Victoria does not yet have a dedicated workplace surveillance act. Employers currently rely on the general protections in the Surveillance Devices Act 1999, which leaves real gaps around notice, consent and data handling. A 2025 parliamentary inquiry recommended a modern, principles-based framework, and the Victorian Government has backed many of its proposals, so change is coming. Until new laws pass, employers should document risk assessments, write clear policies and consult staff now.

TL;DR:

• Employers should implement thorough documentation, including risk assessments and policies, to prepare for upcoming surveillance law reforms.
• Surveillance must be reasonable, necessary, and proportionate, with clear written notices and genuine staff consultation required before deployment.
• Use surveillance tools like CCTV, GPS, or productivity software only when justified by a strong necessity test and with strict access controls.
• Data security, breach protocols, and separation of functions between security and HR are essential to ensure compliance and protect worker privacy.
• The biggest compliance risks lie in automated decision-making, biometric collection, and intrusive tracking, making necessity testing the top priority.

Table of Contents

• Victoria’s current law: what employers and workers actually need to know
• What the Inquiry and government response propose for employers
• Which laws and agencies to consult now
• Practical compliance checklist employers can use now
• How the proposed rules apply to everyday tools
• ABCO Security’s perspective on implementing compliant surveillance
• What Victorian employers keep getting wrong about surveillance reform
• How ABCO Security helps Victorian employers manage surveillance risk
• FAQ
• Sources
• Primary legislation, the Inquiry report and regulator guidance

Victoria’s current law: what employers and workers actually need to know

The Surveillance Devices Act 1999 (Vic) is the baseline law governing workplace monitoring in Victoria. It was written before smartphones, cloud CCTV and productivity software existed, and its workplace privacy provisions are narrower than most employers assume. The Act does not set out a general right to notice before monitoring begins. It mainly restricts where optical and listening devices can be used.

Some protections are clear and absolute:

• Optical surveillance devices are banned in toilets, change rooms, lactation and parenting rooms, and similar private areas.
• Listening devices cannot be used to record private conversations without consent in most workplace settings.
• Covert tracking or recording outside these narrow rules can expose an employer to criminal penalties under the Act.

Federal law does not fill the gap. The Privacy Act 1988’s employee-records exemption means most monitoring of current employees for employment purposes sits outside the Commonwealth privacy framework entirely, leaving state law and workplace agreements to carry the weight. For open-plan offices, warehouses, construction sites and retail floors, that leaves wide areas where surveillance is technically lawful but poorly regulated.

What the Inquiry and government response propose for employers

The Legislative Assembly’s Economy and Infrastructure Committee handed down its inquiry into workplace surveillance in 2025, and the Victorian Government’s response supports many of its recommendations in principle. If adopted, the reforms would reshape day-to-day practice for employers:

1. A technology-neutral standard requiring surveillance to be reasonable, necessary and proportionate to its stated purpose.
2. Mandatory notice to workers well in advance before new surveillance starts, plus genuine consultation with staff or their representatives.
3. A written workplace surveillance policy setting out what is monitored, why and for how long.
4. Tighter rules on biometric data collection and a requirement for human review before automated systems make decisions that affect a worker.
5. Data security standards and breach notification obligations covering surveillance footage and logs.
6. A proposed enforcement model giving a regulator, likely building on the Office of the Victorian Information Commissioner’s existing role, inspection and prosecution powers.

None of this is law yet. Treat the recommendations as the direction of travel and start building the habits now rather than waiting for the Bill.

Which laws and agencies to consult now

Three sources carry the most weight for anyone trying to get this right today, and each plays a different practical role.

• The Surveillance Devices Act 1999, together with the Surveillance Devices (Workplace Privacy) Act 2006 provisions it absorbed, is the starting point for any legal question about where cameras or listening devices can go.
• OVIC’s guiding principles for surveillance set out what privacy-enhancing practice looks like in detail: run a privacy impact assessment, limit what you collect, keep it secure and only as long as needed.
• WorkSafe Victoria’s guidance ties surveillance to occupational health and safety duties: monitoring aimed at preventing violence or managing psychosocial hazards can be a legitimate control measure, provided it is reviewed and workers are consulted.

The Fair Work Act and Privacy Act intersect at the margins, mainly where monitoring data feeds into disciplinary action or where an employer handles job applicants’ or contractors’ information outside the employee-records exemption. Read the Victorian sources first; they carry the practical detail for most day-to-day decisions.

Practical compliance checklist employers can use now

Waiting for legislation is not a strategy. These are the steps worth taking this quarter:

• Draft or update a workplace surveillance policy that names every surveillance type in use, its purpose, retention period and who can access the data.
• Run a documented privacy impact assessment for each monitoring system, testing necessity and proportionality against less intrusive alternatives.
• Give workers written notice before introducing new monitoring and consult genuinely, keeping records of that consultation.
• Avoid collecting biometric data unless there is a strong justification, and build in human review wherever an automated system flags or penalises a worker.
• Lock down surveillance data: restrict third-party sharing, encrypt storage and have a breach notification plan ready before you need it.
• Train managers on what the policy allows, keep audit logs of who accessed footage and when, and retain consultation records in case a dispute arises.

Pro Tip: Separate who can view CCTV footage for security incidents from who handles HR investigations. A clear chain of custody prevents monitoring intended for safety from drifting into performance management without consent.

A well-drafted policy also protects employers: when a worker challenges monitoring, a documented necessity test and a consultation trail are the first things a regulator or tribunal will ask to see.

How the proposed rules apply to everyday tools

Different technologies carry different risk, and the proposed principles-based model means the same necessity and proportionality test applies to all of them, just with different outcomes.

• CCTV: use visible signage, limit footage retention to a defined period, apply role-based access and be able to state the exact purpose for each camera.
• Remote invigilation and activity-monitoring software: disclose what is tracked, limit use to the stated purpose and test any automated flagging for errors before acting on it.
• GPS and wearables: use only where genuinely necessary for the job, for example fleet safety, and document the less intrusive alternatives considered first.
• Keylogging and productivity trackers: these carry the highest privacy risk of any common workplace tool and need a strong, specific necessity case before deployment.

The direction from both OVIC and the Inquiry is consistent: the more intrusive the tool, the higher the bar for justifying it, and generic productivity concerns rarely clear that bar on their own.

ABCO Security’s perspective on implementing compliant surveillance

In practice, the organisations that handle this well separate functions early. Security monitoring access sits with the security team; HR only receives footage or logs when there is a documented, specific reason, with a record of who approved the release. Security monitoring access is typically separated from HR functions when designing CCTV and alarm monitoring systems, paired with vendor due diligence on data storage and encryption before cameras go live.

Risk assessments work best when they are specific to the site: a construction yard, a hospital corridor and a retail floor each carry different privacy and safety trade-offs. Training managers on what footage can and cannot be used for, and running that training before a policy launches rather than after an incident, is what keeps consultation genuine rather than a formality bolted on at the end.

What Victorian employers keep getting wrong about surveillance reform

The common assumption is that Victoria already regulates workplace surveillance closely. It does not, and that gap is precisely why the Inquiry happened. The more useful judgement call isn’t whether reform passes this year or next: it’s that the practices regulators want (notice, consultation, necessity testing, human review) are good management even without a law forcing them.

Conventional advice tends to treat compliance as a box-ticking policy document. The research points somewhere more specific: the biggest risk sits in automated decision-making and biometric collection, not in ordinary CCTV, because that’s where human review is weakest and the Inquiry’s recommendations are sharpest.

If you do one thing first, make it the necessity test. Before adding any new monitoring tool, write down what problem it solves and what less intrusive option you ruled out. That single habit will survive almost any version of the reforms Victoria eventually passes.

— Abco

How ABCO Security helps Victorian employers manage surveillance risk

Getting surveillance right takes more than good intentions: it takes systems that are built to be auditable from day one. ABCO Security provides A1 CCTV & alarm monitoring, security guarding, mobile patrols and surveillance risk assessments for construction sites, healthcare facilities and corporate offices across Victoria, with role-based access and documented retention built into the setup.

We also work alongside workplace technology partners such as Citation Group where clients need broader HR system integration. ABCO handles the operational and technical side of compliant surveillance: policy-ready system design, vendor checks and monitored access logs. Legal interpretation of your obligations should still come from an employment lawyer. If you want a technical audit of your current setup, get in touch for a compliance review.

FAQ

Can my employer watch me on camera all day?

Generally yes, in most work areas, provided the camera isn’t in a prohibited space like a toilet, change room or lactation room under the Surveillance Devices Act 1999. Victoria does not currently require blanket notice for CCTV, though that is one of the changes the 2025 Inquiry recommended.

Can I refuse to be tracked at work?

There’s no general right to refuse lawful monitoring tied to a legitimate work purpose, but you can raise concerns through consultation processes your employer should already have in place. The proposed reforms would strengthen this by requiring employers to justify tracking as necessary and proportionate before introducing it.

Is my boss allowed to watch me on the camera?

Yes, within the limits the Surveillance Devices Act sets: cameras are banned in private spaces like toilets and change rooms, and listening devices face extra restrictions. Outside those prohibited areas, Victorian law currently gives employers considerable latitude, which is a core reason the Inquiry recommended tighter rules.

Is it illegal to put someone under surveillance?

It depends on where and how. Covert surveillance in prohibited private areas, or using listening devices to record private conversations without consent, breaches the Surveillance Devices Act 1999 and can carry criminal penalties, while surveillance in general work areas for a legitimate purpose is usually lawful.

Sources

• Victorian Government response — Inquiry into workplace surveillance (2025)
• Inquiry into workplace surveillance — Parliament of Victoria report
• Surveillance Devices Act 1999 (Vic) — authorised version

Primary legislation, the Inquiry report and regulator guidance

For the full legal texts and official positions behind this explainer, start with the Surveillance Devices Act, the Inquiry’s final report and the Government’s 2025 response, then check OVIC’s guiding principles for practical implementation steps.

Recommended

• Onsite security guards: your 2026 compliance guide
• Surveillance Camera Installation Melbourne: Surveillance
• A Guide to Employee Safety in the Workplace