse for an informal rollout.

NSW adds conduct requirements on top of the notice itself:

Camera surveillance: cameras must be clearly visible, and signs notifying people that they may be under surveillance must be clearly visible at each entrance to the area.
Computer surveillance: computer surveillance must be carried out under a written policy of the employer, and the employee must have been notified of that policy in advance, in a way that makes it reasonable to assume they are aware of and understand it.
Tracking surveillance: if a vehicle or other thing is tracked, a notice must be clearly visible on the vehicle or thing itself.

In the ACT, the Workplace Privacy Act 2011 (ACT) takes a similar approach. Section 13 provides that an employer may only conduct surveillance of a worker in a workplace if written notice is given to the worker, and the Act also imposes consultation obligations before surveillance is introduced. Note that the ACT Act protects workers, a broader category than employees.

Surveillance that does not comply with the NSW notice rules is treated as covert surveillance, and covert surveillance is an offence unless it is authorised by a covert surveillance authority. That classification matters: it is not a technicality, it is what turns a well-intentioned monitoring program into a criminal offence.

Audio is where employers most often trip over. Every state and territory regulates the recording of private conversations through listening device legislation, and the rules are not uniform.

In NSW, section 7 of the Surveillance Devices Act 2007 (NSW) prohibits using a listening device to record a private conversation to which you are a party. That means all parties to the conversation must consent to the recording, including the person on the other end of a customer service call. The maximum penalty is 500 penalty units for a corporation, or 100 penalty units and up to five years imprisonment for an individual.

The position differs across jurisdictions. Some states take the same all-party consent approach as NSW, while others allow a participant to record a conversation in limited circumstances, and most have exceptions for matters such as protecting a person's lawful interests. There is no national rule, so a recording practice that is lawful in one state can be an offence in another. If your business records calls in several states, your approach needs to be mapped jurisdiction by jurisdiction.

The practical steps that reduce risk are straightforward:

Use pre-call announcements so participants know a call is being recorded and can choose whether to continue.
Use on-screen prompts for video meetings, and give participants a way to opt out.
Reconsider audio on CCTV. If your cameras do not need to capture sound, disabling audio capture avoids the listening device regime altogether.
Store and use recordings only for the purpose disclosed, and restrict access to those who need it.

Respect the Privacy Act where it applies

For employers covered by the APPs, surveillance data is personal information, and the APPs impose duties of transparency, limited collection, secure storage and access. The most misunderstood part of this is the employee records exemption.

Section 7B(3) of the Privacy Act 1988 (Cth) exempts an act or practice of an employer if it is directly related to a current or former employment relationship and to an employee record held by the organisation relating to the individual. The exemption is real, but it is narrower than it sounds:

It only covers current and former employees: Job applicants, contractors and labour hire workers have no employment relationship with you, so their information is not exempt.
It only covers employee records: CCTV footage of customers, call recordings involving third parties, and data captured incidentally about people other than the employee do not fall within it.
It only covers acts directly related to the employment relationship: Using surveillance data for an unrelated purpose takes you outside the exemption.
It does not override state laws: The exemption operates only within the Privacy Act; it does not excuse non-compliance with the NSW or ACT workplace surveillance statutes or listening device laws.

The safe approach is to treat the exemption as a limited carve-out rather than a free pass. Even where it applies, running your monitoring on APP-style principles, clear notices, minimal collection, access rights and secure storage, reduces disputes and keeps you compliant for the information the exemption does not cover.

Use surveillance data fairly in employment decisions

How you use surveillance data matters as much as how you collect it. Evidence gathered without notice, or applied inconsistently, can be challenged in proceedings under the Fair Work Act 2009 (Cth), including unfair dismissal claims and adverse action claims. A dismissal based on surveillance footage will be scrutinised for whether the employee knew the monitoring was happening and whether the process gave them a fair chance to respond.

There are also hard limits on what you can monitor. In NSW, section 16 of the Workplace Surveillance Act 2005 (NSW) prohibits using a work surveillance device to monitor an employee while they are not at work, with a narrow exception for computer surveillance of equipment the employer provides. Employees who work remotely still have private lives, and their off-duty activity is not yours to watch.

Work health and safety duties can justify monitoring, for example lone worker tracking or cameras in high-risk areas. But WHS obligations do not override the surveillance and privacy laws. A safety purpose explains why monitoring exists; it does not remove the need for notice, consent where required, and proportionality.

The cost of getting it wrong

The consequences of non-compliance are real, and in some jurisdictions they are criminal. The verified exposure includes:

NSW covert surveillance: carrying out covert surveillance of an employee without a covert surveillance authority is an offence under section 19 of the Workplace Surveillance Act 2005 (NSW), with a maximum penalty of 50 penalty units. Surveillance that starts without the required notice is treated as covert.
NSW off-duty monitoring: monitoring an employee with a work surveillance device while they are not at work carries the same 50 penalty unit maximum under section 16.
NSW unlawful audio recording: recording a private conversation without consent under section 7 of the Surveillance Devices Act 2007 (NSW) carries up to 500 penalty units for a corporation.
Privacy breaches: where the APPs apply, the Office of the Australian Information Commissioner can investigate complaints and seek civil penalties for serious or repeated interferences with privacy.
Employment remedies: an unfair dismissal or adverse action finding can lead to reinstatement, compensation or penalties, and surveillance evidence collected unfairly may be excluded or given little weight.

Beyond the legal exposure sits the reputational cost. Staff who discover they have been monitored without notice lose trust quickly, and that damage is not remedied by a compliance fix later.

A compliance checklist for your rollout

If you are introducing or updating monitoring, work through this list:

Confirm which laws apply to each state or territory where you employ people, and to each monitoring method you plan to use.
Identify the purpose for each form of monitoring, and choose the least intrusive method that reasonably achieves it.
Give written notice at least 14 days before surveillance commences in NSW, and follow the ACT notice and consultation requirements where they apply.
Satisfy the NSW conduct rules: visible cameras, entry signage, a notified computer surveillance policy, and visible notices on tracked vehicles.
Check the consent position for audio in each jurisdiction where you record calls or meetings, and put announcements or prompts in place.
Draft a workplace surveillance policy that sets out what is monitored, how, when, who can access the data, and how long it is kept.
Align your privacy policy with your monitoring practices if the APPs apply, and cover any data stored or processed offshore.
Restrict access to surveillance data, keep audit logs, and set documented retention periods.
Apply the rules consistently across all staff, and link any consequences for misuse to your disciplinary process.

When a lawyer should be involved

A lawyer's role in this area is mostly preventive. A practitioner can map the surveillance and listening device laws across the states where you operate, which is where most errors start. They can draft the notice, the workplace surveillance policy and the computer surveillance policy, and check that your employment contracts and privacy policy line up with what you are actually doing. If genuinely justified, they can also advise on the covert surveillance authority process in NSW, which is a narrow and formal pathway rather than something to improvise.

If a dispute has already arisen, a lawyer can respond to an OAIC complaint, defend a dismissal decision that relies on surveillance evidence, or advise on a regulator's investigation. Getting the groundwork right first is cheaper than defending a claim later.

Start with the notice, then audit what you already monitor

The obligation that costs employers most is the one that is easiest to satisfy: advance written notice. Monitoring that began informally, for example cameras installed for a COVID-era return to work or productivity software rolled out for remote teams, often has no notice behind it at all. In NSW that means the surveillance is legally covert, and every day it continues is a day of exposure.

The first step this week is an audit. List every camera, tracking device, logging tool and recording system you run, then ask whether each one had notice given to the affected staff before it started. If the answer is no, stop the surveillance or give the notice and wait out the 14 days before switching it back on. That single fix removes the most serious exposure in this area, and it is entirely within your control.