ACT Workplace Privacy Act: employee monitoring laws
What Employee Monitoring Law Planner sets out for a monitoring practice at a site in the Australian Capital Territory: the notice, the written policy, the representative step, recording consent and what is not allowed, each cited to the law or the official guidance behind it. This is not every law that applies there.
- Location
- The Australian Capital Territory
- Laws placed
- Australian Privacy Principles (APPs); ACT Workplace Privacy Act 2011
- Guidance placed
- ILO Code of Practice on the Protection of Workers' Personal Data 1997 official guidance, not law
- Read on
- 30 Sep 2026
- Conditions
- Australian Privacy Principles (APPs) is placed when you say the Privacy Act applies; "not sure" places it as a question.
What each practice needs here
20 practice classes| Practice | Representative step | Notice and policy | Recording consent | Not allowed | Paperwork |
|---|---|---|---|---|---|
| AI emotion or sentiment detection | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside a workplace (if it runs outside work) | none held |
| Keystroke logging | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Screenshots or screen recording | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Productivity or activity scoring | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Idle-time tracking | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Webcam or presence checks | statutory requirementconsult workers | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Email and messaging review | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| DLP and email content filtering | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Website or email blocking | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Web and app usage logging | statutory requirementconsult workers | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Biometric time clock | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside a workplace (if it runs outside work) | none held |
| Access control logs | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside a workplace (if it runs outside work) | none held |
| CCTV (break, change or wash rooms) | statutory requirementconsult workers | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| CCTV (work areas) | statutory requirementconsult workers | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| GPS or vehicle telematics | statutory requirementconsult workers | statutory requirementnotice 14 daysnotice on vehicleAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Mobile device location | statutory requirementconsult workers | statutory requirementnotice 14 daysnotice on vehicleAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Call or speech analytics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementinterception law named | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Call recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementinterception law named | statutory requirementnot in toilets, change, prayer, first-aid rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas, lactation, nursing or parent rooms, prayer rooms and first-aid rooms or sick bays)not outside a workplace (if it runs outside work) | none held |
| Social media monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside a workplace (if it runs outside work) | none held |
| Background checks as ongoing monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside a workplace (if it runs outside work) | none held |
Every requirement held here
- Representative stepstatutory requirementConsult the workers in good faith about how the surveillance will be run, for at least the 14-day notice period. ACT WPA s 14
- Noticestatutory requirementWritten notice at least 14 days before the start, giving the device, the method, who is watched, the start date, continuous or intermittent, set period or open-ended, the uses of the records, and the right to be consulted. ACT WPA s 13
- Noticestatutory requirementThe camera plainly visible and a sign at every entrance. ACT WPA s 15
- Noticestatutory requirementA plainly visible notice on the tracked vehicle or thing, or other reasonable steps to tell workers. ACT WPA s 17
- Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
- Written policystatutory requirementData surveillance only under a notified policy saying how computer resources may be used, what is logged, who sees the logs, and how compliance is audited. ACT WPA s 16
- Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
- Covert monitoringstatutory requirementNo covert surveillance of a worker without a covert surveillance authority from the Magistrates Court. ACT WPA s 35
- Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
- Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
- Retentionstatutory requirementDestroy or permanently de-identify records no longer needed for a purpose the Act allows. ACT WPA s 44(2)
- Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
- Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law
Findings a line here can raise
10 of 13- 1 Representative step before start not recorded
- 2 Notice not recorded, or its period not met
- 3 Written policy not recorded where the law asks for one
- 4 Covert monitoring
- 5 Monitoring a place the law keeps private
- 6 Monitoring outside work
- 7 Call recording consent
- 10 Continuous, keystroke or screenshot monitoring with no assessment recorded
- 11 Retention not set, or above the period you set
- 13 Lawful basis not recorded for an EU or UK line
Named, not quoted
- Telecommunications (Interception and Access) Act 1979 (Cth): interception of communications passing over a telecommunications system (Australia; named, not quoted)
Named so you know to open them. We do not hold their text and the page does not state what they require beyond the subject.
The provisions cited here
23 provisionsACT WPA s 14Good faith consultation with workers on proposed surveillance Where s 13 notice is required, the employer consults the worker in good faith about how the surveillance will be run, for no less than the s 13(3) notice period. Good faith means the worker has a real chance to shape how the surveillance is carried out.
ILO code para 12.2(b)Inform and consult representatives before introducing electronic monitoring official guidance, not lawWhere workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.
ACT WPA s 13Written notice of surveillance, 14 days ahead, with the required content Workplace surveillance of a worker is lawful only after the employer has given that worker written notice under s 13, and only as the notice describes. Timing: no later than 14 days before the start date; or within a shorter period the worker accepts; or, where a new worker joins while surveillance is already running or due to begin inside 14 days, before their first day. Content: the type of surveillance device; the method; the people usually or routinely watched; the start date; continuous or intermittent operation; a fixed period or open-ended; what the employer may use and disclose the records for; and the worker's right under s 14 to consult the employer about how it is run. An employer policy can serve as the notice. Optical surveillance at a site the worker does not usually work at needs no notice. Failure to comply is an offence (s 18(1), 20 penalty units).
ACT WPA s 15Optical surveillance: device clearly visible and signs at each entrance An employer uses an optical surveillance device to conduct surveillance of a worker only if the device (camera housings and similar fittings that normally reveal one count as the device) can be plainly seen in the monitored workplace, and a plainly visible sign at every way into that workplace tells people they may be under surveillance there. Failure is an offence (s 18(2), 20 penalty units).
ACT WPA s 17Tracking: visible notice on the tracked vehicle or thing An employer conducts surveillance of a worker that tracks a vehicle or other thing with a tracking device only if a plainly visible notice on the vehicle or item says it is tracked. Where fixing a notice to the item is not reasonably practicable, the employer instead takes reasonable steps to tell workers the item is tracked. Failure is an offence (s 18(4), 20 penalty units).
APP 5Notification of the collection of personal information Notify individuals of the collection of their personal information and the matters set out in APP 5.
ILO code para 6.14(1)Tell workers in advance about monitoring and minimize intrusion official guidance, not lawBefore any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.
ILO code para 5.8Keep workers and representatives informed official guidance, not lawWorkers and their representatives should be told about every data collection process, the rules governing it and their rights.
ACT WPA s 16Data surveillance: policy on computer resource use, logging, access and auditing, notified in advance An employer uses a data surveillance device to conduct surveillance of a worker only in line with an employer policy on data surveillance of workers, notified to the worker before the surveillance so that the worker can reasonably be assumed to know and understand it. The policy states how the employer's computer resources (including internet access and electronic communication applications) may and must not be used, which usage information is recorded in logs and who can see those logs, and the way the employer checks and audits compliance with the policy. Failure is an offence (s 18(3), 20 penalty units).
APP 1Open and transparent management of personal information Manage personal information in an open and transparent way, including having a clearly expressed and up-to-date APP privacy policy.
ACT WPA s 35No covert surveillance of a worker without a covert surveillance authority An employer runs no covert surveillance of workers at a workplace unless it is done under a covert surveillance authority from the Magistrates Court. Other exclusions: law enforcement officers acting under a law; optical surveillance in a correctional centre or place of lawful custody; optical surveillance of casino operations under the Casino Control Act 2006; optical surveillance of legal proceedings or proceedings before a law enforcement agency by a person exercising a statutory function. The employer bears an evidential burden on these. Offence: 50 penalty units.
ILO code para 6.14(2)Secret monitoring only where national law allows it or on reasonable suspicion official guidance, not lawCovert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.
ACT WPA s 41No surveillance in toilets, change rooms, showers, parent or nursing rooms, prayer rooms, sick bays or first-aid rooms No employer surveils a worker in any prohibited non-work area of a workplace, namely a toilet facility; a change room; a shower or other bathing facility; a parent or nursing room; a prayer room; a sick bay; a first-aid room; or any other area prescribed by regulation. Offence: 50 penalty units.
ACT WPA s 42No surveillance of a worker who is not in a workplace, with limited exceptions No employer surveils a worker who is outside any workplace. Exceptions (the employer carries an evidential burden): data surveillance of how the worker uses equipment or resources the employer supplied or paid for; tracking through a device whose tracking cannot be switched off; and an employer that is a law enforcement agency. Offence: 50 penalty units.
APP 3Collection of solicited personal information Only collect personal information that is reasonably necessary for the entity's functions or activities, by lawful and fair means.
ILO code para 6.14(3)Continuous monitoring only for health and safety or protection of property official guidance, not lawMonitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.
ILO code para 5.6Monitoring data not the sole basis of performance evaluation official guidance, not lawOutput from electronic surveillance should never be the sole input when a worker's performance is judged.
ACT WPA s 44(2)Destroy or permanently de-identify surveillance records no longer needed Once a surveillance record has no remaining use or disclosure purpose that the Act permits, the employer takes reasonable steps to destroy it or permanently de-identify it. Offence: 20 penalty units.
APP 11Security of personal information Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.
ILO code para 8.5Retain only as long as the purpose justifies official guidance, not lawKeep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.
ILO code para 5.1Fair, employment-related processing within the law official guidance, not law5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.
ILO code para 6.5No data on sex life, beliefs or convictions, save exceptionally official guidance, not lawEmployers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.
ILO code para 6.6No data on union membership or activities unless required official guidance, not lawEmployers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.