Vicarious liability for Australian businesses and the duties that come with employees

If you employ people in Australia, the law can hold your business responsible for wrongful acts your employees commit while doing their jobs, even when you did not authorise the act and knew nothing about it. This is vicarious liability, and it is one of the few areas of law where a business can owe compensation for harm it did not cause and could not easily have prevented.

Vicarious liability is not a single statutory duty. It is a common law rule that makes employers answerable for their employees' wrongs, sitting alongside supporting duties under consumer, work health and safety and privacy laws. Knowing who the rule catches, what standard a court applies and which supporting duties you owe is the difference between defending a claim on the facts and paying out on a claim you never saw coming.

This guide covers:

• who vicarious liability applies to, and the line between employees and independent contractors
• the course of employment standard a court applies
• the supporting duties around sales conduct, workplace safety and customer data
• the consequences of getting it wrong, and a compliance checklist you can act on

Who the obligation falls on: employees, not independent contractors

Vicarious liability has two limbs. The wrongdoer must be an employee of the business, and the wrongful act must have been committed in the course or scope of employment. Both must be present, and the person harmed must have suffered loss because of the act.

The first limb turns on the real character of the working relationship, not the label on the agreement. In Hollis v Vabu Pty Ltd [2001] HCA 44, the High Court held that bicycle couriers who wore Crisis Couriers uniforms, had work allocated to them by a fleet controller and had their pay rates set by the company were employees, even though they were engaged under arrangements that looked like independent contracting. When an unidentified courier knocked down a pedestrian and rode off, the company was vicariously liable for the injuries. The label on the paperwork did not save it.

A genuinely independent contractor is usually outside vicarious liability. In Sweeney v Boylan Nominees Pty Ltd [2006] HCA 19, the High Court held that a refrigeration mechanic called in to work on a cool room was an independent contractor, and the business was not vicariously liable for his negligence.

Where a comprehensive written contract records the relationship, the High Court has said the terms of that contract generally determine whether a worker is an employee or contractor, unless the contract is a sham or otherwise ineffective: Construction, Forestry, Maritime, Mining and Energy Union v Personnel Contracting Pty Ltd [2022] HCA 1 and ZG Operations Australia Pty Ltd v Jamsek [2022] HCA 2. That makes the drafting of the engagement agreement genuinely important, but it does not allow you to contract around reality. Under s 357 of the Fair Work Act 2009 (Cth), it is unlawful to misrepresent an employment relationship as an independent contracting arrangement, and the Fair Work Ombudsman treats sham contracting as a priority.

The practical point: if someone works under your direction, uses your equipment, wears your branding and cannot refuse work, a court may well decide they are an employee whatever the agreement says, and every wrongful act they commit in the course of the work becomes your exposure.

The standard: the wrongful act must be in the course of employment

For an employer to be vicariously liable, the common law requires that the employee's wrongful act be committed in the course or scope of employment. That is the essential requirement, restated by the High Court in CCIG Investments Pty Ltd v Schokman [2023] HCA 21 and Prince Alfred College Inc v ADC [2016] HCA 37.

The test is whether the act has a sufficiently strong connection with what the employee was employed to do. The act does not need to be authorised. An unauthorised, intentional or even criminal act can still be in the course of employment if it is an improper mode of doing what the employee was employed to do. What takes an act outside the rule is conduct that is effectively the employee's own private venture: a traditional "frolic of their own", or an act so remote from the job that the employee was, in effect, a stranger to the business when they did it.

Where the wrongful act is intentional, courts also ask whether the role the employer gave the employee placed them in a special position of power, intimacy or trust over the victim, and whether the wrongdoing was so connected to that role that it is fair to hold the employer liable. That approach, from Prince Alfred College, explains why employers can be liable for deliberate wrongdoing by staff in roles that put them in authority over customers, clients or residents.

Schokman shows the boundary being drawn the other way. An employee at Daydream Island Resort shared staff accommodation with a colleague, as his contract required. One night the intoxicated colleague urinated on him while he slept, triggering a cataplectic attack. The High Court held the employer was not vicariously liable: the drunken act was not connected to anything the colleague was employed to do, and the shared accommodation, although a term of the employment, did not make the act one committed in the course of employment. The lesson for businesses is that the connection question turns on what the person was employed to do, not on where the incident happened or whether the workplace created the opportunity.

Duty 1: keep staff representations to customers honest

Your employees' words are your words for consumer law purposes. Section 18 of the Australian Consumer Law (the ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), prohibits misleading or deceptive conduct in trade or commerce. When a salesperson overpromises a product's performance, promises a refund the business will not honour or quotes a price the business cannot deliver, that conduct is attributed to the business. Under s 139B of the Competition and Consumer Act, the conduct of an employee acting within their actual or apparent authority is taken to be the conduct of the body corporate.

This means the standard you must meet is not simply "we told staff not to do that". The business is exposed by what staff actually say to customers, whether in sales calls, on site visits or in marketing they approve. Align sales scripts and marketing with what the product or service genuinely does, set clear authority limits for discounts, warranties and refunds, and train staff on what they may promise. The remedies for misleading conduct include damages, so a pattern of overpromising can produce claims the business must fund.

Duty 2: provide a safe workplace

Under the Work Health and Safety Act 2011 (NSW), and equivalent laws in every other state and territory, a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers and of other people who may be put at risk by the work. That duty covers the work environment, plant and structures, systems of work, and the safe use, handling and storage of substances.

Officers of the business carry their own personal duty to exercise due diligence to ensure the business complies. A director who ignores known safety issues is not protected by the company structure, and can be prosecuted personally.

The penalties are not theoretical. In NSW, a body corporate that commits a Category 1 offence, involving gross negligence or recklessness that exposes a person to a risk of death or serious injury, faces a maximum penalty of 90,424 penalty units, more than $9 million. Category 2 and Category 3 maximums are 18,128 and 6,070 penalty units respectively, and individuals can face imprisonment for the most serious offences. Separately, unsafe conduct that injures a customer or worker can found a negligence claim, and courts assessing an employer's duty of care look directly at whether training, supervision and safe systems were in place.

Duty 3: protect the personal information your staff handle

Most small businesses hold customer data, and staff handle it every day. Australian Privacy Principle 11 under the Privacy Act 1988 (Cth) requires an entity that holds personal information to take such steps as are reasonable in the circumstances to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. The same principle requires the information to be destroyed or de-identified once it is no longer needed.

That is a reasonable-steps standard, and regulators assess it against what the business actually did: access controls, password and device policies, secure storage, staff training and clear rules about sending customer information outside the business. A salesperson who emails a customer list to a personal account, or a support agent who shares customer details without checking the caller's identity, can put the business in breach and trigger an investigation by the Office of the Australian Information Commissioner. Serious or repeated interference with privacy attracts substantial civil penalties, so a careless data culture is a genuine liability risk.

The governance that makes the duties manageable

For each of the duties above, the practical work is the same: put the standard in writing, tell people about it, supervise it and keep records. A workplace policy covering conduct, discrimination, harassment, safety, use of company equipment and data handling turns an abstract legal standard into something an employee can follow and an employer can enforce. An employment contract that sets out duties, authority limits, confidentiality and compliance obligations draws the line between permitted and unacceptable conduct. A contractors agreement that records scope, safety obligations, insurances and compliance expectations helps preserve a genuinely independent contracting relationship.

Training matters as much as documentation. Induction for new staff, refresher training when products or rules change, and regular supervision in the field are the evidence a court or regulator will look at when deciding whether the business took reasonable steps. Keep attendance records, incident reports and complaint files. When something goes wrong, act quickly and document the response: prompt corrective action is both good risk management and evidence of reasonable care.

Insurance is a backstop, not a substitute. Public liability, professional indemnity and management liability policies can respond to claims, but they carry exclusions, and most policies require prompt notification of any incident that might give rise to a claim. Notify your insurer early and check the policy wording before you need it.

What happens if you get it wrong

The costs are real. In Hollis v Vabu, the pedestrian recovered $176,313 in damages from a courier company for the negligence of an employee the company could not even identify, plus costs. A single misleading statement by a salesperson can found an ACL damages claim against the business. A WHS Category 1 breach can expose the company to fines in the millions, and its officers to personal liability. On top of the money, a finding of vicarious liability, or a regulator investigating how staff behaved, is reputational damage that affects customers, insurers and future hires.

Vicarious liability is also fault-free. The point of the rule is that the employer pays even though it did nothing wrong. "I didn't authorise it" and "I didn't know about it" are not defences. That is why the prevention work, policies, training, supervision and the right engagement structures matter more than after-the-event argument.

A practical compliance checklist

Work through the list in order, and keep a written record of each step so you can show a court or regulator what you did:

• Classify your workers: review every person who does work for you and decide, on the real relationship, whether they are an employee or an independent contractor, and document the basis for the decision.
• Write the standards down: employment contracts, a staff handbook, workplace policies covering conduct, safety, data and social media, and tailored contractors agreements.
• Train and refresh: induction for new staff, refresher training on sales claims, safety and data handling, with attendance records.
• Supervise in practice: ride-alongs, call reviews and checklists for high-risk tasks such as discounts, warranties and refunds.
• Guard the data: access controls, secure storage, clear rules on sharing customer information, and a retention and deletion process.
• Insure and notify: check public liability, professional indemnity and management liability cover, understand the exclusions, and notify the insurer promptly after any incident.
• Respond to incidents: stabilise, preserve evidence, notify, investigate and remediate, and keep a written record of each step.

Where a lawyer actually helps

Most of this can be done by a well-organised business, but the points of maximum risk are exactly where a lawyer adds value. A lawyer can assess whether a particular working arrangement is genuinely independent contracting, taking into account the contract, the recent High Court decisions and the way the relationship operates in practice. A lawyer can draft or review the contracts, policies and handbooks so they reflect the standards the law actually applies. And if an incident occurs, a lawyer can guide the response: what to preserve, what to tell the insurer, what to say to the regulator and how to run an investigation that will stand up to scrutiny. In a vicarious liability claim, the quality of your documentation and the reasonableness of your response are often the difference between a settlement and a defended win.

The classification question that decides most claims

Most vicarious liability exposure traces back to one decision: how you engage the people who do the work, and what you actually let them do. The two false comforts that cost businesses most are the contractor label on an employment-shaped relationship, and the belief that not knowing about an act means not being responsible for it. A court asks different questions: what was this person employed to do, and how closely connected was the wrongful act to that role?

You can answer both questions about your own business this week. Look at every person who works for you. If the answer is that they are effectively employees, make sure your contracts, policies, training and insurance reflect that reality. If they are genuinely independent, make sure the agreement and the day-to-day practice keep them that way. That audit, done now, is the most direct way to keep vicarious liability a doctrine you understand rather than a claim you defend.