TL;DR: A workplace surveillance policy tells staff how cameras, computer monitoring, and tracking devices are used at work, and the law differs by state. NSW and the ACT require written notice at least 14 days before surveillance starts, plus a policy for computer monitoring. Victoria bans cameras in toilets, washrooms, change rooms, and lactation rooms.

Key takeaways

• In NSW and the ACT, surveillance needs written notice at least 14 days before it starts, unless the employee agrees to less.
• Computer monitoring in NSW and the ACT is lawful only under a policy staff have been told about and can reasonably be assumed to understand.
• Covert surveillance needs a court authority in both NSW and the ACT, and only to investigate suspected unlawful activity.
• According to the OAIC, 81% of Australians think businesses should protect employee information as larger businesses must.
• A NSW rule is not an Australian rule, so check the law in every state where your people work.

What is in this surveillance policy template?

The download pairs a sample workplace surveillance notice with a computer surveillance policy, so staff are told what is monitored and the rules for using work systems are written down. Both are starting points with placeholders for your organisation’s details. Adapt them to the surveillance you actually run, and check them against the law in each state where you employ people.

What is a workplace surveillance policy?

A workplace surveillance policy is a written document explaining how an employer monitors staff at work, which tools it uses, what data they collect, who can see it, and how that data is used. In NSW and the ACT the law expects such a policy for computer monitoring. Elsewhere it is good practice that sets clear expectations.

The NSW Workplace Surveillance Act 2005 sorts workplace surveillance into three kinds. Camera surveillance uses a device that monitors or records visual images. Computer surveillance uses software or equipment that monitors or records what goes into or out of a computer, including emails sent and websites visited. Tracking surveillance uses a device whose main purpose is to record location or movement, such as a GPS tracker in a fleet vehicle.

A surveillance notice and a surveillance policy do different jobs. The notice tells an employee, in advance, that a particular kind of surveillance will start and how it works. The policy sets the standing rules: how staff may use work systems, what is logged, and how compliance is checked. Most employers need both, which is why the template carries both.

Which Australian laws regulate workplace surveillance?

Workplace surveillance is regulated by state and territory law, and the rules differ. NSW has the Workplace Surveillance Act 2005 and the ACT has the Workplace Privacy Act 2011, both with notice regimes. Victoria’s Surveillance Devices Act 1999 bans surveillance in certain workplace rooms. The federal Privacy Act exempts most private sector employee records.

The three regimes compare like this:

	NSW	ACT	Victoria
Main law	Workplace Surveillance Act 2005	Workplace Privacy Act 2011	Surveillance Devices Act 1999, Part 2A
Written notice before surveillance	Yes, 14 days	Yes, 14 days, plus good faith consultation	No workplace notice regime
Policy needed for computer monitoring	Yes	Yes, with set content	No workplace-specific rule
Banned areas	Change rooms, toilets, showers, and other bathing facilities	Toilets, change rooms, showers, parent or nursing rooms, prayer rooms, sick bays, and first-aid rooms	Toilets, washrooms, change rooms, and lactation rooms
Covert surveillance	Only with a covert surveillance authority from a Local Court judge	Only with a covert surveillance authority from the Magistrates Court	Covered by the general device offences

However, Victoria’s general device offences still matter at work. Under the Act, a person must not knowingly use a listening device to record a private conversation they are not part of without consent. Likewise, using an optical device to record a private activity, or a tracking device to locate a person, is restricted without consent.

Who counts as staff also varies. In the ACT, a “worker” includes contractors, outworkers, work experience students, and volunteers. In NSW, a host business using labour hire staff can be treated as their employer. So a policy written for employees alone may miss people. If you employ people in other states or territories, check the surveillance law that applies there before relying on the template.

What must a surveillance notice include?

In NSW, a surveillance notice must state the kind of surveillance, how it will be carried out, when it starts, whether it is continuous or intermittent, and whether it is for a limited period or ongoing. The ACT adds who will be monitored, how records may be used and disclosed, and the worker’s right to consult.

Timing is the part employers most often get wrong. In both NSW and the ACT, the notice must reach the employee at least 14 days before surveillance starts, unless the employee agrees to a shorter period. For a new starter joining where surveillance is already running, the notice must be given before they start work. In NSW, notice by email counts as notice in writing. As a result, the surveillance notice belongs in the onboarding pack, next to the contract.

In addition, each kind of surveillance carries an extra rule of its own. In NSW, cameras must be clearly visible, and signs must sit at each entrance to the monitored place. A tracked vehicle must carry a clearly visible notice that it is tracked. Computer surveillance must follow a policy that staff were told about in advance.

By contrast, the ACT goes further on process. An employer must consult the worker in good faith for the whole notice period, meaning a genuine opportunity to influence how the surveillance is run. For example, suppose a Canberra employer adds GPS to its delivery fleet. It needs a notice with the ACT content, a sticker on each vehicle, and 14 days of real consultation before switching it on.

What should a computer surveillance policy cover?

A computer surveillance policy should say how work computers, email, and internet access may and may not be used, what is logged, who can see the logs, and how compliance is monitored and audited. The ACT names those three elements in its legislation, while NSW requires the policy to be notified so staff are aware of it and understand it.

A practical policy covers:

• Systems in scope: Laptops, phones, email, messaging, cloud apps, and remote access.
• What is monitored: Email, websites visited, files moved, logins, and any keystroke or screen capture tools.
• Who can access the data: Named roles, such as IT security and HR, rather than “management”.
• How records are used: Investigations, security, and legal proceedings, consistent with the purposes the law allows.
• Blocking: When email or websites may be blocked, and how staff are told.
• Out of hours: Whether monitoring of work devices continues when staff are not working.

Blocking email or websites has its own rules. In NSW, an employer may block an email or website only under a notified policy on email and internet access. Where an email is blocked, the employee must usually be told as soon as practicable, though spam, malicious attachments, and menacing or offensive content are exceptions. Importantly, a policy cannot block an email just because it comes from a union, or a website just because it discusses industrial matters. The ACT has a similar regime, with its own stopped delivery notice.

The same policy should connect to your IT acceptable use policy, which sets the rules that monitoring then enforces.

Where is workplace surveillance prohibited?

Surveillance is banned in private areas in all three jurisdictions. NSW prohibits it in change rooms, toilets, showers, and other bathing facilities. The ACT adds parent or nursing rooms, prayer rooms, sick bays, and first-aid rooms. Victoria bans cameras and listening devices in toilets, washrooms, change rooms, and lactation rooms at the workplace.

Monitoring staff outside work is restricted too. In NSW, an employer must not use a work surveillance device to monitor an employee who is not at work. The exception is computer surveillance of equipment or resources the employer provided. The ACT takes a similar approach, with an added exception for tracking functions that cannot be switched off, whose records must not be used or disclosed.

However, “at work” is wider than the office. Under the NSW Act, an employee is at work when they are at the employer’s workplace, or anywhere else while performing work. So someone working from home on a work laptop is at work during their working hours, and the notice and policy rules apply.

Covert surveillance is the narrowest exception of all. In NSW, it requires a covert surveillance authority from a Judge of the Local Court. The authority is only for establishing whether particular employees are involved in unlawful activity at work. It never authorises covert monitoring of work performance, or covert surveillance in change rooms or bathrooms.

Does the Privacy Act apply to employee monitoring?

For most private sector employers, mostly not. According to the OAIC, a private sector employer’s handling of employee records is exempt from the Privacy Act if it directly relates to the current or former employment relationship. However, the Act still applies to information used for an unrelated purpose, to job applicants, and to Australian Government employee records.

Even so, the exemption has limits. The Australian Privacy Principles apply to businesses with an annual turnover of $3 million or more. According to the Fair Work Ombudsman, they still cover personal information about unsuccessful job candidates. Third parties providing payroll, HR, or recruitment services may also need to comply.

Meanwhile, community expectations run well ahead of the law. According to the OAIC’s 2023 Australian Community Attitudes to Privacy Survey, 81% of Australians think businesses collecting work-related information about employees should protect it the way larger businesses must. In addition, only 6% to 13% of people could correctly identify the organisation types exempt from the Privacy Act. So treat surveillance records with care whatever your legal position, because staff will judge you by the higher standard.

How do you roll out a surveillance policy?

Roll out a surveillance policy by listing what you monitor, writing the notice and policy, and consulting staff. Then give at least 14 days’ written notice where NSW or ACT law applies, and record that each person received and understood it. Then review it whenever the technology changes, because new tools often collect more than the old policy describes.

A rollout that holds up usually follows these steps:

• Map the surveillance: Record each camera, monitoring tool, and tracker, with its location and data owner.
• Check each state: Apply the strictest relevant rule where staff work across borders.
• Consult: In the ACT this is a legal duty; elsewhere it builds trust and surfaces problems early.
• Give notice: Send the notice in writing, and include it in onboarding for new starters.
• Record acknowledgement: Keep evidence that each person received the policy and had a chance to ask questions.
• Review: Revisit the policy at least yearly, and whenever a system changes.

Acknowledgement matters most for computer surveillance, because NSW and ACT law both turn on whether staff can reasonably be assumed to be aware of and understand the policy. A signed or recorded acknowledgement is the clearest evidence of that. For more on why written policies earn their keep, see why workplace policies matter.

When is a template not enough?

Frequently asked questions

Do employers have to tell employees about surveillance in Australia?

It depends on the state or territory. In NSW and the ACT, employers must give written notice at least 14 days before surveillance starts, unless the employee agrees to less. Victoria has no workplace notice regime, but its general laws restrict listening, optical, and tracking devices. Check the law wherever your people work.

Can my employer monitor my work computer?

In NSW and the ACT, an employer can monitor a work computer only under a computer surveillance policy that staff were told about in advance and can reasonably be assumed to understand. In NSW, monitoring of employer-provided equipment can continue outside work hours. Other states have different rules, so check local law.

Is it legal to have cameras in the workplace?

Cameras are generally legal in work areas, with conditions. In NSW and the ACT, cameras must be clearly visible, signs must be posted at each entrance, and written notice is required. Cameras are banned in toilets, change rooms, and showers in NSW, the ACT, and Victoria, and the ACT bans more areas.

Can an employer use covert surveillance?

Only in narrow circumstances under state or territory law. In NSW and the ACT, covert surveillance of employees needs a court-issued covert surveillance authority, and only to investigate suspected unlawful activity at work. In NSW, an authority never permits covert monitoring of work performance, or covert surveillance in change rooms, toilets, or showers.

What should a workplace surveillance notice include?

In NSW, a notice must state the kind of surveillance, how it is carried out, when it starts, whether it is continuous or intermittent, and whether it is limited or ongoing. In the ACT, it must also state who is monitored, how records may be used, and that workers may consult about it.

Related reading

• Sample IT acceptable use policy
• Sample social media policy
• Worknice HR document management

Sources

1. NSW Parliamentary Counsel’s Office. “Workplace Surveillance Act 2005 No 47.” Current version for 28 March 2026 to date. Retrieved 8 October 2026. https://legislation.nsw.gov.au/view/html/inforce/current/act-2005-047
2. ACT Parliamentary Counsel’s Office. “Workplace Privacy Act 2011, Republication No 6.” Effective 23 June 2021. Retrieved 8 October 2026. https://www.legislation.act.gov.au/a/2011-4/
3. Victorian Chief Parliamentary Counsel. “Surveillance Devices Act 1999, version 048.” Effective 10 December 2025. Retrieved 8 October 2026. https://www.legislation.vic.gov.au/in-force/acts/surveillance-devices-act-1999
4. Office of the Australian Information Commissioner. “Employment.” Retrieved 8 October 2026. https://www.oaic.gov.au/privacy/your-privacy-rights/more-privacy-rights/employment
5. Office of the Australian Information Commissioner. “Australian Community Attitudes to Privacy Survey 2023.” August 2023. Retrieved 8 October 2026. https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023
6. Fair Work Ombudsman. “Workplace privacy best practice guide.” Last updated 16 January 2026. Retrieved 8 October 2026. https://www.fairwork.gov.au/tools-and-resources/best-practice-guides/workplace-privacy