Employee monitoring can be a genuinely useful tool for small businesses and startups.
When you’re growing a team, protecting confidential information, handling customer data, and trying to keep productivity on track, it’s normal to want visibility over what’s happening in your business systems. But in Australia, employee monitoring sits at the crossroads of several legal areas - including privacy, workplace surveillance, and recording laws - and it’s easy to get it wrong if you move too quickly.
The good news is that you can usually monitor employees lawfully, as long as you do it transparently, for a legitimate purpose, and in a way that’s proportionate. Below, we’ll walk you through how employee monitoring works in practice, what the key legal risks are, and how to roll it out in a way that protects your business (without damaging trust in your workplace).
Note: This article is general information only and isn’t legal advice. Monitoring rules can change depending on your state/territory, your industry, and what type of monitoring you’re using.
What Counts As Employee Monitoring (And Why Businesses Use It)?
In simple terms, employee monitoring is any system, process or tool you use to observe, track, record, or review employee activity at work.
Monitoring can be direct (like CCTV cameras in a workplace) or indirect (like logging access to business files or reviewing work email metadata).
Common Types Of Employee Monitoring
- Email and messaging monitoring: reviewing company email accounts, message logs, or communications on work platforms.
- Internet and device monitoring: web browsing logs, app usage, keystroke/activity tracking, or device management software on company laptops/phones.
- CCTV / video surveillance: cameras in offices, retail stores, warehouses, or entry/exit points.
- Audio recording: recording customer calls for quality assurance or training (this is a high-risk area legally and needs careful handling).
- Location tracking: GPS tracking for company vehicles, delivery routes, or field teams (often via devices or apps).
- Access control monitoring: swipe cards, logins, audit trails showing who accessed what and when.
Legitimate Business Reasons For Monitoring
As an employer, you generally want employee monitoring for reasons like:
- security and safety (protecting stock, preventing incidents, keeping staff safe)
- protecting confidential information (trade secrets, client lists, pricing, IP)
- cybersecurity and fraud prevention (detecting suspicious access and data leaks)
- quality assurance (for customer service teams)
- compliance (for regulated industries or contractual obligations)
- performance management (but this needs a careful and fair approach)
The key is this: your reason matters. If monitoring doesn’t have a legitimate business purpose, or it’s excessive compared to the problem you’re trying to solve, that’s where legal and employee relations risks start to escalate.
What Laws Apply To Employee Monitoring In Australia?
There isn’t one single “employee monitoring law” for all of Australia. Instead, your obligations usually come from a mix of:
- state and territory workplace surveillance laws (where they exist)
- state and territory listening/recording (surveillance device) laws
- privacy law and data handling expectations
- employment law (including Fair Work obligations and contract terms)
- workplace health and safety considerations
What applies will depend on where your business is based, where your employees work (including remote work), and what exactly you’re monitoring.
Workplace Surveillance Laws (State-Based)
Some states and territories have laws that specifically address workplace surveillance. For example:
- NSW: Workplace Surveillance Act 2005 (NSW) regulates camera surveillance, computer surveillance and tracking surveillance in workplaces, including notice requirements and limits on covert surveillance.
- ACT: Workplace Privacy Act 2011 (ACT) covers workplace privacy and includes rules around surveillance and notice in ACT workplaces.
In other jurisdictions, there may not be a dedicated “workplace surveillance act”, but surveillance is still regulated through broader surveillance device / listening device laws, and through employment law and privacy principles. If you operate across multiple states, you may need a “highest common denominator” approach to stay safe.
As a practical rule, workplace surveillance laws often focus on:
- notice requirements (employees must be told surveillance will happen, and sometimes how/when it will occur)
- how the surveillance is carried out (for example, continuous surveillance in private areas is generally a big red flag)
- prohibitions on certain surveillance (especially in places like bathrooms, change rooms, or other private spaces)
If you’re considering cameras, it’s worth sanity-checking your setup against the common compliance themes in workplace camera laws.
Listening And Recording Laws (Phone Calls And Conversations)
Audio recording is one of the easiest ways for employers to accidentally break the law.
Recording rules differ between states and territories, and they can apply to:
- recording customer service phone calls
- recording internal meetings (in-person or online)
- recording conversations on speakerphone
- recording conversations in shared work areas
By way of example, different legislation applies depending on where the recording happens, such as:
- NSW: Surveillance Devices Act 2007 (NSW)
- VIC: Surveillance Devices Act 1999 (VIC)
- QLD: Invasion of Privacy Act 1971 (QLD)
- WA: Surveillance Devices Act 1998 (WA)
- SA: Surveillance Devices Act 2016 (SA)
- TAS: Listening Devices Act 1991 (TAS)
- NT: Surveillance Devices Act 2007 (NT)
- ACT: Listening Devices Act 1992 (ACT) (and workplace-specific privacy obligations may also apply)
These laws can have different consent/notification models and exceptions. Before you record calls, it’s important to understand the recording laws in Australia and how they apply to workplaces, and also to think through the practical compliance steps for business call recording laws (like notification messages and consent models).
Privacy And Data Handling (Even If The Privacy Act Doesn’t Fully Apply)
Many small businesses assume “privacy law doesn’t apply to us.” Sometimes there are exemptions that reduce what you have to do, but it’s not the full story.
For example:
- The Privacy Act 1988 (Cth) often applies to businesses with annual turnover of $3 million or more (and some smaller businesses are still covered due to specific activities or exceptions).
- Even if your business is covered by the Privacy Act, there is an employee records exemption that can apply to certain handling of employee records in an employment context (but it doesn’t automatically cover everything you might collect through monitoring, and it won’t necessarily cover contractors).
- Even where an exemption applies, you can still face serious risk through misuse of confidential information, weak security practices, reputational harm, and employment disputes.
In practice, regardless of whether you’re strictly caught by the Privacy Act, you should treat monitoring information as sensitive and think carefully about how you:
- collect personal information (including employee data)
- store and secure recordings/logs
- control who can access monitoring data
- use monitoring information in HR decisions
- respond to complaints or disputes about surveillance
If you have a website, collect customer data, or store personal information digitally, having a clear Privacy Policy is also a practical baseline for building trust and reducing confusion (internally and externally).
Employment Law (Fair Work And Contract Risk)
Employee monitoring often intersects with employment law, especially when monitoring leads to:
- warnings or disciplinary action
- performance management
- termination
- bullying or harassment complaints
This is where process matters. Even if monitoring itself is lawful, using monitoring outcomes unfairly (or without giving an employee a chance to respond) can create avoidable legal risk.
Your Employment Contract and workplace policies should help set expectations about acceptable use of company systems, confidentiality, and what monitoring is in place.
How To Monitor Employees Lawfully (A Practical Approach)
For most small businesses, the safest way to approach employee monitoring is to treat it as a structured rollout - not a last-minute tool you switch on when something goes wrong.
Here’s a practical framework you can use.
1) Be Clear On The Purpose (And Keep It Reasonable)
Start by writing down what you’re trying to achieve. For example:
- “We want to reduce customer data leaks.”
- “We need CCTV due to stock loss and after-hours break-ins.”
- “We need call recording to train new staff and maintain compliance.”
Then sense-check whether your monitoring is proportionate. For example, installing CCTV in a retail store for theft prevention is usually easier to justify than putting always-on webcam monitoring in a professional office environment.
2) Choose The Least Intrusive Option That Still Works
One of the biggest mistakes employers make is defaulting to the most invasive tool available.
In many cases, you can reduce risk by:
- monitoring systems and access logs rather than monitoring individuals continuously
- restricting monitoring to business devices only
- limiting monitoring to working hours
- using “event-based” monitoring (triggered by suspicious activity) rather than constant monitoring
This not only helps legally - it also tends to be better for culture and retention.
3) Tell Employees What You’re Doing (And Don’t Hide The Ball)
Transparency is a recurring theme across Australian workplace surveillance rules.
In practice, your employees should understand:
- what monitoring is occurring (CCTV, email review, logging access, etc.)
- when it happens (continuous, random audits, only during work hours, etc.)
- why you are doing it (security, compliance, safety, etc.)
- how the information may be used (investigations, training, performance discussions)
- who can access it (owner, HR, managers, IT provider)
Even where the law doesn’t mandate a specific form of notice, providing clear written notice is often the most practical way to avoid disputes later (and in some jurisdictions, notice is a legal requirement for certain types of surveillance).
4) Create A Paper Trail: Policies, Contracts, And Training
Monitoring decisions often come under the microscope when there’s a complaint, a termination dispute, or a data breach.
You want to be able to show that you rolled monitoring out thoughtfully and consistently - not as a targeted response to one individual.
For example, you might:
- include monitoring clauses in employment contracts
- publish an IT and communications policy
- train managers on what they can and can’t do with monitoring information
- get employees to acknowledge key policies (especially if your tools are more intensive)
Many employers also use an acceptable use policy to set the rules for business devices, business networks, and workplace systems in a way that supports monitoring without making it feel arbitrary.
5) Secure The Data (And Limit Access)
Monitoring typically creates sensitive information: footage, recordings, location data, messages, or logs. If that data is accessed by the wrong person (or leaked externally), the legal and reputational damage can be serious.
Practical safeguards include:
- restricting access to a small number of authorised staff
- storing files securely (and encrypting where appropriate)
- having retention periods (don’t keep it forever “just in case”)
- keeping an audit trail for access to monitoring systems
- making sure third-party providers have appropriate security standards
What Policies And Legal Documents Should You Have In Place?
If you’re serious about employee monitoring, you’ll usually want to back it up with clear workplace documentation. This makes it easier to:
- set expectations from day one
- reduce misunderstandings
- manage complaints more confidently
- take action if there’s misconduct (with less risk)
Common Documents For Employee Monitoring
- Employment Contract: should clearly deal with the use of company systems, confidentiality, and your rights to monitor business tools and devices.
- IT / Acceptable Use Policy: outlines what employees can do on business devices and networks, and the types of monitoring you use to enforce the rules.
- Workplace Surveillance / Monitoring Policy: explains the “who, what, when and why” of monitoring, including CCTV, device monitoring, and email review.
- Privacy and data handling documents: helps explain how personal information and monitoring data is collected, stored, and disclosed (internally and externally where relevant).
- Disciplinary and performance processes: ensures monitoring data isn’t used in a way that looks unfair, inconsistent, or rushed.
Depending on your industry, you may also want to formalise additional protections around sensitive business information. An employee privacy handbook can help bring key expectations together in one place, particularly if your team uses multiple systems and you’re handling personal information regularly.
As always, the detail matters. A policy copied from the internet can accidentally contradict your contracts, your actual business practices, or the law in your state.
Common Employee Monitoring Mistakes (And How To Avoid Them)
Most legal issues around employee monitoring don’t happen because an employer is “trying to do the wrong thing.” They happen because monitoring is rolled out quickly, inconsistently, or without proper communication.
Here are some of the most common pitfalls we see.
Monitoring Without Proper Notice
If an employee only discovers monitoring after the fact (for example, you pull logs during an investigation), it can create mistrust fast - and may also be unlawful depending on the type of surveillance and where you operate.
Fix: Make notice part of onboarding, and keep policies accessible and up to date.
Monitoring data can support performance conversations, but it shouldn’t replace good management.
If your only “evidence” of poor performance is a surprise review of browsing history or activity logs, you can end up in a dispute about fairness, context, and whether the expectations were clear.
Fix: Use monitoring to identify issues early, then manage performance through clear KPIs, feedback, and documented processes.
Recording Conversations Without Understanding Consent Rules
Recording calls “for training” feels normal in many industries - but the legal rules can be strict, and they vary by state.
Fix: Build a clear notification and consent approach into your phone system and policies, and keep it consistent.
Monitoring In Private Areas Or Beyond Work Needs
Even if you own the business and the premises, you can’t treat all spaces the same. Surveillance in bathrooms, changing rooms, or other private spaces is generally a major red flag.
Over-monitoring also creates culture issues: it can damage trust and increase turnover (which is expensive for small businesses).
Fix: Limit monitoring to what’s necessary, and regularly review whether the monitoring is still justified.
Poor Security Around Monitoring Data
Storing recordings in unsecured folders, allowing too many people access, or keeping data indefinitely can increase breach risk.
Fix: Set retention periods, restrict access, and implement basic security hygiene.
Key Takeaways
- Employee monitoring can be lawful and commercially sensible in Australia, but it needs to be tied to a clear business purpose and done in a reasonable way.
- Monitoring often triggers multiple legal areas at once, including workplace surveillance rules, recording laws, privacy considerations, and employment law obligations.
- The safest approach is transparent: tell employees what monitoring you use, when it happens, and why it’s in place.
- Strong documentation (contracts and policies) helps you set expectations, reduce disputes, and use monitoring information fairly if issues arise.
- Audio recording and covert surveillance are higher-risk areas - it’s worth getting advice before implementing them.
- Monitoring data should be treated as sensitive: limit access, store it securely, and avoid keeping it longer than necessary.
If you’d like help setting up employee monitoring the right way - including drafting policies and updating your employment documents - reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
