Can Your Employer Monitor Your Emails, Computer and Phone? (Australia 2026)
Australian workplace surveillance laws vary by state. Learn whether your employer can monitor your emails, computer, phone, GPS, and CCTV — from NSW's 14-day written notice rule to Victoria's lack of specific legislation. State-by-state guide plus BYOD and remote work considerations.
The patchwork of Australian workplace surveillance laws
Unlike many countries, Australia does not have a single national workplace surveillance law. Instead, regulation is split between state legislation, the federal Privacy Act 1988, general employment law principles, and specific award or enterprise agreement provisions. The result is a patchwork where your rights depend heavily on which state or territory you work in. New South Wales has the most comprehensive workplace surveillance legislation — the Workplace Surveillance Act 2005, which specifically regulates how employers can monitor employees through computer surveillance, camera surveillance, and tracking surveillance. The ACT has the Workplace Privacy Act 2011, which provides similar protections. Victoria, Queensland, Western Australia, South Australia, Tasmania, and the Northern Territory do not have specific workplace surveillance legislation, instead relying on general surveillance devices acts (which regulate recording of private conversations and optical surveillance), the Privacy Act (for organisations with annual turnover over $3 million), and general employment law principles of good faith and trust and confidence. This means that an employer's ability to monitor you can be significantly different depending on whether you work in Sydney or Melbourne, even if you work for the same company.
NSW: the 14-day notice rule for computer and email monitoring
The NSW Workplace Surveillance Act 2005 is the gold standard for employee surveillance protection in Australia. Under s10 of the Act, an employer must not conduct computer surveillance of an employee unless the employee has been given at least 14 days' written notice that computer surveillance will or may be carried out. The notice must specify the kind of surveillance (email monitoring, internet tracking, keystroke logging, screenshot capture, etc.), how the surveillance will be carried out, when it will start, and whether it will be continuous or intermittent. 'Computer surveillance' is broadly defined to include monitoring or recording of information input or output, emails, internet usage, and any other function of a computer or computer network. The notice must be given to each individual employee — a general notice on a noticeboard or buried in an employee handbook is not sufficient unless it can be shown the employee actually received and acknowledged it. Camera surveillance (CCTV) under s8 must also be notified in advance and cameras must not be placed in change rooms, toilets, or bathing facilities. Tracking surveillance (GPS) under s12 also requires 14 days' written notice. Covert surveillance — monitoring without the employee's knowledge — is only permitted with a covert surveillance authority issued by a magistrate, and only to investigate suspected unlawful activity.
Victoria and Queensland: the privacy gap
Victoria does not have a specific workplace surveillance act. The Surveillance Devices Act 1999 (Vic) regulates the use of listening devices, optical surveillance devices, and tracking devices generally — but it was designed primarily for law enforcement and private investigators, not employers. Under the Act, recording a private conversation without the consent of at least one party is an offence, but single-party consent is sufficient. This means an employer could potentially record a conversation with an employee as long as one party to the conversation (such as a manager) consents. Monitoring of computer use and emails is not specifically regulated, leaving employers to rely on workplace policies and the general employment law obligation of mutual trust and confidence. Queensland similarly lacks specific workplace surveillance legislation. The Invasion of Privacy Act 1971 (Qld) regulates listening devices but does not extend to computer or email monitoring. The Privacy Act 1988 (Cth) applies to private sector organisations with annual turnover exceeding $3 million, but it focuses on the handling of personal information rather than real-time workplace surveillance. In practice, this means employers in Victoria and Queensland have significantly more latitude to monitor employees than employers in NSW, provided they have a clear workplace policy and do not engage in conduct that breaches the implied duty of mutual trust and confidence.
CCTV, GPS tracking, and monitoring personal devices
CCTV in workplaces is common and generally lawful, provided employees are informed of its existence and cameras are not placed in areas where there is a reasonable expectation of privacy (toilets, change rooms, break rooms in some circumstances). In NSW, the 14-day written notice requirement applies. In other states, a clear workplace policy and visible signage are generally considered sufficient. GPS tracking of company vehicles is increasingly common and generally lawful where the employee is informed. In NSW, 14 days' written notice is required. In other states, a workplace policy disclosure is typically sufficient. Tracking personal vehicles is more problematic and may breach surveillance devices legislation in most jurisdictions. Monitoring personal devices is a particularly contentious area. Under Bring Your Own Device (BYOD) policies, employers may require employees to install mobile device management (MDM) software that can monitor location, app usage, emails, and browsing history. The legality of this depends on consent (was the employee properly informed and did they agree?), proportionality (is the monitoring reasonable and necessary for a legitimate business purpose?), and the specific state legislation. Employees should read BYOD policies carefully before signing and understand what level of monitoring they are consenting to.
The federal Privacy Act and the right to disconnect
The Privacy Act 1988 (Cth) applies to federal government agencies and private sector organisations with annual turnover exceeding $3 million (plus some smaller organisations that handle health information or trade in personal information). The Australian Privacy Principles (APPs) within the Act require organisations to handle personal information in accordance with privacy principles including collection limitation (only collect what is necessary), use and disclosure limitations (use only for the purpose it was collected), and security (take reasonable steps to protect personal information). Workplace surveillance data — emails, internet logs, CCTV footage, GPS data — is personal information and must be handled in accordance with the APPs. The new right to disconnect, which took effect for non-small business employers on 26 August 2024 (and for small business employers from 26 August 2025), adds another dimension. Under s333M of the Fair Work Act, employees have the right to refuse to monitor, read, or respond to contact from their employer outside of working hours unless the refusal is unreasonable. While this does not directly regulate surveillance, it may limit an employer's ability to act on monitoring data gathered outside working hours — if an employer penalises an employee for not responding to an after-hours email detected through monitoring, this could breach the right to disconnect.
Remote work and monitoring: the new frontier
The shift to hybrid and remote work has dramatically expanded the scope of workplace surveillance. Employers are increasingly deploying productivity monitoring software that tracks keystrokes, takes periodic screenshots, monitors application usage, tracks mouse movements, and even activates webcams. Some tools calculate a 'productivity score' based on activity levels. The legal position on these tools varies by state. In NSW, the Workplace Surveillance Act applies regardless of where the employee is physically located — so an employer must still provide 14 days' written notice before conducting computer surveillance of a remote worker. In Victoria and Queensland, the lack of specific legislation means remote monitoring is primarily governed by workplace policies and the employment contract. The Fair Work Ombudsman has flagged concerns about excessive remote monitoring and its impact on employee wellbeing. From a practical standpoint, employees who are subject to remote monitoring should be clearly informed about what is being monitored, how the data will be used, who will have access to it, and how long it will be retained. If your employer introduces new monitoring software, ask for these details in writing. If you are in NSW and did not receive a surveillance notice, the monitoring may be unlawful. If you believe monitoring is excessive or unreasonable, raise it with your union, your HSR, or the relevant privacy commissioner.
What to do if you believe surveillance is unlawful
If you believe your employer is conducting unlawful surveillance, your first step depends on your jurisdiction. In NSW, you can contact the Privacy Commissioner of NSW or report to NSW Police (covert surveillance without authority is a criminal offence carrying up to $55,000 in fines or 5 years imprisonment for an individual). In the ACT, contact the ACT Human Rights Commission. In other states, your options are more limited — you may need to rely on the federal Privacy Act (if applicable) by complaining to the Office of the Australian Information Commissioner (OAIC), or pursue a breach of the employment contract through the Fair Work Commission or courts. Regardless of jurisdiction, document what you believe is occurring: note the type of monitoring, when you became aware of it, whether you received any notice, and any impact on you. If you are a union member, raise it with your union — surveillance practices can be challenged through enterprise bargaining and industrial action. If the surveillance involves recording private conversations without proper consent, this may constitute a criminal offence under the relevant state's surveillance devices legislation. You may also have a basis for a general protections claim under the Fair Work Act if the surveillance constitutes adverse action taken because you exercised a workplace right (such as raising a safety concern or making a complaint).
Try these free tools
Official resources
General information and estimates only — not legal, financial, or tax advice. Always verify with the Fair Work Ombudsman (13 13 94) or a qualified professional.
Related articles
Enterprise agreements and Modern Awards both set workplace conditions, but they work differently. Learn the BOOT test, how EAs are made, zombie agreements, and how to check which applies to you.
National Employment Standards (NES) — Complete Summary of Your 11 RightsThe NES gives every Australian employee 11 minimum workplace rights. Here is a plain-English summary of each entitlement — maximum hours, leave, flexible arrangements, termination, and more.
Right to Disconnect Australia — What the New Law Means for YouAustralia's right to disconnect law lets employees refuse unreasonable out-of-hours contact. Learn who it covers, what counts as unreasonable, and how the FWC enforces it.