Can An Employer Read Employee Work Messages?

Mia runs a design studio in Melbourne. After a client complained that a staff member shared project files in a private chat, Mia wanted to check the employee's work laptop, Slack messages and emails to see what had happened.

That instinct is understandable. When your business owns the systems, pays for the devices and carries the client risk, you need visibility. But employee messages can also involve privacy, surveillance and workplace law issues.

The good news is this doesn't have to be complicated. With the right policy, employee monitoring notice and process, you can usually monitor work messages in a way that's fair, lawful and easier to explain if someone pushes back.

Can An Employer Read Employee Work Messages In Australia?

Yes, you can often read employee work messages in Australia, but only if you do it lawfully, reasonably and in line with any notice and policy requirements that apply to your workplace.

A work message might include:

• Emails sent from a business email account
• Messages in work tools like Slack, Microsoft Teams, Google Chat or project management software
• Texts or app messages on a business-owned phone
• Customer messages sent through your CRM, social media inbox or booking platform
• Files and comments saved in business cloud storage

The key distinction is that ownership of the device or account doesn't give you unlimited rights. You still need to think about the purpose of the monitoring, whether staff have been told about it and whether the monitoring goes further than necessary.

For example, checking a shared support inbox to manage customer complaints is usually very different from secretly reading a staff member's personal WhatsApp messages because they left the app open on a work computer.

A practical way to look at it's this: if you can clearly explain the business reason, point to a policy the employee has seen and show that you only checked what you needed to check, you're in a much stronger position.

What Notice Do You Need Before Monitoring Work Emails Or Chats?

It depends on where your employees work, because workplace surveillance rules are state and territory based as well as affected by general privacy and employment laws.

New South Wales and the ACT have specific workplace surveillance laws that are especially relevant to computer monitoring.

In NSW, the Workplace Surveillance Act 2005 generally requires you to give employees at least 14 days' written notice before starting surveillance, unless the employee agrees to a shorter period. For new employees in NSW, if the surveillance will apply from when they start, notice must be given before they start work. Computer surveillance must also usually be carried out in line with a policy that has been notified to employees in advance.

In the ACT, the Workplace Privacy Act 2011 also has notice requirements for surveillance, including written notice generally at least 14 days before surveillance starts, unless a shorter period is agreed. For new employees in the ACT, if monitoring will apply from day one, give the written notice before they start and make sure any shorter notice period is agreed.

Other states and territories may not have the same workplace surveillance notice rules, but surveillance devices laws, privacy duties, employment contracts and workplace policies can still matter. Secret recording of audio, for example, can be risky under state and territory surveillance devices legislation.

As a practical baseline, even if you're outside NSW or the ACT, you should tell staff in writing:

• What systems, accounts and devices may be monitored
• Why monitoring may happen, such as security, compliance, performance, customer service or investigation purposes
• When monitoring may occur, including whether it's ongoing or only triggered by a concern
• Who may access the information
• How the information may be used

Say Mia employs two designers in Sydney and wants to start monitoring Slack and business email from 15 March. If she gives written notice and the policy on 1 March, that gives 14 days' notice. If she wants to start earlier, she should get agreement to the shorter notice period and keep a record of it.

What Should Your Workplace Surveillance Policy Say?

Your workplace surveillance policy should clearly tell employees what you monitor, why you monitor it and what rules apply when they use your business systems.

This policy often works alongside an acceptable use policy or broader workplace policy. The surveillance policy explains your monitoring rights. The acceptable use policy explains what employees can and can't do on work devices, networks and accounts.

A good policy should feel practical, not like a hidden trap. If your team understands the rules from day one, you're less likely to end up in an argument about whether someone had a reasonable expectation of privacy.

Workplace Surveillance Policy Outline

Here's a fill-in outline you can use as a starting point. A lawyer should tailor it before you use it, because templates often miss state-based notice rules and the way your tools actually work.

1. Purpose: Explain the business reasons for monitoring, such as security, customer service, compliance, productivity or protecting confidential information.
2. Systems Covered: List the accounts, devices, networks and platforms that may be monitored.
3. Types Of Monitoring: State whether you monitor emails, chat messages, logins, file access, device activity, internet use or app usage.
4. When Monitoring Happens: Explain whether monitoring is ongoing, periodic, automated or only used when an issue arises.
5. Personal Use Rules: Set out whether limited personal use is allowed and what privacy limits apply.
6. Access And Authorisation: Identify who can approve access to messages and who can view the results.
7. Use Of Information: Explain that information may be used for investigations, disciplinary processes, security reviews or legal compliance.
8. Storage And Security: Explain how records will be stored, protected and deleted when no longer needed.
9. Employee Acknowledgement: Include a process for employees to confirm they have received and understood the policy.

You should also be careful with wording like all messages are private or we never monitor accounts. If that's not true, it can make it harder to rely on monitoring later.

Can You Monitor Personal Messages On A Work Device?

Sometimes, but you should be much more cautious with personal messages than work messages, even if the personal messages are on a work device.

Many employees use work laptops or phones for small personal tasks, like checking a personal email, messaging a partner or logging into a personal app. Your acceptable use policy or employee privacy handbook can limit or ban personal use, but in practice you still need to handle personal material carefully.

For example, if an employee uses a business phone to send personal texts, you may be able to see billing records or device data. But opening personal conversations and reading every message may be hard to justify unless there's a clear business reason and your policy supports it.

A safer approach is to minimise what you access. If you're investigating a leak of client files, you might search for the file name, client name or relevant dates in work systems first. You don't usually need to read unrelated personal chats to do that.

You should also avoid accessing personal accounts in a way that could breach the platform's terms, confidentiality obligations or computer access laws. Don't use saved passwords to log into someone's personal email or social media account just because they used a work laptop.

Your policy should make this clear:

• Work systems are primarily for business use
• Limited personal use may be permitted, if that's your position
• Employees shouldn't expect complete privacy when using work systems
• You won't intentionally access personal content unless there's a legitimate reason
• Employees should keep personal accounts separate from business systems where possible

This balance protects your business while reducing the risk that monitoring feels excessive or unfair.

How Do Privacy Laws Apply To Employee Messages?

Privacy laws can apply, but the answer depends on your business, the people involved and the type of information you're collecting.

The Privacy Act 1988 includes an employee records exemption for many private sector employers. In simple terms, some acts or practices directly related to a current or former employment relationship and an employee record may be exempt from the Australian Privacy Principles.

That exemption isn't a blank cheque. It may not cover job applicants, contractors, customers, suppliers or personal information that isn't directly related to the employment relationship. It also won't remove your obligations under workplace surveillance laws, confidentiality duties, employment contracts or general workplace fairness principles.

If your business is covered by the Privacy Act, such as because you have annual turnover over $3 million or fall into a specific covered category, you should also think about your privacy policy, privacy collection notice and data handling practices. Even smaller businesses can be caught in some industries or if they handle certain types of information.

Modern messaging tools create extra privacy risk because one thread can include many types of information at once. A Teams chat might include employee performance comments, client personal information, health information, passwords, commercial secrets and jokes between staff. If you export or review the whole chat history, you're collecting more than you may need.

You should also keep the Fair Work Act 2009 in mind. The right to disconnect started for non-small business employers on 26 August 2024 and for small business employers on 26 August 2025. This doesn't ban after-hours messages, but employees may have a workplace right to refuse unreasonable out-of-hours contact or monitoring expectations. Your messaging and monitoring practices shouldn't punish staff for using that right.

What Should You Do Before Checking Messages?

Before checking employee messages, pause and follow a simple process. This helps you get the information you need without creating a bigger workplace problem.

Step 1: Identify The Business Reason

Write down why you need to access the messages. For example, you're investigating a customer complaint, suspected misuse of confidential information, harassment complaint, fraud concern, cyber incident or repeated failure to respond to clients.

Step 2: Check Your Policy And Notice

Confirm whether your workplace surveillance policy, acceptable use policy, employment contract, remote work policy or onboarding materials cover the type of monitoring you want to do. If your employee is in NSW or the ACT, check whether the required notice was given.

Step 3: Limit The Search

Use targeted search terms, dates, channels and accounts. Avoid browsing broadly through private or unrelated content. If you only need messages from a customer support channel for 1 to 7 May, don't export a staff member's entire chat history for the year.

Step 4: Control Who Sees The Information

Keep access tight. Usually, only the person managing the issue, a senior decision-maker and your adviser should see the material. Save copies securely and avoid forwarding sensitive messages around the business.

Step 5: Give The Employee A Fair Process

If you plan to rely on messages for a warning, dismissal or other disciplinary step, give the employee a fair chance to respond. The process will depend on the seriousness of the issue and your contracts and policies.

Say you run a cafe in Brisbane and a customer complains that bookings were ignored. Your policy says the cafe may review the shared booking inbox and work Instagram messages for customer service purposes. You check the booking inbox for the relevant week, find three missed messages and discuss them with the rostered manager. That's a targeted business review. It's very different from opening the manager's personal Instagram account to see what they were doing after work.

Key Takeaways

• You can often read work emails and messages, but you need a clear business reason, proper notice and a policy that supports the monitoring.
• NSW and the ACT have specific workplace surveillance laws, including 14 days' written notice in many cases.
• Your workplace surveillance policy should work together with your acceptable use policy, employment contracts and privacy documents.
• Personal messages on work devices need extra care. Keep your searches targeted and avoid accessing personal accounts.
• Privacy, confidentiality and Fair Work Act risks can still arise, especially with modern chat tools that mix work, personal and customer information.
• A clear process before checking messages can help you protect your business and avoid unnecessary disputes.

If you'd like help with your workplace surveillance policy, acceptable use rules, employment contracts or privacy documents, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.