ComplianceLegalPrivacyEmployee monitoring

Employee Monitoring Laws in Australia

NSW sets the strictest bar with a 14-day notice rule and a near-ban on covert surveillance. What applies in each state, and what compliance looks like.

Australia regulates workplace surveillance through state and territory legislation, not a national statute, and the differences between jurisdictions are large enough to matter. An employer running a distributed team across Sydney, Melbourne and Perth is operating under three different sets of obligations at once.

Complicating it further, the federal Privacy Act's employee records exemption removes much private-sector employee information from its scope. So the framework people reach for first is largely not the one that governs, and the surveillance Acts do the real work.

New South Wales sets the bar

If you have any employees in NSW, plan to the NSW rules. They are the most prescriptive in the country and complying with them will generally keep you clear elsewhere.

The Workplace Surveillance Act 2005 requires notice at least 14 days before surveillance of an employee begins. That notice must be in writing, and email counts. An employee can agree to a shorter period, but the default is 14 days and it runs before the surveillance starts, not before you decide to buy something.

The notice has to be specific. It must state the kind of surveillance — camera, computer or tracking — how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it is for a limited period or ongoing. A general clause saying the company reserves the right to monitor its systems does not meet this.

Separately, computer surveillance must be conducted in accordance with a policy that has been published to employees and notified to them. Two requirements, then: the notice about this surveillance, and the standing policy governing how computer surveillance is done at all.

Covert monitoring is effectively off the table

The NSW position on covert surveillance is stricter than most employers assume. Surveillance conducted without notice is generally only permissible under a covert surveillance authority issued by a magistrate, and the purpose contemplated is establishing whether an employee is engaged in unlawful activity at work.

This is not a high internal bar to clear. It is an external process. An employer that decides to monitor someone quietly because of a suspicion, without going through it, is not making a risk-managed judgement call — it is doing something the Act contemplates as unlawful.

Other jurisdictions frame this differently, but the practical answer across Australia is the same: covert workplace surveillance is exceptional and externally supervised, not a management option. The same principle appears in the UK's ICO guidance, where covert monitoring requires exceptional circumstances.

The rest of the country, in short

Victoria, Queensland, Western Australia, South Australia, Tasmania, the ACT and the Northern Territory each have surveillance devices legislation, but the coverage differs. Several are focused on optical, listening and tracking devices, with computer surveillance of the kind an employee monitoring tool performs less directly addressed than in NSW and the ACT.

That gap is easy to misread as permission. Two reasons it is not. First, general obligations still apply — the implied duty of mutual trust and confidence in the employment relationship, unfair dismissal considerations if monitoring data drives a termination, and workplace relations obligations around consultation. Second, employees move, and a Victorian employer that hires in Sydney inherits the NSW regime on that hire.

The workable approach for anyone operating nationally is to adopt the strictest applicable standard as the company standard. Running different notice regimes per state is possible in principle and unmanageable in practice.

What compliance actually looks like

Concretely, an Australian deployment that holds up has five artefacts:

A published computer surveillance policy describing what is monitored and how, notified to employees rather than merely posted somewhere.

A specific written notice to each affected employee, issued at least 14 days before surveillance starts, covering the five points the Act enumerates.

A record of when each notice was sent and to whom. This is the evidence, and reconstructing it later is unpleasant.

A defined process for new starters, because the notice obligation attaches to them too and onboarding is where this quietly fails.

A retention position, because holding surveillance records indefinitely turns a compliant collection into an ongoing exposure.

The rollout checklist covers the operational sequencing, and the policy template is a reasonable base to adapt, with the NSW-specific elements added.

Choosing a tool with this in mind

The notice requirement has a design consequence that is easy to miss: you must be able to describe accurately, in advance, what the tool collects. Products whose collection is configurable in a hundred directions, or whose vendor documentation is vague about what is captured, make that notice hard to write and easy to get wrong. A tool with a narrow, clearly-stated collection surface is not just less intrusive, it is administratively cheaper here.

The same goes for changes. If a vendor update adds a collection type, your notice is now inaccurate. Choosing a product whose scope is stable and plainly documented matters more in Australia than in jurisdictions with looser notice rules.

Where ProdView fits

ProdView collects activity and application metadata — productive hours, focus time, meeting load, capacity — and never screen content or keystrokes, with screenshots optional and off by default. That makes the NSW notice short and accurate, and the standing policy easy to write. Employees see the same dashboard managers do, retention is configurable, SOC 2 Type II, one agent across Windows, macOS and Linux.

When not to pick us: you have a security or regulatory requirement for session recording or DLP. Those are legitimate, and a UAM tool is the right answer for the seats concerned — with a correspondingly longer notice describing what it does.

Try before you commit

Three seats are free forever, so you can see exactly what is collected before drafting the notice that has to describe it. Model the payback with the ROI calculator if you need the business case first.

General information about Australian workplace surveillance law as of August 2026, not legal advice. Obligations differ by state and territory; take Australian employment law advice before deploying.

P
ProdView Team

The ProdView team builds privacy-first workforce analytics for engineering managers. We write about measuring productivity without surveillance, the laws that govern monitoring, and how the best teams run their week.

Frequently asked questions

Is employee monitoring legal in Australia?
Yes, but surveillance is regulated at state and territory level rather than federally, and the rules differ meaningfully. New South Wales has the most prescriptive regime, requiring at least 14 days' written notice before computer surveillance begins and a published surveillance policy.
How much notice must Australian employers give before monitoring?
In New South Wales, at least 14 days before the surveillance starts, in writing, with email counting as writing. An employee may agree to a shorter period. The notice must describe the kind of surveillance, how it will be carried out, when it starts, whether it is continuous or intermittent, and whether it is ongoing or time-limited.
Is covert employee monitoring allowed in Australia?
Only in narrow circumstances and, in New South Wales, generally only under a covert surveillance authority issued by a magistrate for the purpose of establishing whether an employee is engaged in unlawful activity. It is not something an employer can decide to do internally.
Does the Privacy Act apply to employee monitoring in Australia?
The Privacy Act contains an employee records exemption that removes much private-sector employee information from its scope, which is why state surveillance legislation does most of the work here. The exemption has been under review for some years, so treat it as a moving target rather than a permanent shield.
What should an Australian computer surveillance policy contain?
Enough for an employee to understand what is monitored and when. In NSW the surveillance must be conducted in accordance with a policy that has been published and notified to employees, so a policy sitting unread on an intranet is unlikely to satisfy the requirement.
Monitoring law elsewhere

Employ people in more than one country? These cover the same ground for other jurisdictions.

Related reading
  • How Many Reports Is Too Many?
    Span of control gets set by org-chart convenience and discovered by attrition. The signals that show a manager is over-extended before their team tells you.
  • Badge Data Is Not Productivity Data
    Office utilisation tells you who turned up. It cannot tell you whether the day worked. What each measurement supports, and the error of substituting one.
  • If Your Monitoring Data Leaks
    A behavioural archive on every employee is an unusually bad thing to lose. Why it is worse than it looks, and how to shrink the blast radius now.

Make the policy easy to keep

ProdView collects activity metadata only — no screen content, no keystrokes — so the restrictive version of your monitoring policy is simply true about the product, not a setting you have to maintain.

Get the policy templateStart free — 3 seats