Compliance
Employee Monitoring and the Law: What Australian Employers Need to Know
Monitoring work activity on company equipment is generally lawful in Australia when employees are properly notified. The detail is in which state you are in, and what "notified" means.
· 2 min read
This article is general information, not legal advice. Employment and surveillance law varies by state and by country, and the consequences of getting it wrong are real. Get advice for your own situation before rolling anything out.
The general position
In Australia, monitoring employees’ work activity on employer-provided equipment during working hours is generally permissible where employees have been given proper notice. The obligations come from several directions at once: state and territory surveillance devices and workplace surveillance legislation, the federal Privacy Act 1988 and the Australian Privacy Principles, and your obligations under the Fair Work framework and any applicable award or agreement.
Notice is the pivotal requirement
New South Wales is the clearest example: the Workplace Surveillance Act 2005 (NSW) requires written notice at least 14 days before computer surveillance begins, and that notice must state the kind of surveillance, how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it will be ongoing or for a set period. Covert surveillance requires a magistrate’s authority. Other states differ in the detail; the direction of travel is the same.
Practically, this means a rollout starts with a written notice and a communication, not with an installer.
A workable checklist
- Write a monitoring policy that states what is collected, why, who can see it, how long it is kept, and what it will not be used for.
- Give written notice with the lead time your jurisdiction requires — 14 days in NSW.
- Collect only what you can justify against a stated purpose. Scope creep in collection is where trust and compliance both fail.
- Restrict tracking to working hours and work equipment.
- Give employees access to their own data. Several regimes require it and every workforce expects it.
- Set a retention period and actually enforce it.
- Consult where an award, agreement or works council requires it.
If you employ outside Australia
The bar is often higher. Under GDPR you need a lawful basis, usually legitimate interests supported by a documented balancing test, and typically a data protection impact assessment for systematic monitoring. Consent is a weak basis in an employment relationship because it cannot be freely given. Several EU jurisdictions also require works council consultation before deployment, and the Philippines, India and the United States each add their own requirements.
Our FAQs cover what BeActive captures and, more importantly, what it refuses to capture — which is usually the first thing a privacy review asks.