Workplace Surveillance Policy Template

If you run a small business, it’s completely normal to want clarity over what’s happening in your workplace. Maybe you’ve had stock go missing, customer complaints about service, or safety concerns after hours. Or maybe you’re simply scaling up and want better systems in place.

That’s where workplace surveillance comes in - things like CCTV, computer monitoring and GPS tracking can be useful tools when they’re used the right way.

But surveillance is also one of those areas where “just installing the camera” can create legal and employee relations issues fast. Having a clear workplace surveillance policy template helps you set expectations, meet your legal obligations, and reduce the risk of disputes - but it’s important to remember a policy alone won’t automatically make surveillance lawful if the setup or method doesn’t comply with the rules in your state or territory.

Below, we’ll walk you through what a workplace surveillance policy template for Australian small businesses should include, how to roll it out properly, and common mistakes to avoid.

What Is A Workplace Surveillance Policy (And Why Do You Need One)?

A workplace surveillance policy is a written policy that explains:

what types of surveillance you use (or may use) at work;
why you use surveillance (for example: safety, security, productivity, compliance);
when and how surveillance occurs;
how you handle surveillance records (like CCTV footage or computer logs); and
what employees should expect (including their responsibilities).

For small businesses, a workplace surveillance policy is often the difference between surveillance being a sensible operational tool and surveillance becoming a source of conflict or legal exposure.

Why A Policy Matters In Practice

Even where workplace surveillance is legal, problems often arise because it wasn’t communicated properly. A policy helps you:

set clear expectations about monitoring (reducing surprise and mistrust);
show you have a legitimate business reason for surveillance;
support fair processes if you later rely on surveillance information for performance management or investigations;
reduce privacy complaints by documenting how footage/data is handled;
standardise decision-making (so managers aren’t “making it up” on the spot).

If you already have employment documentation in place (like an Employment Contract), your surveillance policy can also work alongside it to reinforce what’s expected at work.

What Laws Apply To Workplace Surveillance In Australia?

Workplace surveillance can be regulated by a mix of laws depending on:

which state or territory your workplace is in;
what type of surveillance you’re using (video, audio, computer, GPS); and
how the information is collected, stored and used.

In other words: there isn’t one single “workplace surveillance law” that applies the same way to every business in Australia.

State And Territory Differences

Some states and territories have specific workplace surveillance legislation (with strict notice requirements and rules around covert surveillance). Others rely more heavily on broader surveillance devices laws, privacy frameworks, and general employment/WHS principles.

For example, NSW and the ACT have dedicated workplace surveillance laws that can require advance written notice to employees (often around 14 days, subject to limited exceptions) for overt surveillance like cameras, computer monitoring and tracking. Covert surveillance is generally heavily restricted and may require a specific authority (such as a magistrate’s approval) and a defined investigation purpose. That means it’s not usually something a small business can simply decide to do on its own.

Other jurisdictions don’t have an equivalent “workplace surveillance” statute, but that doesn’t mean anything goes. Each state and territory has its own rules about surveillance devices (especially audio), and it’s worth understanding the compliance landscape around recording laws. Queensland businesses should also be careful about the rules on recording conversations in Queensland, particularly if you are considering audio in addition to video.

Even if your intention is reasonable (for example, preventing theft), the method matters. Covert surveillance, audio recording, or recording in sensitive spaces can trigger serious legal issues.

Privacy, Data Handling And Practical Risk

Surveillance creates “information”, and how you store and use that information matters. Depending on your circumstances, surveillance records may be “personal information” under privacy laws. Many small businesses are exempt from parts of the federal Privacy Act 1988 (Cth) (for example, if they have annual turnover under $3 million and don’t fall within an exception), but that exemption isn’t universal and it can be lost in certain situations (such as some health-related businesses or where you trade in personal information). Even where an exemption applies, you should still handle surveillance data carefully because other laws, contractual obligations, confidentiality duties, and employee relations risks can still apply.

If your business handles personal information (including potentially through surveillance records), you should also be thinking about broader privacy compliance, including having a clear Privacy Policy where appropriate.

It’s also important to remember that workplace surveillance issues often show up in employment disputes. If surveillance is used unfairly, inconsistently, or without the required notice, it can undermine a performance process or a disciplinary investigation.

Key Sections To Include In A Workplace Surveillance Policy Template

If you’re creating or updating a workplace surveillance policy template, these are the sections we generally recommend including for an Australian small business.

1. Purpose Of Surveillance

Start by clearly stating why your business uses surveillance. This helps show that monitoring is not “just because”, and that it’s linked to legitimate operations.

Common purposes include:

work health and safety (WHS);
security of premises, staff, customers and stock;
preventing theft, fraud or unauthorised access;
supporting investigations into incidents or complaints; and
protecting confidential information and business systems.

Tip: Keep it specific to your business. For example, a retail store may focus on theft prevention and customer safety, while a professional services business may focus on cybersecurity and confidentiality.

2. Scope: Who And Where The Policy Applies

Spell out who is covered by the policy, such as:

employees (full-time, part-time and casual);
contractors and consultants;
labour hire workers;
interns and volunteers; and
anyone who uses your systems, vehicles, or enters monitored areas.

Also define the workplace locations covered, such as:

your office, retail store, warehouse, or workshop;
vehicles owned or leased by the business;
remote work environments where business devices are used; and
digital systems (email, cloud platforms, CRMs, time tracking tools).

3. Types Of Surveillance Used

This is where your policy becomes truly practical. List the kinds of surveillance you use (or may use), and describe them in plain English.

Typical categories include:

Camera surveillance (CCTV): where cameras are located, what they generally capture, and whether they record continuously.
Computer and internet monitoring: monitoring login activity, browsing history on work devices, email usage, file access, or security alerts.
Telephone/communications monitoring: call monitoring or recording (if applicable), including customer service lines.
Tracking/GPS: vehicle tracking or device location tracking (common for deliveries, trades, mobile service businesses).

If you’re using cameras, it’s also worth considering your broader approach to workplace camera compliance, because the legal and practical issues are rarely limited to “where the camera sits”. Many businesses find it helpful to align surveillance policies with their broader understanding of workplace camera laws.

4. Notice, Signage And Communication

Your policy should explain how you notify workers (and where relevant, visitors) that surveillance is happening. Keep in mind that in some jurisdictions (such as NSW and the ACT) notice requirements are not just “best practice” - they can be a legal requirement, and they may need to be given a set period in advance and in a particular form.

This can include:

providing the policy during onboarding;
asking staff to acknowledge the policy (for example, signed acknowledgement or HR platform acceptance);
putting up signage for CCTV in monitored areas;
notifying staff when new surveillance is introduced (for example, adding cameras, adding GPS to vehicles, or implementing new monitoring software).

Practically, the best time to communicate surveillance is before you need to rely on it. Clear notice reduces the chance of disputes later, especially if surveillance data becomes relevant to a complaint or investigation.

5. Prohibited Areas And Reasonable Expectations Of Privacy

A well-drafted workplace surveillance policy template should also draw a firm line around where surveillance will not occur.

While the rules vary by jurisdiction and surveillance type, it’s generally sensible (and often essential) to state that surveillance will not be used in areas where people expect privacy, such as:

bathrooms and change rooms;
designated breastfeeding or first aid rooms (depending on circumstances);
private areas not connected to work activities.

Including this section can also help reassure staff that your approach is measured, not intrusive.

6. Access, Storage And Retention Of Surveillance Records

This part is often missed in DIY templates, but it’s critical.

Your policy should cover:

who can access surveillance data (for example, the owner, a specific manager, HR, IT administrator);
where it is stored (on-site, in the cloud, external provider);
how long it is kept (a retention period that makes sense for your risk profile and legal needs);
how it is secured (passwords, restricted access, encryption where relevant);
when it may be shared (for example, with police, insurers, legal advisors, or regulators).

From a small business perspective, this is about more than compliance. If you don’t control access to footage or logs, you increase the risk of privacy complaints, reputational damage, and internal conflict.

7. How Surveillance Information Can Be Used

Be upfront about the ways surveillance records may be used. This helps prevent confusion and sets a baseline for fairness.

For example, you might state that surveillance information may be used:

to investigate suspected misconduct (e.g. theft, violence, bullying, serious policy breaches);
to investigate incidents, accidents or near misses;
to manage cybersecurity incidents and unauthorised access attempts;
as evidence in insurance claims or legal disputes; and
for operational review (for example, safety compliance, after-hours access, or customer incidents).

If you also intend to use surveillance for performance management, be careful. It’s not that it can never be relevant, but it should be handled consistently and with a fair process, particularly if it could lead to warnings or termination.

8. Employee Responsibilities And Acceptable Use

Your policy should also explain what you expect of staff, including that they must:

follow security procedures (like not sharing passwords);
use work devices appropriately;
not interfere with or disable surveillance equipment; and
report incidents that may require review of footage or logs (such as accidents, security events, serious customer complaints).

This section pairs well with other workplace policies (for example, IT acceptable use policies), but your surveillance policy should still be understandable as a stand-alone document.

9. Complaints And Questions Process

Finally, include a simple “what to do if you have concerns” section. This helps you deal with issues early and internally.

For example:

who staff should speak to (owner, manager, HR);
how complaints will be handled; and
how requests for footage will be assessed (if you allow this at all, and under what conditions).

How To Roll Out A Workplace Surveillance Policy Without Causing Pushback

Even a perfect workplace surveillance policy template can fall apart if you roll it out in a way that feels sudden or secretive.

For most small businesses, the goal is to maintain trust while still protecting the business.

Give Clear Notice And Explain The “Why”

When you introduce or update the policy, explain the business reasons in plain language. For example:

“We’ve had some after-hours security issues, so we’re upgrading CCTV.”
“We’re improving cybersecurity and will be monitoring login attempts and system access.”
“We want to keep staff safe at closing time and have a record if an incident occurs.”

This framing matters. People tend to accept surveillance more readily when it’s tied to safety and security, rather than general suspicion.

Get Written Acknowledgement

It’s a good idea to have employees acknowledge they’ve received and understood the policy (especially for new starters). While acknowledgement is helpful, it won’t override any legal restrictions on surveillance methods in your state or territory, so it should sit alongside (not replace) proper compliance.

Often this is done alongside employment documentation, including a tailored Employment Contract for your permanent staff and other relevant onboarding documents.

Train Your Managers (Even If You Only Have One)

In small businesses, “management” might just be you - or a single supervisor. Either way, the person who accesses surveillance data needs to understand:

what they can and can’t do with footage/logs;
how to avoid using surveillance unfairly (for example, selectively monitoring one person); and
how to document decisions if surveillance is part of an investigation.

This is one of the most effective ways to reduce risk, because many disputes arise from inconsistent or emotional decision-making in the moment.

Common Mistakes Small Businesses Make With Workplace Surveillance

Workplace surveillance issues usually don’t come from “bad intentions”. More often, they happen because a business owner was trying to solve a problem quickly and didn’t realise the legal and practical flow-on effects.

Installing Surveillance Without Proper Notice

Failing to provide clear notice (and relying on “everyone knows we have cameras”) is risky. Good notice includes the policy, signage, and clear communication - and in some places (like NSW and the ACT) you may need to meet specific written notice timing and content requirements.

Recording Audio When You Only Intended CCTV

Some CCTV systems have audio capability built in. If you don’t realise it’s enabled, you can accidentally create a much bigger compliance problem than you intended.

If your business is considering recording calls or conversations, it’s worth taking a careful look at the rules around recording a phone call in Australia and ensuring your approach matches your state requirements and your actual business needs.

Using Surveillance Data For “Everyday Micromanagement”

Surveillance is usually easiest to justify when it is tied to security, safety, or specific investigations.

When surveillance becomes a tool for constant monitoring of behaviour, it can damage trust and morale, and it may increase the chance of complaints or disputes.

Not Securing Footage Or Logs

If too many people can access surveillance data (or if it’s stored insecurely), you increase the risk of:

privacy breaches;
misuse of information;
confidentiality issues; and
reputational damage if footage is leaked.

Not Aligning Surveillance With Your Other Policies

Your surveillance approach should be consistent with the rest of your workplace framework. For example, if you have policies about appropriate workplace conduct, device use, or disciplinary processes, your surveillance policy should work with them - not contradict them.

Key Takeaways

A workplace surveillance policy template helps you communicate what monitoring you use, why you use it, and how surveillance information will be handled - but it won’t replace state/territory legal requirements about how surveillance must be implemented.
Workplace surveillance rules vary across Australia, so your policy should reflect your state or territory requirements and your specific surveillance methods (including stricter notice and covert surveillance rules in places like NSW and the ACT).
A strong policy should cover the purpose, scope, types of surveillance, notice/signage, prohibited areas, data storage and access, permitted uses, employee responsibilities, and a complaints process.
Rolling out the policy properly (with clear communication and acknowledgement) can reduce pushback and improve trust.
Common mistakes include failing to give notice, accidentally recording audio, using surveillance for micromanagement, and not securing footage or logs.

If you’d like help putting together a workplace surveillance policy template that fits your business (and your state), you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.

Workplace Surveillance Policy Template: What To Include In Australia