Workplace monitoring in Australia and the legal obligations for employers

Monitoring your workplace is not illegal in Australia, but running it without following the rules that attach to it is a different story. Employers who install CCTV, track company vehicles, review internet use or record calls take on a set of legal obligations: they must give staff proper notice, meet state surveillance and consent requirements, keep monitoring out of private areas, handle the resulting data carefully, and use what they collect fairly in employment decisions. Get those steps right and monitoring is a legitimate protection tool. Skip them and the same cameras and logs become the basis for penalties, complaints and claims.

This guide sets out who each of those obligations applies to, what the law actually requires, and the consequences of getting it wrong, so you can check your own setup against a verified picture of the rules.

Who the workplace monitoring rules apply to

There is no single national workplace monitoring law. Legality depends on a patchwork of state surveillance statutes, the Privacy Act 1988 (Cth), and employment law, and the rules that bite depend on where you operate, what you monitor and who you monitor.

Start with your state. NSW is the only state with a dedicated workplace surveillance statute: the Workplace Surveillance Act 2005 (NSW) regulates camera, computer and tracking surveillance of employees, and it applies to every employer in the state regardless of size. Its companion, the Surveillance Devices Act 2007 (NSW), co-applies: the note to s 3 makes clear that both Acts must be complied with where camera surveillance is carried out. Elsewhere, monitoring is regulated through general surveillance device and listening device legislation, privacy laws and employment law, and the consent requirements can differ sharply from state to state.

The Privacy Act 1988 (Cth) only reaches some businesses. Under s 6D, a business is a small business exempt from the Australian Privacy Principles if its annual turnover was $3 million or less in the previous financial year, unless an exception applies: health service providers that hold health information, businesses that trade in personal information for a benefit, and credit reporting bodies are in scope regardless of turnover. Even for covered businesses, the employee records exemption in s 7B(3) exempts handling of employee records that is directly related to a current or former employment relationship. That exemption is narrow, does not sweep in everything monitoring produces, and does not touch state surveillance law at all.

Two things follow from the thresholds. First, the turnover test is about the business, not the tool: a $2 million retailer with CCTV is still outside the Privacy Act, while a $4 million one is inside it, and a medical clinic of any size is inside it because it holds health information. Second, a new federal statutory cause of action for serious invasion of privacy now sits in the Privacy Act. Under s 7, an individual can sue where their privacy was invaded by intrusion upon seclusion or misuse of information, the invasion was intentional or reckless and serious, and they had a reasonable expectation of privacy in all the circumstances. Consent and lawful-authority defences apply. The cause of action is new and largely untested in workplaces, but it means even monitoring that clears the surveillance statutes can still be challenged.

Give proper notice before you start monitoring

This is the obligation employers most often get backwards. Notice is not something you give when you announce a new policy; in NSW it must come before the surveillance starts.

Section 10 of the Workplace Surveillance Act 2005 (NSW) requires written notice at least 14 days before surveillance of an employee commences. The notice must state the kind of surveillance (camera, computer or tracking), how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it is for a limited period or ongoing. Email counts as writing. An employee can agree to a shorter period, and an employee hired after surveillance is already running must receive notice before they start work. One carve-out exists: no notice is required for camera surveillance at a workplace that is not the employee's usual workplace, such as a one-off site visit.

Notice in writing is not the whole story. Under s 11, camera surveillance also requires that the cameras themselves are clearly visible and that signs notifying people they may be under surveillance are clearly visible at each entrance to the area. Under s 13, tracking surveillance of a vehicle or other thing requires a notice clearly visible on the vehicle itself. Section 14 provides a practical alternative: surveillance is treated as compliant if employees, or a body representing a substantial number of them, have agreed to the surveillance for a non-surveillance purpose and it is carried out in accordance with that agreement.

Outside NSW there is no identical 14-day rule, and some states impose no workplace-specific notice regime at all. But notice remains the single best risk-reduction step available: employment contracts that flag monitoring, a policy employees acknowledge, signage and system prompts all go to whether staff had a reasonable expectation of privacy, which is the question that matters in privacy claims, disciplinary disputes and the new statutory tort.

Audio is the highest-risk form of monitoring because every state regulates the recording of private conversations through listening device or surveillance device legislation, and the consent rules differ. NSW is a useful example of how strict the baseline can be.

Section 7 of the Surveillance Devices Act 2007 (NSW) prohibits using a listening device to overhear, record or monitor a private conversation to which you are not a party, and also prohibits recording a private conversation to which you are a party. In other words, in NSW you cannot simply record a conversation you are part of; you need an applicable exception such as a warrant, consent or unintentional capture. The maximum penalty is 500 penalty units for a corporation and 100 penalty units or five years' imprisonment for an individual. Penalty units are the standardised fine measure in NSW legislation, so these are serious figures, not parking fines.

The phrase "this call may be recorded" is common, but it is not a universal solution. It works best for customer calls where the parties are told and can choose to continue. It does less work for internal conversations between employees, where the consent requirements of the relevant state may not be met simply by a system prompt, and where recordings are later used for a purpose beyond the one disclosed. In some states the consent rules are stricter still. If you record calls, know the state law for every location where the call takes place, not just where your office is.

Keep surveillance overt and out of private areas

NSW draws a bright line at covert surveillance. Section 19 of the Workplace Surveillance Act 2005 (NSW) makes it an offence to carry out covert surveillance of an employee at work unless it is authorised by a covert surveillance authority, a limited process for investigating suspected unlawful activity rather than a general licence to spy. The maximum penalty is 50 penalty units. For everyday monitoring, there is no such thing as a quiet rollout: if you would not tell staff about it, it is probably covert, and in NSW that is an offence.

The same logic applies to place. Cameras in bathrooms, change rooms and other areas where people reasonably expect privacy are the classic failure, and they are high-risk under state surveillance law, privacy principles and the new tort alike. Even break rooms, wellbeing rooms and quiet areas used for private calls deserve caution. The question to ask before installing any camera is whether a reasonable person in that place would expect to be observed. If the answer is no, do not install it, regardless of what the signage says.

Treat monitoring data as sensitive business information

Once you collect footage, logs or recordings, you take on obligations about what happens to them. Section 18 of the Workplace Surveillance Act 2005 (NSW) restricts use and disclosure of surveillance records from notified surveillance to legitimate employment or business purposes, disclosure to law enforcement, use in civil or criminal proceedings, or averting an imminent threat of serious violence or substantial property damage. Breaching the limit carries a maximum penalty of 20 penalty units.

If your business is covered by the Privacy Act 1988 (Cth), the Australian Privacy Principles add collection, use, storage, access and retention obligations over the personal information your monitoring captures. The employee records exemption in s 7B(3) is real but limited: it covers records directly related to the employment relationship, and it does not cover contractors or remove your obligations under state surveillance law. Practical safeguards apply to everyone: restrict access to those who genuinely need it, secure the storage, set retention and deletion rules, and have a way to respond to requests and complaints. Monitoring data that reveals health details, family circumstances or private conduct is exactly the material that turns an ordinary dispute into a privacy complaint.

Use monitoring results fairly in employment decisions

Monitoring is often the evidence in a performance or disciplinary process, and that is where employment law bites. A dismissal based on surveillance footage can be challenged as unfair dismissal on the ground that it was harsh, unjust or unreasonable, and decisions driven by monitoring can also attract general protections claims for adverse action if the real reason was a protected attribute or right. The surveillance itself is only part of the picture: a fair process, clear expectations set out in advance, and consistent application across staff are what make monitoring-based decisions defensible.

That means monitoring only some employees, switching monitoring on when a conflict arises, or using footage to micromanage rather than manage genuine risk are the patterns that turn lawful monitoring into an unlawful process. If you need extra monitoring for a suspected breach, document the reason, keep it limited to what is necessary, and tell the employee.

What happens if you get it wrong

The consequences sit at three levels. Under NSW law, the headline penalties are the 500 penalty units for corporations and 100 penalty units or five years' imprisonment for individuals under s 7 of the Surveillance Devices Act 2007 (NSW) for unlawful recording, 50 penalty units for covert surveillance, and 20 penalty units for improper use or disclosure of surveillance records under the Workplace Surveillance Act 2005 (NSW).

Then there are the civil routes. Employees can pursue unfair dismissal and general protections claims where monitoring feeds a dismissal, with compensation and reinstatement on the table. If your business is covered by the Privacy Act, an employee or customer can complain to the Office of the Australian Information Commissioner about how monitoring data was handled, and the Commissioner can investigate and make enforceable determinations. The new serious invasion of privacy cause of action adds a further avenue for damages where monitoring intruded on seclusion or misused information. Finally there is the practical cost: staff who discover hidden monitoring lose trust quickly, and in a dispute the fact that monitoring was secret or disproportionate tends to colour everything else.

A workplace monitoring compliance checklist

Run through this checklist against each monitoring tool you operate:

Notice: Did you give written notice at least 14 days before monitoring started, stating the kind, method, timing and duration of the surveillance (NSW), and is notice in place for every new hire?
Signage and visibility: Are cameras clearly visible and signs displayed at each entrance (NSW s 11), and is any vehicle tracking marked on the vehicle (NSW s 13)?
Audio: Do you know the listening device rules in every state where calls are recorded, and can you point to the consent or exception that makes each recording lawful?
No covert surveillance: Is all monitoring overt, documented and known to staff, rather than quiet?
Private areas: Are there no cameras or listening devices in bathrooms, change rooms, break rooms or other places where privacy is reasonably expected?
Data handling: Is access restricted, storage secure, and retention and deletion documented, and are use and disclosure limited to legitimate employment and business purposes?
Policies: Is monitoring covered in your employment contracts, an acknowledged policy and system prompts, and are the rules applied consistently?
Fair process: If monitoring results are used in performance or disciplinary decisions, is there a documented, fair process that does not single people out?

When you need a lawyer for workplace monitoring

A lawyer's role here is to close the gaps between what you do and what the rules require. A practitioner can audit your current monitoring against the state surveillance statutes and the Privacy Act thresholds, draft the notice, monitoring policy and contract clauses that make monitoring transparent, advise on the state-by-state consent rules for call recording and GPS tracking, and help with the harder calls: biometrics, facial recognition and any proposal that touches highly private areas or covert elements. If monitoring has already produced a dismissal or a complaint, a lawyer can assess whether the process and the evidence will survive scrutiny. Monitoring is an area where the cost of advice before rollout is small compared with the cost of defending a claim after the fact.

The 14-day clock starts before you switch anything on

The obligation employers miss most is the sequence. Notice is not a document you backdate when someone asks; in NSW it is a written notice that must reach employees at least 14 days before surveillance commences, and that period cannot be manufactured after the cameras are already recording. If you are planning monitoring, or have rolled it out informally, the first step is to work out what is actually being collected today, then either give the required notice before continuing or pause the monitoring until the paperwork is right. Consent for audio and notice for everything else are the two rules that separate a defensible monitoring setup from a liability. If you cannot say, for each tool, what notice was given, what consent applies and where the data lives, that is the gap to close first.