Who must comply with Workplace Privacy Act 2011 (ACT)?

ACT employers must follow ACT workplace surveillance + privacy framework.

The Workplace Privacy Act 2011 (ACT) regulates how employers conduct optical (camera), data (computer, internet and email) and tracking surveillance of workers. An employer may only conduct surveillance in a workplace after giving each worker written notice, at least 14 days in advance unless the worker agrees to less, stating the kind of device, how and when the surveillance will be conducted, who will be watched, whether it is continuous or ongoing, and how records may be used (s 13). The employer must consult the worker in good faith during the notice period (s 14). Cameras must be clearly visible with signs at each workplace entrance (s 15); data surveillance must follow a written computer-use policy the worker has been made aware of (s 16); tracked vehicles must carry a visible notice (s 17). Surveillance in toilets, change rooms, parent rooms, prayer rooms, sick bays and first-aid rooms is an offence, as is surveillance of workers outside the workplace apart from employer-provided equipment (ss 41-42). Covert surveillance requires a Magistrates Court authority.

Applies when the business has employees.

How the regulator frames it: Employers in the ACT that conduct surveillance of workers, where 'worker' is defined broadly in s 7 (not only employees). Surveillance by agreement (s 19) and surveillance for workplace security (s 36 defences) are treated separately.

What triggers it: Introducing or changing optical, data or tracking surveillance of workers, blocking workers' email or internet access, or seeking to conduct covert surveillance to investigate suspected unlawful activity.

Jurisdiction: Australian Capital Territory law only. A business with no operations in ACT is outside it, whatever the rest of the test says.

Outcome across the 35 industries Rules Mate maps (35 of 35: depends on size or structure).

The answer is the same in every industry: depends on size or structure. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "depends on size or structure".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. You have employees (6–19)
• Pty Ltd company in real estate agents with no employees, turnover $100K–$1M: does not apply. Requires employees.

When due

Written notice at least 14 days before surveillance starts (or a shorter agreed period, or before a new worker starts); consultation throughout the notice period; a covert surveillance authority lasts no more than 30 days, and the employer must report to the court within 30 days after it ends.

Frequency

Ongoing

Evidence to keep

Written surveillance notices or policy covering every s 13(4) item; consultation records; data surveillance and computer-use policy and evidence workers were notified; camera signage at each entrance; tracking notices on vehicles; blocking notices; secure storage and access controls for surveillance records; covert surveillance authority, supervisor appointment and post-authority report.

Status

Current

Priority

High

Maximum penalty: Offences under the Act include up to 20 penalty units for not complying with notified surveillance requirements (s 18), 50 penalty units for covert surveillance without an authority (s 35), for surveillance in prohibited non-work areas (s 41) and for surveillance of workers not at work (s 42), and 50 penalty units for misuse or disclosure of surveillance records (s 22). Inspectors under the Work Health and Safety Act 2011 can issue enforcement notices.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority and carries criminal liability, and is an ongoing duty.

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)