What privacy laws mean for your business
CCTV is one of the most effective ways to protect a workplace, monitor security incidents and provide evidence when something goes wrong. But installing cameras is not simply a matter of choosing the right equipment and putting it on the wall.
Australian businesses need to consider privacy, surveillance and workplace laws when using CCTV, particularly when cameras capture identifiable employees, customers or visitors. The rules can also vary between states and territories.
For businesses in Victoria, there are specific considerations under the Surveillance Devices Act 1999, alongside applicable federal privacy requirements and workplace obligations.
This guide explains the key issues in plain English so you can make more informed decisions about workplace CCTV.
Can you legally install CCTV in an Australian workplace?
Yes. Businesses can generally install CCTV in workplaces, but there are legal and privacy obligations that need to be considered.
The important question is not simply whether you can install a camera. It is where the camera is positioned, what it records, why you are recording it, who can access the footage and how the footage is managed.
If your business is covered by the Privacy Act 1988, identifiable images captured by CCTV can constitute personal information. The Australian Privacy Principles may therefore apply to how that information is collected, used, stored and disclosed.
State and territory surveillance laws can also apply. The Office of the Australian Information Commissioner (OAIC) specifically notes that employers need to comply with relevant Australian, state and territory laws when conducting workplace surveillance.
There is also an important distinction between using CCTV for legitimate security purposes and using it as a tool for continuous employee monitoring.
A camera installed to protect entrances, monitor restricted areas or investigate security incidents is different from a system deliberately designed to track individual employees’ behaviour throughout the working day.
That distinction should form part of your CCTV planning from the beginning.
The 3 legal areas that apply to workplace CCTV
There is no single Australian law that covers every aspect of workplace CCTV. Depending on your business, location and how the system is used, several different legal frameworks may be relevant.
The Federal Privacy Act 1988
The Privacy Act 1988 and Australian Privacy Principles (APPs) apply to Australian Government agencies and many organisations, including organisations with annual turnover above $3 million, subject to exceptions. Some smaller businesses are also covered in specific circumstances.
Importantly, the Privacy Act does not specifically regulate workplace surveillance. However, where CCTV footage contains identifiable information and the Privacy Act applies to the organisation and the relevant activity, privacy obligations can arise.
The OAIC states that businesses covered by the Privacy Act generally need to tell people that their image may be captured before recording takes place. They must also take reasonable steps to protect personal information and destroy or de-identify it when it is no longer needed, subject to applicable requirements.
There is also an employee records exemption under the Privacy Act for certain private-sector employee records where the handling is directly related to the current or former employment relationship. However, businesses should not assume that every piece of CCTV footage involving an employee automatically falls within this exemption. The circumstances and purpose of the information matter.
Victorian Surveillance Devices Act 1999
If your business operates in Victoria, the Surveillance Devices Act 1999 (Vic) is particularly relevant.
The Act regulates the use of surveillance devices, including optical surveillance devices and listening devices. Businesses therefore need to consider not only what their cameras see, but whether the system also captures audio.
The current Act is administered under Victorian legislation and remains in force.
This is one reason a CCTV system should not be assessed purely on its video capabilities. Features such as built-in microphones, audio recording and advanced analytics can introduce additional legal and privacy considerations.
Workplace privacy considerations across Australia
Workplace surveillance requirements are not identical across Australia.
Some jurisdictions have specific workplace surveillance legislation. For example, NSW has a dedicated Workplace Surveillance Act 2005, which includes requirements around notifying employees about camera, computer and tracking surveillance. In certain circumstances, employees must receive written notice before surveillance begins, and workplace cameras must be clearly visible with appropriate signage.
Other jurisdictions rely on different combinations of surveillance, privacy and workplace laws.
The Fair Work Ombudsman also recommends that businesses consider what information is collected, what areas are under surveillance and who can access the resulting information. State and territory laws may limit workplace surveillance.
If your business operates across multiple states, do not assume that a CCTV policy that works in one location automatically satisfies the requirements everywhere.
Where can and can’t you Install CCTV at work?
The location and purpose of a camera are critical.
CCTV is commonly appropriate in areas such as:
- Building entrances and exits
- Reception and public-facing areas
- Car parks and loading areas
- Warehouses and storage areas
- Security-sensitive areas
- Perimeters and external access points
- Areas containing valuable equipment or stock
- Restricted-access zones
However, businesses should be extremely cautious about surveillance in areas where people have a reasonable expectation of privacy.
This includes bathrooms, toilets, showers and change rooms.
Cameras should also not be positioned in a way that unnecessarily captures private activities or areas that do not need to be monitored for the stated security purpose.
Break rooms and staff areas require particular consideration. A camera may sometimes be justified for a specific security reason, but installing cameras simply to observe employee behaviour can create significantly greater privacy and workplace concerns.
Camera placement should also minimise unnecessary collection. A camera covering a doorway does not need to capture an entire neighbouring office if doing so provides no additional security benefit.
What must you tell employees before installing CCTV?
Transparency is one of the most important parts of responsible workplace surveillance.
If your business is covered by the Privacy Act, the OAIC states that people should generally be made aware that their image may be captured before they are recorded. This is commonly achieved through clearly visible CCTV signage and appropriate privacy notices.
The information provided should be meaningful, rather than simply putting up a generic “CCTV in use” sign and assuming the job is done.
Your business should consider explaining:
- That CCTV operates at the workplace
- The areas covered by surveillance
- The purpose of the CCTV
- Who may access recordings
- How footage is stored and protected
- How long footage is retained
- How individuals can raise privacy concerns
For employees, it is also sensible to address CCTV within workplace policies and onboarding information.
In NSW, for example, specific workplace surveillance legislation requires prior written notice to employees in many circumstances, with requirements covering the type of surveillance, how it operates, when it starts and whether it is continuous or intermittent.
The requirements in other states differ, which is why businesses with employees across Australia should obtain advice relevant to each jurisdiction.
Audio Recording: Why it’s a legal minefield
One of the easiest mistakes businesses make when purchasing CCTV is overlooking the microphone.
Many modern security cameras can record both video and audio. That does not mean the audio function should automatically be enabled.
Audio surveillance can be subject to different and potentially stricter rules than visual surveillance.
In Victoria, the Surveillance Devices Act 1999 regulates listening devices and the recording of private conversations. This means businesses need to consider whether their CCTV system is inadvertently recording conversations that it does not need to capture.
The practical solution is simple:
If you do not have a clear business and legal reason to record audio, consider disabling the microphone.
This should be discussed when the CCTV system is specified, rather than discovered after installation.
The same principle applies to advanced camera features such as facial recognition, people tracking or other analytics. The more information a system collects about identifiable individuals, the more carefully the business needs to consider its legal and privacy obligations.
The OAIC treats certain biometric information, including information used for automated biometric verification or identification, as sensitive information under the Privacy Act where the Act applies.
For businesses considering AI-enabled security cameras, privacy should therefore form part of the system design rather than being treated as an issue after installation.
Workplace CCTV Compliance Checklist
Before installing or upgrading CCTV, work through the following checklist.
-
Define the purpose
Document why you need CCTV.
Is the primary purpose security, theft prevention, workplace safety, access control, incident investigation or protection of property?
Avoid collecting more information than you actually need.
-
Identify the laws that apply
Determine which federal, state and territory laws apply to your business and the way you intend to use CCTV.
If you operate across multiple states, check the requirements for each location.
-
Map camera locations
Review every proposed camera location.
Ask whether the camera is necessary and whether its field of view can be reduced to avoid capturing unnecessary areas.
-
Avoid private areas
Do not install cameras in toilets, showers, change rooms or other areas where people have a strong expectation of privacy.
Be particularly careful with cameras covering staff-only areas.
-
Decide whether audio is necessary
Check whether cameras have microphones.
If audio recording is not necessary, consider disabling it.
If audio is required, obtain appropriate legal advice before enabling the feature.
-
Notify employees and visitors
Use appropriate signage and workplace communications to explain that CCTV operates on the premises.
Do not rely on signage alone where more detailed notification or workplace policies are required.
-
Control access to footage
Limit access to authorised personnel.
Your CCTV recordings can contain personal information, so access should be controlled and systems should be appropriately secured.
-
Establish a retention policy
Determine how long footage genuinely needs to be retained.
Do not keep recordings indefinitely simply because the storage system allows it.
The appropriate retention period may depend on your business, the purpose of the recording, contractual requirements, insurance and applicable laws.
-
Secure the system
Protect cameras, recorders, cloud accounts and footage from unauthorised access.
Use strong passwords, appropriate user permissions and security controls.
-
Review the system regularly
Your business can change significantly after the original CCTV installation.
Review camera locations, access permissions, retention periods and policies periodically to ensure they remain appropriate.
Frequently Asked Questions
Do I need employee consent to install workplace CCTV?
Not necessarily.
There is no simple Australia-wide rule that says every employee must consent before a workplace CCTV system can be installed. The requirements depend on the jurisdiction, the purpose of the surveillance, the type of information being collected and the laws applying to the business.
However, transparency and appropriate notification are important. Some jurisdictions have specific employee notification requirements, while privacy laws may also require businesses to provide appropriate notice.
If you are introducing CCTV specifically to monitor employee behaviour or performance, obtain legal advice before proceeding.
Can I record audio with my CCTV?
Do not assume that because your camera has a microphone, you can legally record audio.
Audio surveillance is regulated differently from video surveillance in some jurisdictions, including Victoria. Recording private conversations can create significant legal issues.
If audio is not essential to the security purpose, disabling the microphone may be the more appropriate approach.
How long can I keep CCTV footage?
There is no single Australia-wide retention period that applies to every workplace CCTV system.
The appropriate period depends on why the footage is collected, applicable laws, business requirements and other obligations.
For organisations covered by the Privacy Act, the OAIC states that personal information should be destroyed or de-identified when it is no longer needed, subject to applicable exceptions and requirements.
The best approach is to establish a documented retention policy rather than keeping every recording indefinitely.
Get compliant CCTV installed in your Melbourne workplace
The right CCTV system should protect your people, property and business without creating unnecessary privacy risk.
Controltech Security Solutions can help you assess your site, identify appropriate camera locations and design commercial CCTV systems around your security requirements.
If you’re planning a new installation or reviewing an existing system, book a compliance-aware site assessment to discuss your requirements.
Important: This article provides general information only and is not legal advice. Australian privacy and surveillance laws can vary depending on your business, location and how your CCTV system is used. Obtain independent legal advice about your specific circumstances before implementing workplace surveillance.