Who must comply with Workplace Surveillance Act 2005 (NSW)?

NSW employers conducting workplace surveillance must give notice + meet specific conditions.

The Workplace Surveillance Act 2005 (NSW) governs camera, computer and tracking surveillance of employees while they are at work. Surveillance must not start without written notice (email counts) given at least 14 days beforehand unless the employee agrees to less, stating the kind of surveillance, how and when it will be carried out, whether it is continuous or intermittent, and whether it is for a limited period or ongoing (s 10). Cameras, or casings indicating a camera, must be clearly visible with signs at each entrance (s 11); computer surveillance must follow an employer policy the employee has been notified of in advance (s 12); tracked vehicles or things must carry a visible notice (s 13). Surveillance that does not follow Part 2 is covert surveillance, which is an offence unless authorised by a covert surveillance authority obtained to establish whether particular employees are engaged in unlawful activity at work, never to monitor work performance. Surveillance in change rooms, toilets and showers, and surveillance with a work device when the employee is not at work (other than computer surveillance of employer-provided equipment), are prohibited.

Applies when the business has employees.

How the regulator frames it: Employers in NSW (including related corporations treated as one employer under s 4, and the Crown) that carry out, or cause to be carried out, surveillance of their employees while at work.

What triggers it: Introducing or changing camera, computer or tracking surveillance of employees, blocking employee emails or website access, using or disclosing surveillance records, or seeking to conduct covert surveillance.

Jurisdiction: New South Wales law only. A business with no operations in NSW is outside it, whatever the rest of the test says.

Outcome across the 35 industries Rules Mate maps (35 of 35: depends on size or structure).

The answer is the same in every industry: depends on size or structure. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "depends on size or structure".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. You have employees (6–19)
• Pty Ltd company in real estate agents with no employees, turnover $100K–$1M: does not apply. Requires employees.

When due

Written notice at least 14 days before surveillance commences (or before a new employee starts work if surveillance is already running or begins within 14 days); computer surveillance and email/internet blocking policies notified in advance; prevented-delivery notices given as soon as practicable when an employee's email is blocked.

Frequency

Ongoing

Evidence to keep

Section 10 surveillance notices and delivery records; computer surveillance and email/internet access policy with evidence employees were notified; camera signage at each entrance; tracking notices on vehicles; prevented-delivery notices; register of uses and disclosures of surveillance records against the s 18 permitted purposes; any covert surveillance authority, surveillance supervisor details and report on its use.

Status

Current

Priority

High

Maximum penalty: Up to 50 penalty units for surveillance in change rooms, toilets or bathing facilities (s 15), surveillance of employees not at work (s 16), unlawful blocking of emails or internet access (s 17) and covert surveillance without an authority (s 19); up to 20 penalty units for using or disclosing surveillance records outside the permitted purposes (s 18)

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority and carries criminal liability, and is an ongoing duty.

Regulated by Information and Privacy Commission NSW.

IPC NSW: NSW privacy and government information regulator. Administers PPIPA and HRIPA.

• Information and Privacy Commission NSW

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)