Victorian workplace surveillance laws: employee monitoring
What Employee Monitoring Law Planner sets out for a monitoring practice at a site in Victoria: the notice, the written policy, the representative step, recording consent and what is not allowed, each cited to the law or the official guidance behind it. This is not every law that applies there.
- Location
- Victoria
- Laws placed
- Australian Privacy Principles (APPs); Victorian Surveillance Devices Act 1999
- Guidance placed
- ILO Code of Practice on the Protection of Workers' Personal Data 1997 official guidance, not law
- Read on
- 30 Sep 2026
- Conditions
- Australian Privacy Principles (APPs) is placed when you say the Privacy Act applies; "not sure" places it as a question.
What each practice needs here
20 practice classes| Practice | Representative step | Notice and policy | Recording consent | Not allowed | Paperwork |
|---|---|---|---|---|---|
| AI emotion or sentiment detection | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Keystroke logging | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Screenshots or screen recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Productivity or activity scoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Idle-time tracking | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Webcam or presence checks | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, washrooms, change, lactation rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) | statutory requirementreasonably necessary (when you say the Privacy Act applies) |
| Email and messaging review | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| DLP and email content filtering | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Website or email blocking | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Web and app usage logging | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Biometric time clock | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Access control logs | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| CCTV (break, change or wash rooms) | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, washrooms, change, lactation rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) | none held |
| CCTV (work areas) | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | statutory requirementnot in toilets, washrooms, change, lactation rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) | none held |
| GPS or vehicle telematics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Mobile device location | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Call or speech analytics | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementevery party (non-party)interception law named | statutory requirementnot in toilets, washrooms, change, lactation rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) | none held |
| Call recording | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | statutory requirementevery party (non-party)interception law named | statutory requirementnot in toilets, washrooms, change, lactation rooms (where it covers toilets or washrooms, change or locker rooms, showers or bathing areas and lactation, nursing or parent rooms) | none held |
| Social media monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
| Background checks as ongoing monitoring | none held | statutory requirementAPP 5 notice (when you say the Privacy Act applies) | none held | none held | none held |
Every requirement held here
- Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
- Recording consentstatutory requirementA listening device on a private conversation you are not part of needs every party's consent. Vic SDA s 6
- Recording consentstatutory requirementInterception of communications passing over a telecommunications system. Telecommunications (Interception and Access) Act 1979 (Cth), named, not quoted
- Personal devicesstatutory requirementTracking a worker as a person, or through their own phone or vehicle, needs the worker's consent. (if personal devices are monitored) Vic SDA s 8
- Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
- Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law
- Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
- Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law
Findings a line here can raise
10 of 13- 1 Representative step before start not recorded
- 2 Notice not recorded, or its period not met
- 3 Written policy not recorded where the law asks for one
- 4 Covert monitoring
- 5 Monitoring a place the law keeps private
- 7 Call recording consent
- 10 Continuous, keystroke or screenshot monitoring with no assessment recorded
- 11 Retention not set, or above the period you set
- 12 Personal devices monitored
- 13 Lawful basis not recorded for an EU or UK line
Named, not quoted
- Telecommunications (Interception and Access) Act 1979 (Cth): interception of communications passing over a telecommunications system (Australia; named, not quoted)
Named so you know to open them. We do not hold their text and the page does not state what they require beyond the subject.
The provisions cited here
18 provisionsILO code para 12.2(b)Inform and consult representatives before introducing electronic monitoring official guidance, not lawWhere workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.
APP 5Notification of the collection of personal information Notify individuals of the collection of their personal information and the matters set out in APP 5.
ILO code para 6.14(1)Tell workers in advance about monitoring and minimize intrusion official guidance, not lawBefore any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.
ILO code para 5.8Keep workers and representatives informed official guidance, not lawWorkers and their representatives should be told about every data collection process, the rules governing it and their rights.
APP 1Open and transparent management of personal information Manage personal information in an open and transparent way, including having a clearly expressed and up-to-date APP privacy policy.
ILO code para 6.14(2)Secret monitoring only where national law allows it or on reasonable suspicion official guidance, not lawCovert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.
Vic SDA s 9BNo optical or listening device in workplace toilets, washrooms, change rooms or lactation rooms No employer knowingly installs, uses or maintains a camera or other optical surveillance device, or any listening device, to watch, listen to, record or monitor what workers do or say in workplace toilets, washrooms, lactation rooms or change rooms. This applies whether or not the workers consent. Exceptions: warrants and emergency authorisations, Commonwealth law, and where a condition of a liquor licence under the Liquor Control Reform Act 1998 requires it. Maximum for an individual: 2 years' imprisonment or a 240 penalty unit fine (both level 7), or both; otherwise 1200 penalty units; officers of a body corporate who fail to exercise due diligence are liable (s 32A), and for an unincorporated body or firm the members of its committee of management or the partners are liable (s 9D).
Vic SDA s 7No optical device on a private activity without every party's consent No one knowingly installs, uses or maintains an optical surveillance device to watch or visually record a private activity they are not part of unless every party to it has given express or implied consent. Exceptions: warrants and emergency authorisations, Commonwealth law, law enforcement officers on premises with the occupier's authority where reasonably necessary to protect someone's lawful interests, and incidental recording by the overt use of body-worn cameras or tablets by police, ambulance officers and prescribed persons. Maximum for an individual: 2 years' imprisonment or a 240 penalty unit fine (both level 7), or both; for a body corporate 1200 penalty units. Officers who fail to exercise due diligence are also liable (s 32A). Because a private activity excludes activity outside a building or where the parties ought to expect being observed, openly signed workplace CCTV in ordinary work areas is generally outside s 7, while cameras watching activity in places where workers reasonably expect privacy need consent (and Part 2A bans some places outright).
Vic SDA s 6No listening device on a private conversation without every party's consent No one knowingly installs, uses or maintains a listening device to eavesdrop on, listen to, record or monitor a private conversation they are not part of unless every party to it has given express or implied consent. Exceptions: warrants and emergency authorisations, Commonwealth law, specified law enforcement safety monitoring with one party's consent, and incidental recording by the overt use of body-worn cameras or tablets by police, ambulance officers and prescribed persons. Maximum for an individual: 2 years' imprisonment or a 240 penalty unit fine (both level 7), or both; for a body corporate 1200 penalty units. Officers who fail to exercise due diligence are also liable (s 32A). A party to a conversation recording it is not caught by s 6, but communicating or publishing that recording is restricted by s 11. For employers, audio capture of workers' private conversations (for example audio-enabled CCTV, call or meeting recording by a non-party) needs the consent of every party.
APP 3Collection of solicited personal information Only collect personal information that is reasonably necessary for the entity's functions or activities, by lawful and fair means.
ILO code para 6.14(3)Continuous monitoring only for health and safety or protection of property official guidance, not lawMonitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.
ILO code para 5.6Monitoring data not the sole basis of performance evaluation official guidance, not lawOutput from electronic surveillance should never be the sole input when a worker's performance is judged.
APP 11Security of personal information Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.
ILO code para 8.5Retain only as long as the purpose justifies official guidance, not lawKeep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.
Vic SDA s 8No tracking device without the consent of the person, or of whoever holds the object No one knowingly installs, uses or maintains a tracking device to find where a person is without that person's express or implied consent, or where an object is unless whoever lawfully possesses or controls it has given express or implied consent. Exceptions: warrants and emergency authorisations, Commonwealth law, and orders under the Serious Offenders Act 2018, parole orders, community correction orders, prison governor orders and bail electronic monitoring conditions. Maximum for an individual: 2 years' imprisonment or a 240 penalty unit fine (both level 7), or both; for a body corporate 1200 penalty units. Officers who fail to exercise due diligence are also liable (s 32A). Employer GPS on vehicles or devices it lawfully possesses or controls rests on that possession or control; tracking a worker as a person, or through their own phone or vehicle, needs the worker's consent.
ILO code para 5.1Fair, employment-related processing within the law official guidance, not law5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.
ILO code para 6.5No data on sex life, beliefs or convictions, save exceptionally official guidance, not lawEmployers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.
ILO code para 6.6No data on union membership or activities unless required official guidance, not lawEmployers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.