CCTV Laws In Australia: Privacy And Compliance

Yes, CCTV is generally legal for Australian businesses, but you need a genuine business reason, clear notice or signage, sensible camera placement, and secure handling of footage. There's no fixed Australia-wide rule for how long CCTV footage must be kept, but you should only keep it for as long as you need it, often 30 to 90 days unless an incident requires longer.

Installing CCTV can help deter theft, support staff safety, manage incidents and give you peace of mind. Once your cameras can identify customers, employees, contractors or visitors, you're likely handling personal information, so privacy and surveillance rules matter.

The good news is that most businesses can use CCTV lawfully and responsibly with the right setup, notices, policies and access controls.

What Are The CCTV Laws In Australia?

There's no single CCTV law that applies to every business in Australia. Instead, a few legal frameworks work together:

• State and territory surveillance laws: These regulate the use of surveillance devices, especially audio recording and recording private activities or private conversations.
• Workplace surveillance laws: Some jurisdictions, especially New South Wales and the ACT, have specific rules for monitoring staff, including notice requirements for camera surveillance.
• Federal privacy law: The Privacy Act 1988 (Cth) governs how covered businesses collect, use, store and disclose personal information, which can include identifiable CCTV footage.
• Other site-specific rules: Commercial lease terms, shopping centre rules, strata rules, insurance requirements and local council conditions may add extra requirements.

As a starting point, your business can usually install CCTV to protect people, premises, stock and equipment if you're transparent about it and avoid areas where people have a strong expectation of privacy.

Video and audio should be treated differently. Video-only CCTV in visible business areas is often manageable with notice, signage and privacy controls. Audio recording is much more restricted because it can capture private conversations. If your cameras have built-in microphones, it's usually safer to disable audio unless you have checked the rules and have a clear consent process. For a broader view of the rules, have a look at recording laws in Australia and how they apply to businesses.

What Are The CCTV Signage Requirements?

There's no one national CCTV sign template that every business must use. However, clear signage is one of the easiest ways to show that your surveillance is open, fair and transparent.

Your signs should be visible before a person enters a monitored area where possible. For a shop, that usually means a sign at the front entrance and, if needed, additional signs near counters, stock rooms, car parks or other monitored areas. For an office or warehouse, place signs at staff entrances, reception and any relevant operational areas.

A practical CCTV sign should say:

• That CCTV cameras are in use.
• The main reason, such as safety, security, loss prevention or incident management.
• The business name or site operator.
• Where a person can find more privacy information, such as your Privacy Policy or contact email.

For example: CCTV cameras operate on these premises for safety, security and loss prevention. Footage may be reviewed by authorised staff and disclosed where legally required or reasonably necessary. For privacy enquiries, contact privacy@example.com.

If you're monitoring employees, signage alone is usually not enough. You should also give written notice and have workplace surveillance rules that explain where cameras are located, what they record, why they're used, who can access footage and when footage may be reviewed.

CCTV In The Workplace: Notice, Consent And Employee Rights

Using CCTV at work is common, but the rules tighten when employees are involved. Across Australia, you should tell staff that surveillance is happening, where cameras are located, and why you're using them.

Some jurisdictions go further. In New South Wales, the Workplace Surveillance Act 2005 requires employers to give employees at least 14 days written notice before camera surveillance starts, unless the employee agrees to a shorter period. The notice needs to cover matters such as the kind of surveillance, how it will be carried out, when it will start, whether it's continuous or intermittent, and whether it's for a limited period or ongoing. Cameras must also be clearly visible and signs must notify people that they may be under surveillance.

The ACT has workplace privacy laws that also require notice and consultation steps for workplace surveillance. Other states and territories rely more heavily on surveillance devices laws, privacy principles where they apply, and general employment law expectations of reasonableness and fairness.

Practical tips for workplace compliance include:

• Give clear written notice to staff before surveillance starts and whenever there's a meaningful change.
• Use conspicuous signage at entrances and in monitored areas.
• Limit cameras to areas where there's a legitimate business purpose, such as entry points, counters, shop floors, warehouses, loading docks and stock rooms.
• Avoid private spaces, including bathrooms, showers, change rooms and similar areas.
• Be cautious around break rooms, prayer rooms and first aid rooms. If monitoring is genuinely needed, keep it narrow and explain why.
• Set rules on who can view footage and when, such as for a safety incident, suspected theft, stock discrepancy or lawful request.

You generally don't need employee consent for ordinary video CCTV if you have a lawful and reasonable business purpose and you meet the notice requirements that apply to your location. However, consent may be needed for higher-risk uses, such as audio recording, covert surveillance, biometric or facial recognition features, or using footage in marketing.

If you also monitor business calls or have devices that capture sound, remember that audio is highly regulated. Before enabling mics or recording calls, check your obligations around cameras in the workplace and consider whether you need separate consent and processes under business call recording laws.

How Long Is CCTV Footage Kept In Australia?

There's no fixed legal retention period that says every Australian business must keep CCTV footage for a set number of days. The practical rule is to keep footage only for as long as you need it for the reason you collected it.

Many businesses use a rolling retention period of 30 days. Some use 14, 60 or 90 days depending on the size of the site, insurance requirements, security risks and how quickly incidents are usually detected. For example, a small cafe may only need 30 days, while a warehouse with delayed stock reconciliations may choose 60 or 90 days.

You should keep footage longer if it's needed for a specific incident, workplace investigation, insurance claim, police request or legal obligation. In that case, copy and preserve only the relevant clip rather than keeping all footage indefinitely.

A sensible retention process looks like this:

• Set a default deletion period, such as 30 days, in your CCTV policy.
• Use automatic overwriting or deletion where your system allows it.
• Create an incident folder for clips that need to be preserved.
• Record why the clip was saved, who authorised it and when it should be reviewed for deletion.
• Delete saved clips when the incident, claim or investigation no longer requires them.

Holding onto footage for years just in case can increase your privacy and data breach risk. If a hacker, former employee or unauthorised person accesses old footage you no longer needed, the issue is harder to justify.

Privacy Act CCTV Rules: When Footage Is Personal Information

CCTV footage that can identify a person is personal information. If your business is covered by the Privacy Act, you need to comply with the Australian Privacy Principles, often called the APPs.

The Privacy Act often applies to businesses with annual turnover of more than $3 million, as well as some smaller businesses, including many health service providers, certain credit reporting participants, businesses that trade in personal information, and some contracted service providers to government. Franchises and groups should check their structure carefully because coverage can depend on how the business operates.

In plain English, if the Privacy Act applies to your business, you should:

• Collect CCTV footage only where it's reasonably necessary for your business functions, such as safety, security or incident management.
• Collect footage in a lawful, fair and transparent way.
• Tell people about the collection through signs, workplace notices and your privacy materials.
• Securely store footage and restrict access to authorised people.
• Use footage only for the reason you collected it, or a related purpose the person would reasonably expect, unless another legal basis applies.
• Delete or de-identify footage when you no longer need it.
• Have a process for access requests and privacy complaints.

Having a clear, up-to-date Privacy Policy that covers CCTV is a practical way to show you're collecting and handling footage transparently. It should explain why you capture video, how long you retain it, who you share it with, such as a cloud vendor or security company, and how someone can contact you with questions.

Security matters too. If your CCTV system is compromised and footage is accessed or leaked, it may trigger obligations under the Notifiable Data Breaches scheme. It's wise to implement a Data Breach Response Plan so your team knows what to do if something goes wrong.

Even if your business isn't currently covered by the Privacy Act because of the small business exemption, customers, staff, insurers and regulators still expect you to handle footage carefully.

Where Can You Install Cameras, And Where Should You Avoid Them?

The law focuses on reasonableness and privacy expectations. As a rule of thumb, cameras are easier to justify in areas where people would reasonably expect to be observed and harder to justify in places where privacy is expected.

Typical lower-risk areas, with notice, include:

• Entrances, exits and reception areas.
• Retail floors and public-facing counters.
• Warehouses, loading docks and stock rooms.
• Car parks and building exteriors.
• Cash registers, safes and other high-risk transaction points.

Areas to avoid include:

• Bathrooms and showers.
• Change rooms and locker rooms.
• Rooms used for changing, bathing or medical treatment.
• Prayer rooms, first aid rooms and similar sensitive spaces, unless there's a very strong and carefully managed reason.
• Any area where a person would reasonably expect privacy.

What about staff rooms and kitchens? Some businesses monitor general staff areas to protect property or manage safety risks, but you should be able to justify the need. Keep coverage as unobtrusive as possible, avoid capturing private conversations where you can, and make sure your workplace notices are clear.

Be careful about where cameras point. Don't capture neighbouring homes, private yards, neighbouring offices or sensitive sites if you can avoid it. Adjust camera angles, zoom, motion zones and privacy masking settings to reduce over-collection.

Can You Share CCTV Footage Or Post It Online?

You should be very careful before sharing CCTV footage. Even if the footage was lawfully recorded, sharing it can create a separate privacy, confidentiality, employment or reputational issue.

Common sharing scenarios include:

• Police requests: You can usually provide relevant footage to police where there's a lawful request or you reasonably believe it's necessary for law enforcement. Keep a record of what was provided, to whom and why.
• Insurance claims: You may share relevant footage with your insurer or broker if it's needed for a claim and aligns with your Privacy Policy and insurance arrangements.
• Customer requests: If a customer asks for footage showing them, check whether the Privacy Act applies, whether other people are visible, and whether you can blur or crop footage before providing access.
• Employee requests: Handle staff requests consistently with your workplace policies, privacy obligations and any employee records rules that apply.
• Other businesses or members of the public: Avoid handing over footage casually. Ask why they need it, whether police or an insurer should request it instead, and whether disclosure is lawful and proportionate.

Posting CCTV footage on social media is rarely a good idea. A clip of a suspected shoplifter, workplace incident or customer dispute may identify people, invite harassment, prejudice an investigation and breach privacy or workplace obligations. If you want to use footage for training or marketing, get consent or de-identify it properly. If you plan to publish identifiable images or video, align your process with Australia's photography consent laws.

If someone is requesting CCTV footage from a private company, the answer isn't always automatic. If the Privacy Act applies and the footage is personal information about that person, they may have access rights, but the business can still need to protect other people's privacy, confidential information and security. A common approach is to verify the requester's identity, locate the footage, assess whether others are identifiable, then provide a blurred clip, still image, supervised viewing or written summary where appropriate.

Key Takeaways

• CCTV is usually legal for Australian businesses if you have a genuine purpose, give clear notice, use appropriate signage and avoid private areas.
• There's no universal CCTV retention period in Australia. Keep footage only as long as needed, often 30 to 90 days, and preserve incident clips separately.
• Workplace CCTV needs extra care, especially in NSW and the ACT where specific notice rules can apply.
• Identifiable CCTV footage can be personal information, so Privacy Act obligations may apply to collection, storage, access, sharing and deletion.
• Don't share footage casually or post it on social media. Police, insurer, customer and employee requests should be handled through a controlled process.
• Disable audio by default, lock down system access, use a CCTV policy and review your setup regularly.

If you'd like help with CCTV policies, workplace surveillance notices, privacy compliance or data processing terms, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.