Security camera compliance for Australian businesses

You've just installed a CCTV system — or you're about to. The cameras are up, the footage is recording, and the system looks exactly like the ones every other business on the street uses. But in Australia, how you deploy, manage, and disclose that system is regulated by a patchwork of federal and state laws, and "everyone else does it" is not a defence when something goes wrong.

Where you can point cameras — and where you can't

The law draws a clear line around spaces where people have a reasonable expectation of privacy. Cross that line and you may face a criminal offence under your state's surveillance devices legislation, not just a privacy complaint.

Areas that are generally fine:

Customer-facing areas: shop floors, reception, entry and exit points, car parks
Back-of-house operational areas (loading docks, stock rooms, cash-handling areas) where staff have been properly notified
Building perimeter and access points

Areas that are off-limits or very high risk:

Bathrooms, change rooms, shower facilities — prohibited in virtually every state and territory
Spaces where a reasonable expectation of privacy exists: prayer rooms, first aid rooms, medical consultation spaces
Meeting rooms or private offices where sensitive audio could be captured, without a clear lawful basis

Staff break rooms sit in a grey zone. There is no blanket national prohibition, but many jurisdictions impose restrictions on monitoring employees in non-public areas, and capturing audio in a break room raises separate risks under listening device laws (see below). If you believe you have a genuine security need for a break-room camera, get specific advice before installing it.

What the law actually requires from you

Australian security camera law sits across three overlapping frameworks.

State and territory surveillance devices legislation governs what you can physically do with cameras and recording devices. In NSW, the Surveillance Devices Act 2007 (NSW) is the principal instrument. Other states and territories have their own equivalents: Victoria has the Surveillance Devices Act 1999 (Vic), Queensland the Invasion of Privacy Act 1971 (Qld), South Australia the Surveillance Devices Act 2016 (SA), and Tasmania the Listening Devices Act 1991 (Tas). These laws restrict when private conversations can be recorded and create offences for unlawful use of optical and listening devices.

Workplace surveillance legislation goes further in some jurisdictions. In NSW, the Workplace Surveillance Act 2005 (NSW) imposes specific obligations on employers who use cameras to monitor staff. In the ACT, the equivalent is the Workplace Privacy Act 2011 (ACT). No comparable dedicated legislation exists in most other states, though the general surveillance device laws still apply.

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply when your business collects personal information — which CCTV footage of identifiable individuals clearly is. If your business has an annual turnover above $3 million, or falls into a category that is covered regardless of turnover (such as a private health service provider, or a business that trades in personal information), you have binding obligations under the APPs. The $3 million small business exemption is still in force as of mid-2026, though the Australian Government has confirmed it is working on a second tranche of Privacy Act reforms that would remove it — so even businesses currently exempt would be wise to prepare.

Employee surveillance: the notice rules in NSW and the ACT

If you operate in NSW and your cameras will monitor employees, the Workplace Surveillance Act 2005 (NSW) applies. The key obligations:

Written notice required. Before camera surveillance of an employee commences, the employer must give the employee written notice. Under s 10, the notice must be given at least 14 days before surveillance starts, unless the employee agrees to a shorter period.
New employees. If surveillance is already in place when someone starts work, the notice must be given before they begin — not after.
Visible cameras and signage. Under s 11, cameras must be clearly visible in the monitored space, and signs notifying people that they may be under camera surveillance must be clearly visible at each entrance to that area. Covert camera surveillance of employees is prohibited except under a covert surveillance authority issued by a magistrate.
Prohibited areas. The Act prohibits surveillance of employees in change rooms, toilet facilities, shower areas and other bathing facilities at a workplace.

In the ACT, the Workplace Privacy Act 2011 (ACT) imposes comparable requirements. If you operate in other states, there is no equivalent dedicated workplace surveillance statute, but general surveillance device laws still apply and best practice dictates providing written notice and visible signage regardless.

Audio is a separate and stricter problem

Every state and territory regulates the use of listening devices to record private conversations, and the rules are meaningfully different from those that govern video-only cameras.

In NSW, s 7 of the Surveillance Devices Act 2007 (NSW) prohibits a person from knowingly using a listening device to record a private conversation to which they are a party, unless a specific exception applies — for example, all parties consent, or the recording is reasonably necessary to protect a lawful interest. Recording a private conversation without consent where none of those exceptions applies is a criminal offence carrying significant penalties.

Victoria's Surveillance Devices Act 1999 (Vic) requires the express or implied consent of each party before a listening device can be used to record a private conversation. Queensland's Invasion of Privacy Act 1971 (Qld) takes a similar approach.

The practical upshot: disable the microphone on any CCTV system unless you have a specific legal basis and a clear consent process. Audio-capable cameras, body-worn cameras, dashcams with audio, and any device with a built-in microphone all engage listening device laws — not just purpose-built recording equipment. Get advice specific to your state before enabling audio capture.

For video-only cameras monitoring customer-facing areas, clear and prominent signage is generally sufficient to put visitors on notice. There is no requirement to obtain individual written consent from every customer who enters a monitored space.

Good signage practice:

Place signs at every entry point before people commit to entering
State the purpose plainly: for example, "CCTV in operation for security and loss prevention"
Make signs large enough to read without stopping
Walk your premises from a first-time visitor's perspective to check visibility

Where cameras might capture areas outside your property boundary — neighbouring premises, public footpaths, private homes — minimise that capture where possible. Capturing the private property of others without a lawful basis raises both privacy and potential nuisance concerns.

Footage is personal information — treat it that way

CCTV footage of a person whose identity can reasonably be determined is personal information for the purposes of the Privacy Act 1988 (Cth). If the Privacy Act covers your business, APP 11 requires you to take reasonable steps to protect that information from misuse, loss, and unauthorised access — and to destroy or de-identify it when it is no longer needed.

Even if you currently fall under the $3 million turnover threshold, applying APP-style discipline to your footage is sound risk management given the direction of reform and the practical value of clear policies.

Retention. Set a defined retention period tied to your genuine business needs — for example, 30 days for general coverage, extended only when footage is relevant to a specific incident under investigation. Indefinite retention "just in case" increases exposure and is inconsistent with the destruction obligations under APP 11.

Access controls. Limit who can view live feeds and retrieve archived footage. Log every access: who viewed it, when, and why.

Storage security. Use encryption where available, keep systems patched, and restrict remote access. If a third party installs, monitors, or stores your footage, include confidentiality, security, and breach-notification obligations in the contract.

Privacy Policy. If the Privacy Act applies to you, your Privacy Policy should explain what CCTV footage you collect, why you collect it, how long you keep it, and who you may disclose it to.

Responding to access requests and law enforcement

Individual access requests. A person may request access to footage in which they appear. If the Privacy Act applies, APP 12 entitles individuals to access their personal information unless an exception applies — for example, disclosure would unreasonably affect another person's privacy, or the footage relates to an ongoing investigation. Common responses include providing a copy, offering a view-only session, or declining with written reasons. Have a documented process and train the staff who would receive such requests.

Police and regulator requests. Law enforcement can request footage, but a request alone is not authority to hand it over. You may disclose footage where required by law — for example, under a warrant, court order, or statutory notice — and in some cases where permitted by law, such as voluntarily assisting an investigation where the Privacy Act allows it. Confirm the requester's identity and authority, check the scope of what is asked for, provide only what is covered, and keep a record of what you disclosed and on what basis. If you are uncertain, seek legal advice before disclosing.

The documents your system needs

A compliant CCTV setup is supported by written records, not just hardware. The documents most businesses need:

Workplace Surveillance or CCTV Policy. Covers where cameras operate, what they are used for, who can access footage, retention periods, and the process for individual access requests. In NSW and the ACT, this policy (or the written notice to employees) must exist before surveillance starts.
Privacy Policy update. If the Privacy Act applies, your policy should address CCTV footage as a category of personal information collected.
Data Breach Response Plan. Sets out what happens if footage is accessed without authorisation or a storage system is compromised, including escalation steps and notification obligations.
Vendor contracts. If a third party supplies, maintains, or stores footage, ensure the contract specifies security standards, access restrictions, breach notification timeframes, and data-return or deletion on termination.

How Artificer Legal can help

A security camera system that works legally is one that has been designed with legal advice, not retrofitted with it after a complaint lands. The areas where a practitioner adds the most value are:

Reviewing your setup against the specific laws of your state or territory — the obligations in NSW are different from those in Victoria or Queensland, and a generic checklist won't catch the distinctions
Drafting the written notice for employees in NSW or the ACT in the form the legislation requires, so you are not exposed if a surveillance dispute arises
Updating your Privacy Policy and CCTV policy to reflect what your system actually does, who can access it, and how long footage is held
Reviewing vendor contracts to ensure security, confidentiality and breach-notification obligations are enforceable and appropriate for the sensitivity of the footage
Advising on audio if you are considering enabling microphones on any device — this is the highest-risk part of any surveillance setup and the one most likely to create criminal exposure without specific legal advice

The audio recording risk

The single most common compliance failure in CCTV is not the camera placement — it is the audio. Businesses install systems with microphones enabled by default, often without realising it, and do not appreciate that recording a private conversation engages criminal offences under state surveillance device legislation rather than merely a privacy complaint. The penalties are not administrative. Disable audio unless you have taken specific advice for your jurisdiction and have a lawful basis to proceed.

Security cameras are legal and useful for Australian businesses when deployed thoughtfully. The framework across federal privacy law and state surveillance device legislation is navigable — but it rewards businesses that design their system with the rules in mind, provide clear written notice to staff, put proper signage in place for customers, treat footage as the personal data it is, and have the right documents backing everything up.