Laws
Workplace surveillance laws in Australia: the APPs
What Employee Monitoring Law Planner sets out for a monitoring practice at a site in Australia: the notice, the written policy, the representative step, recording consent and what is not allowed, each cited to the law or the official guidance behind it. This is not every law that applies there.
- Location
- Australia
- Laws placed
- Australian Privacy Principles (APPs)
- Guidance placed
- ILO Code of Practice on the Protection of Workers' Personal Data 1997 official guidance, not law
- Read on
- 30 Sep 2026
- Conditions
- Australian Privacy Principles (APPs) is placed when you say the Privacy Act applies; "not sure" places it as a question.
- Not held here
- No state or territory given: the state and territory surveillance acts are not placed.
What each practice needs here
20 practice classes| Practice | Representative step | Notice and policy | Recording consent | Not allowed | Paperwork |
|---|---|---|---|---|---|
| AI emotion or sentiment detection | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Keystroke logging | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Screenshots or screen recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Productivity or activity scoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Idle-time tracking | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Webcam or presence checks | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Email and messaging review | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| DLP and email content filtering | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Website or email blocking | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Web and app usage logging | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Biometric time clock | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Access control logs | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| CCTV (break, change or wash rooms) | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| CCTV (work areas) | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| GPS or vehicle telematics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Mobile device location | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Call or speech analytics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementinterception law named | none held | none held |
| Call recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementinterception law named | none held | none held |
| Social media monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Background checks as ongoing monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
Every requirement held here
- Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
- Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
- Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
- Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
- Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
- Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law
Findings a line here can raise
8 of 13- 1 Representative step before start not recorded
- 2 Notice not recorded, or its period not met
- 3 Written policy not recorded where the law asks for one
- 4 Covert monitoring
- 7 Call recording consent
- 10 Continuous, keystroke or screenshot monitoring with no assessment recorded
- 11 Retention not set, or above the period you set
- 13 Lawful basis not recorded for an EU or UK line
Named, not quoted
- Telecommunications (Interception and Access) Act 1979 (Cth): interception of communications passing over a telecommunications system (Australia; named, not quoted)
Named so you know to open them. We do not hold their text and the page does not state what they require beyond the subject.
The provisions cited here
14 provisionsILO code para 12.2(b)Inform and consult representatives before introducing electronic monitoring official guidance, not lawWhere workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.
What a reviewer asks to see: Consultation record for each monitoring system, dated before introduction, with the representatives' views and the employer's response
Where monitoring plans usually fall short: Monitoring tool piloted without consulting the representatives
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
APP 5Notification of the collection of personal information Notify individuals of the collection of their personal information and the matters set out in APP 5.
What a reviewer asks to see: Collection notices (APP 5 matters); Timing of notification
Where monitoring plans usually fall short: No collection notice; Notice missing APP 5 matters
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
ILO code para 6.14(1)Tell workers in advance about monitoring and minimize intrusion official guidance, not lawBefore any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.
What a reviewer asks to see: Monitoring notice per system stating reasons, schedule, methods and data collected, issued before monitoring starts; Proportionality assessment showing less intrusive options considered
Where monitoring plans usually fall short: Notice states only that monitoring may occur, without schedule or methods; Screenshots captured continuously when sampling would serve the purpose
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
ILO code para 5.8Keep workers and representatives informed official guidance, not lawWorkers and their representatives should be told about every data collection process, the rules governing it and their rights.
What a reviewer asks to see: Worker privacy notice covering each collection process, its rules and workers' rights; Record of the information given to worker representatives
Where monitoring plans usually fall short: Notice covers HR records but not monitoring systems
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
APP 1Open and transparent management of personal information Manage personal information in an open and transparent way, including having a clearly expressed and up-to-date APP privacy policy.
What a reviewer asks to see: Published APP privacy policy; Evidence of open data-handling practices; Policy review records
Where monitoring plans usually fall short: No APP privacy policy; Policy out of date; Practices not transparent
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
ILO code para 6.14(2)Secret monitoring only where national law allows it or on reasonable suspicion official guidance, not lawCovert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.
What a reviewer asks to see: Authorization record for each covert monitoring exercise with the suspicion and grounds, or the legal provision relied on; End date and review of each exercise
Where monitoring plans usually fall short: Covert monitoring used for general performance concerns
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
APP 3Collection of solicited personal information Only collect personal information that is reasonably necessary for the entity's functions or activities, by lawful and fair means.
What a reviewer asks to see: Justification of necessity for collection; Lawful and fair collection methods; Heightened protection for sensitive information
Where monitoring plans usually fall short: Over-collection; Unlawful/unfair collection; Sensitive info collected without consent
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
ILO code para 6.14(3)Continuous monitoring only for health and safety or protection of property official guidance, not lawMonitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.
What a reviewer asks to see: Register of continuous monitoring (CCTV, telematics, always-on tracking) with the health, safety or property ground for each
Where monitoring plans usually fall short: Always-on webcam or activity tracking for remote staff justified by productivity
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
ILO code para 5.6Monitoring data not the sole basis of performance evaluation official guidance, not lawOutput from electronic surveillance should never be the sole input when a worker's performance is judged.
What a reviewer asks to see: Appraisal procedure listing the evidence sources considered besides monitoring data; Sample appraisals showing other inputs (manager review, outputs, feedback)
Where monitoring plans usually fall short: Productivity scores from activity tracking used as the whole appraisal
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
APP 11Security of personal information Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.
What a reviewer asks to see: Information security controls for personal information; Destruction/de-identification of redundant PI
Where monitoring plans usually fall short: PI not secured; Redundant PI retained
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
ILO code para 8.5Retain only as long as the purpose justifies official guidance, not lawKeep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.
What a reviewer asks to see: Retention schedule for worker data including monitoring records, citing purpose, legal requirement or proceedings; Deletion logs
Where monitoring plans usually fall short: Monitoring recordings kept indefinitely; Unsuccessful applicants' data kept without their agreement
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
ILO code para 5.1Fair, employment-related processing within the law official guidance, not law5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.
What a reviewer asks to see: Register of worker data processing activities, each with its employment-related reason and legal basis
Where monitoring plans usually fall short: Data collected for reasons unrelated to the job, such as off-duty social media activity
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
ILO code para 6.5No data on sex life, beliefs or convictions, save exceptionally official guidance, not lawEmployers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.
What a reviewer asks to see: Data inventory confirming these categories are not collected, or the documented exception and legal basis where they are
Where monitoring plans usually fall short: Criminal record checks for every role regardless of relevance
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026
ILO code para 6.6No data on union membership or activities unless required official guidance, not lawEmployers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.
What a reviewer asks to see: Review of HR and monitoring systems confirming union data are not collected except under a stated legal or agreement basis
Where monitoring plans usually fall short: Monitoring tools flag union-related email or chat
Source: ILO Code of Practice on the Protection of Workers' Personal Data 1997 (official guidance, not law), read 30 Sep 2026