Workplace surveillance in Australia — what to do when you've skipped the legal steps

A warehouse manager installs a new GPS tracker on the delivery fleet on Monday. By Friday, two drivers have lodged complaints with HR, one has spoken to a union delegate, and the manager is searching the internet trying to work out whether what she did was actually lawful. The short answer is: it may have been, but only if she followed a process she didn't know existed.

What is actually at stake

Australian workplace surveillance law is not a single, national framework. It is a patchwork of state and territory Acts, Commonwealth privacy obligations, and employment law principles — and the requirements vary depending on where your staff work, not where your head office sits.

The most significant exposure sits in New South Wales and the Australian Capital Territory, where dedicated legislation sets out prescriptive notice obligations before any camera, computer or tracking surveillance of employees can begin. In NSW, that is the Workplace Surveillance Act 2005 (NSW). In the ACT, it is the Workplace Privacy Act 2011 (ACT). Both Acts cover three categories of surveillance: optical surveillance (cameras), data or computer surveillance (email, internet, device activity), and tracking surveillance (GPS). Both impose a 14-day prior written notice requirement before surveillance commences.

In Victoria, the Surveillance Devices Act 1999 (Vic) — as amended by the Surveillance Devices (Workplace Privacy) Act 2006 (Vic) — prohibits the use of optical and listening devices in toilets, washrooms, change rooms and lactation rooms, but does not impose the same broad prior-notice regime that applies in NSW and the ACT. Other states and territories have their own surveillance devices and listening devices laws, particularly relevant to audio recording.

At the Commonwealth level, if your business is covered by the Privacy Act 1988 (Cth) and you keep records of surveillance data — CCTV footage, computer logs, GPS history — that do not fall squarely within the employee records exemption, the Australian Privacy Principles may apply to how you collect, store, use and disclose that information.

The risk of getting this wrong is not just regulatory. In NSW, conducting surveillance without the required notice can result in civil and criminal liability, and unlawfully obtained surveillance evidence can face admissibility challenges in disciplinary proceedings — precisely the moment you would most want it.

Step 1: Work out what you are actually running and where

Before you can fix anything, you need an honest inventory. The categories that attract legal obligations are broader than most small businesses expect.

Pull together:

• All CCTV and security cameras (fixed and movable), including any that record audio
• Call recording systems on desk phones, VOIP or mobile numbers
• Software that monitors email, browser activity, file access, login times or keystroke data
• GPS or location tracking on company vehicles, phones or delivery apps
• Access control systems (swipe cards, PIN logs, alarm records) that could be used to track individual movements

For each item, record which states your monitored employees work in. An employee working from home in NSW falls under NSW law, not the law of your head-office state. An interstate driver whose company vehicle you track across the border picks up the surveillance regime of their usual work location.

This is the foundation for everything else. Surveillance obligations attach to the employee's work location, not to where the device is registered.

Step 2: Check whether valid notice was given — and document what you find

In NSW and the ACT, the notice requirement under s 10 of the Workplace Surveillance Act 2005 (NSW) and s 13 of the Workplace Privacy Act 2011 (ACT) is not satisfied by:

• a general reference to "monitoring may occur" buried in an employment contract
• a verbal mention in an onboarding meeting
• a sign on the wall that was put up after the surveillance started

What the law requires is a written notice given at least 14 days before surveillance commences, stating the kind of surveillance, how it will be carried out, when it starts, whether it will be continuous or intermittent, and whether it is ongoing or for a limited period. A new employee starting into an already-surveilled workplace must receive the notice before they begin work — the 14-day window does not apply in that case, but the notice itself still must.

Check your records:

• Was written notice given before each type of surveillance commenced?
• Did it cover all three categories that are in use (camera, computer, tracking)?
• Do you have signed acknowledgements or records of delivery?
• Were new hires who joined after surveillance was already running given notice before day one?

If the answer to any of these is no, or uncertain, treat the gap as confirmed and move to remediation rather than hoping the issue does not surface.

Step 3: Pause covert or undisclosed surveillance while you get legal advice

Covert surveillance — surveillance that has not been disclosed to the employee — has its own rules. In the ACT, conducting covert surveillance generally requires prior authorisation from the ACT Magistrates Court, and any such authority is valid for only 30 days. In NSW, there are limited exceptions for covert surveillance (for example, where an employer reasonably suspects an employee of serious wrongdoing), but these are narrow and procedurally specific.

If you have been monitoring employees without any notice and without a lawful basis for covert surveillance, continue collecting that data while you seek advice only if there is an active and documented business reason — such as an ongoing fraud investigation — and get legal advice on whether your situation meets any exception. In any other case, the safer immediate step is to pause the undisclosed monitoring, not to continue it while you sort out the paperwork.

This is the one step that genuinely cannot wait. Evidence gathered during unlawful surveillance may be excluded in disciplinary proceedings, and continuing after you become aware of the non-compliance makes the position harder to defend.

Step 4: Draft and issue a compliant written surveillance notice — and update your policy

The notice itself does not need to be long. What it needs to do is satisfy the statutory content requirements. For NSW and ACT employees, a compliant notice will state, at minimum:

• the type or types of surveillance (camera, computer, tracking — each separately described)
• how each type is carried out (for example, fixed CCTV cameras at reception and the warehouse floor; monitoring of email sent and received on company accounts; GPS tracking via the fleet management app on company vehicles)
• the date surveillance starts (or, for existing surveillance, acknowledging it is already in operation and confirming the policy going forward)
• whether monitoring is continuous or triggered by specific circumstances
• whether the surveillance is ongoing or subject to review

The notice can be embedded in a broader workplace surveillance policy — in fact, a standalone policy is the more practical approach for a multi-role or growing business, because it covers new hires, allows for updating when new tools are introduced, and doubles as the written acknowledgement record.

For other states, your policy should still explain:

• what surveillance is in use and why
• how footage, logs and records are accessed, stored and retained
• who within the business can access surveillance data and under what circumstances
• where surveillance does not apply (bathrooms, change rooms, and any other private areas)
• how employees can raise concerns

Step 5: Align your employment documents and set up a review trigger

A surveillance policy that sits in a drawer achieves less than one that is actively built into your employment cycle. After the notice is issued:

• Update your employment contracts and onboarding materials so every new hire receives the notice before they start and signs an acknowledgement
• For your existing staff, issue the updated policy directly and keep a record of delivery and acknowledgement
• Set a review date — at minimum annually, or whenever you add a new type of monitoring tool. A business that adds a time-tracking software add-on to its project management system without updating its policy has created a new notice gap

For businesses that handle customer data alongside surveillance data — call recordings that capture customer conversations, CCTV footage that covers customer-facing areas — consider whether your customer-facing privacy policy and your employee surveillance framework are consistent and whether your data retention and security practices across both are adequate under the Australian Privacy Principles.

How Artificer Legal can help you close this gap

If you have brought this situation to us, here is what we would typically do. First, we would review your current surveillance tools and map them against the legislative requirements in each state where your employees work — not just NSW and the ACT, but wherever your staff are located. Second, we would assess whether any existing notices or policy provisions come close to satisfying the relevant statutory requirements, and whether there is an argument that existing employment contracts or handbook provisions already put employees on notice in a legally meaningful way. Third, we would draft a compliant written notice and an updated workplace surveillance policy that covers all current surveillance types and is structured to accommodate future tools without requiring a full redraft. Fourth, where the gap is significant and employees are aware of it, we would advise on how to communicate the correction — including timing and framing — in a way that does not compound the exposure. We would also flag any other employment documents (contracts, handbooks, privacy policies) that need to be updated for consistency.

The thing most worth remembering

The most common mistake is not the decision to use surveillance — it is the assumption that installing the technology and having a business reason is enough. It is not. In NSW and the ACT, the notice obligation is a precondition, not a formality: surveillance that begins before a valid written notice is served is surveillance that was unlawful from the start, regardless of how legitimate the business purpose was. The fix is usually straightforward, but it needs to happen before, not after, the first complaint or disciplinary proceeding that turns on that footage or those logs.

To summarise the key points: Australian workplace surveillance law is jurisdiction-specific. NSW and the ACT require at least 14 days' prior written notice for camera, computer and tracking surveillance, with specific content requirements under the Workplace Surveillance Act 2005 (NSW) and the Workplace Privacy Act 2011 (ACT) respectively. Victoria and other states have their own rules, particularly around audio recording and location tracking. Surveillance data may also attract obligations under the Australian Privacy Principles. A compliant written policy, delivered before surveillance commences and built into your employment onboarding, is the practical way to stay on the right side of all of it.