Workplace Surveillance Laws: Free Checker for Employers

The Lawpath workplace surveillance checker (below) is a free tool for Australian employers that shows what workplace surveillance laws require before you switch on cameras, monitoring software, GPS, call recording, biometric clock-ins or AI in hiring and performance management. Pick your state or territory, tick what you plan to do, answer five quick questions, and you get a list of what you must do, what you can’t do, the key risks and the changes coming.

Most owners assume a line in the staff handbook covers them. In New South Wales and the ACT it doesn’t: you need written notice at least 14 days before surveillance starts, signs at every camera entrance, and a magistrate’s authority before you watch anyone in secret. Cross into Victoria and the only workplace-specific rule bans cameras and listening devices in toilets, washrooms, change rooms and lactation rooms. In Queensland, the main statute only deals with listening devices. Same cameras, same software, very different obligations once you cross a state line.

What is the workplace surveillance checker, and who is it for?

It’s for the person who has to sign off on monitoring: the café owner adding CCTV, the logistics business putting GPS in its vans, the agency trialling an AI tool that ranks 400 applications overnight. If you’ve asked “am I allowed to monitor my staff?”, start here.

The checker answers one question for the state or territory you pick: what does the law require of you, as the employer, for the monitoring or AI use you’ve ticked? It doesn’t judge whether the monitoring is a good idea for your culture. That call is yours.

How to use the checker

Here’s what you enter, in order.

1. Choose the state or territory where the staff you want to monitor work. If your team is spread across states, run it once for each.
2. Tick everything you plan to do: cameras, computer and email monitoring, location tracking, audio recording, biometrics, AI in recruitment, or AI for performance, rostering or discipline.
3. Tell it whether the Privacy Act covers your business. Turnover over $3 million is the main test, but some smaller businesses are covered too. If you’re not sure, say so and the results include the Privacy Act steps anyway.
4. Answer the yes or no questions: covert monitoring, private areas such as toilets and change rooms, monitoring outside work or on personal devices, and whether you’ll use the data to discipline or dismiss someone.

What the results show

You get a risk rating first. Covert monitoring, anything near a toilet or change room, or out-of-hours monitoring in NSW or the ACT puts you in the red. Below that sit four lists: what you must do, what you can’t do, the key risks, and the changes to watch. Every line names the law it comes from, and the official sources for your state are linked underneath.

Three businesses, three different answers

A Sydney courier business wants GPS in its six vans. Under the Workplace Surveillance Act 2005 (NSW), each driver needs written notice at least 14 days before tracking starts, and each van needs a clearly visible notice saying it’s tracked. The catch is section 16: you can’t carry out surveillance of an employee when they aren’t at work. If drivers take the vans home, switch tracking off after hours or get advice first.

A Melbourne retailer adds CCTV with audio to the shop floor. Victoria has no 14-day notice rule, so the video side is mostly about obvious cameras, signs and keeping clear of toilets, washrooms, change rooms and lactation rooms (section 9B of the Surveillance Devices Act 1999 (Vic), which staff consent can’t override). The audio is the problem. In Victoria, a person can record a conversation they’re part of, but the business isn’t a party to chats between staff and customers, so recording them without consent risks an offence under section 6.

A Brisbane recruitment firm with $8 million in turnover starts using AI to screen CVs. Queensland’s surveillance laws barely touch this. The Privacy Act does: job applicants fall outside the employee records exemption, so the Australian Privacy Principles apply to their data. From 10 December 2026, if the tool rejects people or substantially shapes that decision, the firm’s privacy policy must say what kinds of personal information the program uses and what kinds of decisions it makes. And if the model quietly screens out people with career gaps, that can be indirect discrimination against parents and carers, whoever built the software.

How workplace surveillance laws differ by state

Only two jurisdictions have a law written for workplace surveillance. Everywhere else, you work from general surveillance devices or listening devices laws, plus the federal rules that apply nationally.

State or territory	Main law	Cameras, computers and tracking	Covert monitoring	Recording conversations
NSW	Workplace Surveillance Act 2005	14 days’ written notice; visible cameras and entrance signs; computer monitoring only under a notified policy; notice on tracked vehicles	Magistrate’s covert surveillance authority, only to investigate unlawful activity	All parties’ consent, with narrow exceptions
ACT	Workplace Privacy Act 2011	14 days’ written notice plus good-faith consultation; visible cameras and signs; data surveillance policy; notice on tracked vehicles; the notice must say if records may be used for discipline	Magistrates Court authority, only to investigate unlawful activity	All parties’ consent, with narrow exceptions
Victoria	Surveillance Devices Act 1999	No notice law. Consent needed to record private activities or track people; no cameras or listening devices in toilets, washrooms, change rooms or lactation rooms	No authority scheme	A party can record; you can’t record conversations you’re not part of
Queensland	Invasion of Privacy Act 1971	No workplace or tracking law; criminal law bans recording people in private places	No authority scheme	A party can record
WA	Surveillance Devices Act 1998	Consent needed to record private activities or track people	No authority scheme	All parties’ consent, with narrow exceptions
SA	Surveillance Devices Act 2016	Consent needed to record private activities, track people, or put data surveillance on a computer (owner or controller consent)	No authority scheme	All parties’ consent, with narrow exceptions
Tasmania	Listening Devices Act 1991	No camera, tracking or computer law; criminal law bans recording people in private places	No authority scheme	All parties’ consent, with narrow exceptions
NT	Surveillance Devices Act 2007	Consent needed to record private activities or track people	No authority scheme	A party can record

The NSW short guide to the Workplace Surveillance Act makes a useful point: routine back-ups, network performance monitoring and licence checks are not “surveillance”. Reading someone’s emails, logging keystrokes or tracking every website they visit is. The ACT adds a trap of its own. Under section 22 of the Workplace Privacy Act, using a surveillance record to take adverse action against a worker, such as a warning or dismissal, is an offence unless your notice said you might. We go deeper on the NSW Act in 5 things you need to know about the Workplace Surveillance Act, and on cameras in is it legal to use security cameras in the workplace?

AI at work: the rules that already apply

There’s no Australian AI Act. The Government’s December 2025 National AI Plan chose to rely on existing laws, so an AI tool is judged by the same rules as the manager using it. Four of those matter most to employers.

First, discrimination law. Federal and state anti-discrimination Acts, and the general protections in Part 3-1 of the Fair Work Act, cover decisions about prospective employees as well as current ones. A tool that scores people down for age, disability, pregnancy or carer’s responsibilities exposes you, even if a vendor trained it.

Second, unfair dismissal. A productivity score is evidence, and a dismissal still needs a valid reason and a fair process under section 387. Put the data to the employee and let them answer it.

Third, the Privacy Act. From 10 December 2026, businesses covered by the Act must describe in their privacy policy the kinds of personal information their computer programs use, and the kinds of decisions those programs make or substantially and directly help make, where the decision could significantly affect someone. The OAIC’s guidance explains the test, and our post on updating your privacy policy for automated decisions walks through the change. The employee records exemption may cover some decisions about current employees, but it doesn’t cover applicants or contractors.

Fourth, biometrics. Fingerprints and face templates are sensitive information, and collecting them generally needs consent. In Lee v Superior Wood [2019] FWCFB 2946, the Full Bench of the Fair Work Commission held that the employee records exemption didn’t cover collecting fingerprint data the employer didn’t yet hold, so a direction to use the scanner wasn’t a lawful one.

The privacy tort applies to every business

Since 10 June 2025, Schedule 2 of the Privacy Act has let people sue for a serious invasion of privacy, either by intruding on their seclusion or by misusing information about them, where the invasion was intentional or reckless. There’s no $3 million turnover threshold and no employee records exemption. A camera angled into a break room, or a manager sharing someone’s location history around the office, now carries civil risk as well as the state law risk. The OAIC’s tort page sets out the elements.

What’s coming, and what isn’t law yet

Victoria is the one to watch. A parliamentary inquiry reported in May 2025, and the Government has supported 15 of its 18 recommendations in principle, including notice, consultation, a proportionality test, limits on covert and biometric surveillance, and human review of significant automated decisions. No bill has been introduced, and Labor has said it would legislate if re-elected at the November 2026 state election. Track it on the Victorian Government’s workplace surveillance page.

In NSW, the Work Health and Safety Amendment (Digital Work Systems) Act 2026 passed in February 2026. Once its main duties start, businesses will have to consider whether algorithms and other digital work systems create excessive workloads, metrics or surveillance, or discriminatory decisions. Those duties start on a date still to be proclaimed, according to SafeWork NSW.

Federally, an exposure draft of the next Privacy Act reforms was released in August 2026. It isn’t law, and the small business and employee records exemptions remain in place for now. The checker marks all of these as pending, and we’ll update it as they change.

What the checker leaves out

It’s built for private sector employers. Public sector agencies have extra privacy and information laws. It doesn’t read your modern award or enterprise agreement, which may add consultation steps before new technology arrives, or decide whether a particular conversation is legally private. It doesn’t cover telecommunications interception law or monitoring that crosses state borders, where the safest course is to follow the strictest state involved. When the answer turns on the exact facts, the results say so and point you to the source.

Frequently asked questions

Is the workplace surveillance checker free?

Yes. It’s free to use and there’s no login or sign-up.

Do I have to tell employees before I monitor them?

In NSW and the ACT, yes: written notice at least 14 days before surveillance starts, unless the employee agrees to a shorter period, and before day one for new starters. In the other states there’s no specific notice law, but surveillance devices laws often require consent, so a written policy and advance notice is the safest approach everywhere.

Can I monitor employees without telling them?

In NSW and the ACT, covert surveillance needs an authority from a magistrate, and it’s only granted to investigate suspected unlawful activity at work. Other states have no authority scheme, and secretly recording private conversations or activities, or tracking someone without consent, can be an offence. Covert monitoring also increases the risk of a serious invasion of privacy claim.

Can I use AI to screen job applicants?

Yes, but you’re responsible for the outcome. Check the tool for bias against protected attributes, keep a person accountable for decisions, and if the Privacy Act covers your business, treat applicant data under the Australian Privacy Principles. From 10 December 2026, your privacy policy must also describe significant decisions made or substantially assisted by computer programs.

Does the Privacy Act apply to employee monitoring?

Partly. Businesses with turnover of $3 million or less are generally exempt, and a covered employer’s handling of current or former employees’ records is usually exempt too. Job applicants, contractors and collecting sensitive information such as biometrics aren’t covered by that exemption, and the privacy tort applies to every business regardless of size.

Set up monitoring you can defend

Monitoring done properly protects staff, customers and the business. Done carelessly, it becomes the exhibit in someone else’s claim. The difference is usually a policy, a notice and a few weeks of lead time.

Check your obligations for your state in a couple of minutes with the free workplace surveillance checker above.

This article is general information only and isn’t legal advice. Surveillance and privacy laws differ by state and are changing, so check the official source for your state or get advice for your situation.