Employee monitoring laws in New South Wales: the Workplace Surveillance Act 2005
What Employee Monitoring Law Planner sets out for a monitoring practice at a site in New South Wales: the notice, the written policy, the representative step, recording consent and what is not allowed, each cited to the law or the official guidance behind it. This is not every law that applies there.
- Location
- New South Wales
- Laws placed
- Australian Privacy Principles (APPs); NSW Workplace Surveillance Act 2005; NSW Surveillance Devices Act 2007
- Guidance placed
- ILO Code of Practice on the Protection of Workers' Personal Data 1997 official guidance, not law
- Read on
- 30 Sep 2026
- Conditions
- Australian Privacy Principles (APPs) is placed when you say the Privacy Act applies; "not sure" places it as a question.
What each practice needs here
20 practice classes| Practice | Representative step | Notice and policy | Recording consent | Not allowed | Paperwork |
|---|---|---|---|---|---|
| AI emotion or sentiment detection | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside work (if it runs outside work) | none held |
| Keystroke logging | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Screenshots or screen recording | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Productivity or activity scoring | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Idle-time tracking | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Webcam or presence checks | none held | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Email and messaging review | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| DLP and email content filtering | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Website or email blocking | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notifiedpolicy, delivery notice | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Web and app usage logging | none held | statutory requirementnotice 14 daysAPP 5 notice (when you say the Privacy Act applies)written policy, notified | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Biometric time clock | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside work (if it runs outside work) | none held |
| Access control logs | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside work (if it runs outside work) | none held |
| CCTV (break, change or wash rooms) | none held | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| CCTV (work areas) | none held | statutory requirementnotice 14 daysvisible, signsAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| GPS or vehicle telematics | none held | statutory requirementnotice 14 daysnotice on vehicleAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Mobile device location | none held | statutory requirementnotice 14 daysnotice on vehicleAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Call or speech analytics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementevery party, or narrow exceptioninterception law named | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Call recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementevery party, or narrow exceptioninterception law named | statutory requirementnot in change rooms, toilets, showers (where it covers toilets or washrooms, change or locker rooms and showers or bathing areas)not outside work (if it runs outside work) | none held |
| Social media monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside work (if it runs outside work) | none held |
| Background checks as ongoing monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot outside work (if it runs outside work) | none held |
Every requirement held here
- Noticestatutory requirementWritten notice to each employee at least 14 days before the surveillance starts (email counts), saying the kind, how it is done, when it starts, whether continuous or intermittent, and whether for a set period or ongoing. A new starter gets it before they start. NSW WSA s 10
- Noticestatutory requirementCameras clearly visible, and signs at every entrance to the place under surveillance. NSW WSA s 11
- Noticestatutory requirementA plainly visible notice on the vehicle or thing tracked. NSW WSA s 13
- Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
- Written policystatutory requirementComputer surveillance only as a written policy on staff computer use allows, and only after the employee has been told of it in advance so they can be taken to know and understand it. NSW WSA s 12
- Written policystatutory requirementBlock an email or website only under an email and internet policy notified in advance, and send a prevented delivery notice when an email is stopped. NSW WSA s 17
- Recording consentstatutory requirementRecording a private conversation as a party needs every principal party's consent, or one party's where recording is reasonably necessary to protect that party's own interests; listening to a conversation you are not part of is not allowed. NSW SDA s 7(1)(a)NSW SDA s 7(1)(b) and (3)
- Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
- Covert monitoringstatutory requirementNo covert surveillance of employees at work without a covert surveillance authority from a Magistrate; surveillance without the notice Part 2 asks for is covert. NSW WSA s 19NSW WSA s 22
- Covert monitoringverification requiredNo communication, publication or possession of records obtained by a device used outside the conditions of the Act. NSW SDA s 11NSW SDA s 12NSW SDA s 14
- Personal devicesstatutory requirementTracking a person, or monitoring a computer they own, needs their consent; the employer's own devices rest on its possession or control. (if personal devices are monitored) NSW SDA s 9NSW SDA s 10
- Personal devicesstatutory requirementA camera in an employee's home or belongings needs the owner's or occupier's consent. (if personal devices are monitored) NSW SDA s 8
- Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
- Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
- Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
- Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law
Findings a line here can raise
11 of 13- 1 Representative step before start not recorded
- 2 Notice not recorded, or its period not met
- 3 Written policy not recorded where the law asks for one
- 4 Covert monitoring
- 5 Monitoring a place the law keeps private
- 6 Monitoring outside work
- 7 Call recording consent
- 10 Continuous, keystroke or screenshot monitoring with no assessment recorded
- 11 Retention not set, or above the period you set
- 12 Personal devices monitored
- 13 Lawful basis not recorded for an EU or UK line
Named, not quoted
- Telecommunications (Interception and Access) Act 1979 (Cth): interception of communications passing over a telecommunications system (Australia; named, not quoted)
Named so you know to open them. We do not hold their text and the page does not state what they require beyond the subject.
The provisions cited here
31 provisionsILO code para 12.2(b)Inform and consult representatives before introducing electronic monitoring official guidance, not lawWhere workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.
NSW WSA s 10Written notice of surveillance at least 14 days before it starts Before surveillance of an employee begins, the employer gives the employee written notice (email counts as writing). The notice goes out no later than 14 days ahead of the start, unless the employee agrees to a shorter period; where surveillance is already running when someone is hired, or will start within 14 days of their first day, the notice is given before that person starts work. The notice states: the kind of surveillance (camera, computer or tracking); how it will be carried out; when it will start; whether it will be continuous or intermittent; and whether it will run for a specified limited period or be ongoing. No notice is needed for camera surveillance at a workplace that is not one of the employee's usual workplaces. Surveillance without a compliant notice is covert surveillance (s 19).
NSW WSA s 11Camera surveillance: cameras visible and signs at each entrance Camera surveillance of an employee is carried out only where the cameras (or housings or other fittings that ordinarily reveal a camera) can be clearly seen in the place under surveillance and signs that can be plainly seen at every way into that place tell people they may be under surveillance there. These conditions apply in addition to the s 10 notice.
NSW WSA s 13Tracking surveillance: visible notice on the tracked vehicle or thing Tracking surveillance of an employee that tracks a vehicle or other thing is carried out only where a plainly visible notice on the vehicle or item shows that it is subject to tracking surveillance. This is in addition to the s 10 notice to the employee.
APP 5Notification of the collection of personal information Notify individuals of the collection of their personal information and the matters set out in APP 5.
ILO code para 6.14(1)Tell workers in advance about monitoring and minimize intrusion official guidance, not lawBefore any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.
ILO code para 5.8Keep workers and representatives informed official guidance, not lawWorkers and their representatives should be told about every data collection process, the rules governing it and their rights.
NSW WSA s 12Computer surveillance: written policy notified in advance Computer surveillance of an employee is carried out only as the employer's written policy on monitoring staff computer use allows, and only after the employee has been told of that policy in advance in a way that makes it reasonable to assume the employee knows and understands it. Monitoring outside what the policy describes is not covered.
NSW WSA s 17Blocking email or internet access only under a notified policy, with prevented delivery notice The employer stops an email to or from an employee getting through, or blocks access to a website, only when acting under an email and internet access policy notified to the employee in advance so that the employee can reasonably be taken to know and understand it. When an email is blocked, the employee is told as soon as practicable (a prevented delivery notice), by email or otherwise. No notice is needed where the email was blocked as spam (a commercial electronic message under the Spam Act 2003), because it or an attachment could have interfered with or damaged the employer's computers, network, programs or data, or because reasonable persons would regard it as menacing, harassing or offensive, or, for an outgoing email, where the employer did not know and could not reasonably know which employee sent it or that an employee sent it. The policy may not allow blocking merely because a message comes from an industrial organisation of employees or its officer, or because the email or website contains information about industrial matters. Maximum penalty 50 penalty units.
APP 1Open and transparent management of personal information Manage personal information in an open and transparent way, including having a clearly expressed and up-to-date APP privacy policy.
NSW WSA s 19No covert surveillance of employees at work without a covert surveillance authority The employer does not conduct, or arrange, covert surveillance of staff at work unless a covert surveillance authority issued by a Magistrate authorises it. Covert surveillance is any surveillance of an employee at work that does not meet Part 2 (notice, camera visibility and signs, computer policy, tracking notice). Maximum penalty 50 penalty units. Section 21 excludes law enforcement officers acting under other laws, cameras in correctional centres or custody, casino monitoring under the Casino Control Act 1992 and cameras recording legal proceedings; s 22 gives a security defence.
NSW WSA s 22Security surveillance defence: sole security purpose, real risk and prior written notice Where an employer relies on the defence for covert surveillance kept for workplace security, it must be able to prove that: the surveillance was solely to protect the security of the workplace or the people in it, with any surveillance of employees incidental to that; a real and significant risk existed that security would be compromised without covert surveillance; and the workforce there, or a body representing a substantial share of it, received written notice of the planned security surveillance before it began. A record from such surveillance that is unrelated to security is admitted against an employee in disciplinary or legal proceedings only where the desirability of admitting it outweighs the undesirability of evidence obtained that way.
NSW SDA s 11No communication or publication of private conversations or activities obtained unlawfully Text not verified against the current consolidation; open the Act before relying on it. An amending Act awaits commencement by proclamation: this text may change from that date.No one publishes or communicates to anyone a private conversation or an activity, or a recording or account of either, that came to their knowledge directly or indirectly through use of a listening, optical surveillance or tracking device in breach of Part 2. Maximum penalty for a corporation 500 penalty units; for an individual 100 penalty units, 5 years' imprisonment, or both. Permitted: communication to a party to the conversation or activity, with the express or implied consent of all principal parties, to investigate or prosecute an offence against s 11, or in proceedings for an offence under the Act; and to the minimum reasonably needed where serious violence, substantial property damage or a serious narcotics offence is imminent. Knowledge obtained lawfully may still be communicated even if also obtained unlawfully.
NSW SDA s 12No possession of a record known to be obtained unlawfully Text not verified against the current consolidation; open the Act before relying on it. An amending Act awaits commencement by proclamation: this text may change from that date.No one holds a recording of a private conversation or activity knowing it was obtained, directly or indirectly, by use of a listening, optical surveillance or tracking device in breach of Part 2. Maximum penalty for a corporation 500 penalty units; for an individual 100 penalty units, 5 years' imprisonment, or both. Holding it is allowed for the purposes of prosecuting an offence against the Act, with the express or implied consent of all principal parties or participants, or where the record was passed on in circumstances that did not breach Part 2.
NSW SDA s 14No communication or publication of computer information from data surveillance outside the Act Text not verified against the current consolidation; open the Act before relying on it. An amending Act awaits commencement by proclamation: this text may change from that date.No one publishes or communicates information about the input into, or output from, a computer obtained directly or indirectly by using a data surveillance device in breach of Part 2. Maximum penalty for a corporation 500 penalty units; for an individual 100 penalty units, 5 years' imprisonment, or both. Permitted: communication to the person lawfully possessing or controlling the computer, with that person's express or implied consent, to investigate or prosecute an offence against s 14, in proceedings for an offence under the Act, and to the minimum reasonably needed where serious violence, substantial property damage or a serious narcotics offence is imminent. Information obtained lawfully may still be used even if also obtained unlawfully.
ILO code para 6.14(2)Secret monitoring only where national law allows it or on reasonable suspicion official guidance, not lawCovert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.
NSW WSA s 15No surveillance in change rooms, toilets, showers or bathing facilities The employer does not carry out, or cause, any surveillance of its employees in a change room, toilet, shower or other bathing area at a workplace (up to 50 penalty units). A covert surveillance authority cannot authorise surveillance in these places either (s 20(3)).
NSW WSA s 16No surveillance with a work device while the employee is not at work The employer does not use a work surveillance device (a device used to watch the employee at work) to carry out surveillance of the employee at any time the employee is outside what s 5 counts as being at work (neither at a workplace of the employer nor elsewhere performing its work). The exception is computer surveillance of the employee's use of equipment or resources the employer provided or paid for. Law enforcement agencies as employers are outside the section. Up to 50 penalty units.
NSW SDA s 7(1)(a)No listening device to overhear or record a private conversation the user is not a party to No one knowingly installs, uses, causes to be used or maintains a listening device to eavesdrop on, listen to, record or monitor a private conversation they are not taking part in. Maximum penalty for a corporation 500 penalty units; for an individual 100 penalty units, 5 years' imprisonment, or both. Exceptions include use under a warrant or emergency authorisation, under Commonwealth law (such as the Commonwealth interception and access legislation), unintentional hearing, and specified police uses. For an employer this rules out audio capture of staff conversations (for example audio-enabled CCTV in offices, meeting rooms or break areas) where the conversations are private and the employer is not a party.
NSW SDA s 7(1)(b) and (3)Recording a private conversation as a party: consent of all principal parties or a narrow exception A party to a private conversation does not knowingly use a listening device to record it unless all the principal parties consent, expressly or impliedly, or one principal party consents and the recording is either reasonably necessary to protect that party's lawful interests or not made with the aim of passing the conversation, or an account of it, to people outside it. Penalties as for s 7(1)(a). For recorded calls or meetings, the practical route is an announcement or other basis from which every principal party's consent can be shown.
APP 3Collection of solicited personal information Only collect personal information that is reasonably necessary for the entity's functions or activities, by lawful and fair means.
ILO code para 6.14(3)Continuous monitoring only for health and safety or protection of property official guidance, not lawMonitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.
ILO code para 5.6Monitoring data not the sole basis of performance evaluation official guidance, not lawOutput from electronic surveillance should never be the sole input when a worker's performance is judged.
APP 11Security of personal information Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.
ILO code para 8.5Retain only as long as the purpose justifies official guidance, not lawKeep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.
NSW SDA s 9Tracking device only with the consent of the person, or of whoever holds the object No one knowingly installs, uses or maintains a tracking device to find where a person is without that person's express or implied consent, or where an object is unless whoever lawfully possesses or controls it has given express or implied consent. Maximum penalty as for s 7. Exceptions cover warrants or emergency authorisations, Commonwealth law, and installation, use or maintenance for a lawful purpose. Employer GPS on its own vehicles or devices rests on the employer's possession or control, together with the Workplace Surveillance Act 2005 notice duties; tracking an employee personally, or through their own phone or car, needs that person's consent.
NSW SDA s 10Data surveillance device only with consent to entry or interference No one knowingly installs, uses or maintains a data surveillance device at premises to capture or watch what goes into or comes out of a computer there, where that requires going onto the premises without the owner's or occupier's express or implied consent, or tampering with the computer or a network on the premises when whoever lawfully possesses or controls it has given no express or implied consent. Maximum penalty as for s 7. Exceptions cover warrants, Commonwealth law and the Witness Protection Act 1995. Monitoring software on employer-owned and controlled computers and networks rests on the employer's own consent, with the Workplace Surveillance Act 2005 policy and notice duties; monitoring an employee's personally owned computer needs that person's consent.
NSW SDA s 8Optical surveillance device only with consent to entry or interference No one knowingly installs, uses or maintains an optical surveillance device on or in premises, a vehicle or another object to watch or visually record an activity, where that requires going onto the premises or into the vehicle without the owner's or occupier's express or implied consent, or tampering with the vehicle or object when whoever lawfully possesses or controls it has given no express or implied consent. Maximum penalty as for s 7. Exceptions cover warrants, Commonwealth law, device retrieval, specified law enforcement searches, Tasers and police body-worn video. An employer installing cameras on its own premises or vehicles has the owner's or occupier's consent; the concern arises for devices placed in employees' homes, private vehicles or belongings, or on a client's or landlord's premises without their consent.
ILO code para 5.1Fair, employment-related processing within the law official guidance, not law5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.
ILO code para 6.5No data on sex life, beliefs or convictions, save exceptionally official guidance, not lawEmployers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.
ILO code para 6.6No data on union membership or activities unless required official guidance, not lawEmployers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.