Workplace Surveillance Laws: What Employers Can Legally Monitor

Posted on by

In the United States, there is no single federal workplace surveillance law. Employers can generally monitor company systems and put cameras in work areas, but the rules change by state, by type of monitoring, and by whether employees were told. Elsewhere the rules are stricter. Australia, the UK and the EU all require notice and proportionality. If you run a business that operates across borders, or you are an employee wondering what your boss can see, the safest approach is to know the strictest rule that applies to you and work from that.

This guide covers the US framework first, then how other major jurisdictions compare. It also covers when a lawful, professional investigation is a better route than quietly watching everyone.

Pi melbourne
Investigate Workplace Concerns Discreetly
Pi Melbourne provides tailored investigations for concerns such as corporate fraud, with professional surveillance and evidence collection.

Visit Pi Melbourne

TL;DR

  • US federal law is permissive: the Electronic Communications Privacy Act (ECPA) generally allows monitoring of company-owned devices, especially with notice. States add their own notice and consent rules.
  • Notice is the common thread. Connecticut, Delaware and New York require written notice before electronic monitoring, and California requires monitoring to be necessary and proportionate.
  • Outside the US, covert monitoring is tightly restricted. In Australia, the ACT requires 14 days’ written notice, and in the UK covert monitoring is justified only in exceptional cases.
  • Cameras never belong in private areas such as restrooms or changing rooms, and constant filming of staff is hard to defend almost anywhere.
  • When you suspect theft, fraud or serious misconduct, a targeted investigation run by licensed professionals is safer than broad surveillance of your whole workforce.

Table of Contents

How US workplace surveillance law is structured

The US has no dedicated, nationwide statute that covers every kind of employee monitoring. Instead, employers face a patchwork: a federal communications law, state statutes on notice and recording, and general privacy and labor principles.

The federal baseline is the ECPA of 1986. It is the primary federal framework, and it generally permits monitoring of electronic communications on company-owned devices, especially when employees have been given notice, according to a 2026 overview of monitoring laws by country. That is why many employers can lawfully review email on a company account or activity on a company laptop.

But “generally permitted” is not “anything goes.” The rest of the picture comes from the states.

State notice rules

Some states do not leave notice to chance. Connecticut, Delaware and New York require employers to give written notice before monitoring employees’ electronic communications. If you operate in one of those states, a line buried in an old handbook is a weak foundation. A signed acknowledgment is far better.

California goes further. Its Consumer Privacy Act, which reaches employee data, requires workplace monitoring to be reasonably necessary and proportionate, with purposes that employees would not find surprising. In practice, that means you should be able to explain in one sentence why each tool exists and why a less intrusive one would not do.

Cameras, audio and phone calls

Video and audio are treated differently. Most states allow visible cameras in work areas where employees have no reasonable expectation of privacy, such as shop floors, lobbies, loading docks and open offices. Restrooms, locker rooms and changing areas are off limits in virtually every setting.

Audio is the trap. Recording conversations can fall under state wiretapping rules, and some states require every party to consent. A camera with a microphone is not the same legal object as a camera without one. If a vendor sells you a unit with audio switched on by default, turn it off until you have confirmed the rule in your state.

If you want a quick test before installing anything, ask four questions:

  1. Is the area one where staff could reasonably expect privacy?
  2. Does the device capture sound as well as video?
  3. Have employees been told in writing, and are signs posted?
  4. Is there a specific, documented reason that cameras are the least intrusive way to meet it?

A no on the first question is fine. A no on any of the other three means stop and fix it.

Can your employer watch you on camera all day?

In most of the US, an employer can keep visible cameras running through the working day in common work areas. What the law cares about is where the camera points, what it records and whether you were told.

Other countries draw the line sooner. In Luxembourg, constant surveillance is generally prohibited in work areas where employees are permanently stationed, and employers must use the least intrusive means and film only what is strictly necessary. A 2022 Dutch court went a step further for remote work, ruling that a rule requiring a worker to keep a camera on for a nine-hour day was an unjustifiable violation of the right to a private life. The ruling involved a US company, which is a useful reminder that employing people abroad means following local law, not just the law at headquarters.

Is your boss allowed to record you without your knowledge?

In the US, the answer depends on the state and the medium. Hidden video in a general work area is lawful in some places and restricted in others. Hidden audio is far riskier because of wiretap and consent rules. Hidden cameras in restrooms or changing areas are never acceptable.

The UK takes a clear position. The Information Commissioner’s Office says that covert monitoring is unlikely to be justified in usual circumstances, though it may be justified exceptionally, for example to prevent or detect suspected criminal activity or gross misconduct. Workers must generally be told about monitoring. That exception is the pattern worth copying even in the US: secrecy should be the last resort, tied to a specific suspicion, and time-limited.

How other countries regulate employee monitoring

If you employ people outside the US, or you are a multinational with offices in several places, these are the regimes you are most likely to meet.

Jurisdiction Core approach What it means in practice
United States Federal ECPA baseline plus state rules Monitoring of company systems is usually allowed; notice rules vary by state
California Necessary and proportionate You must justify the purpose and avoid surprising employees
European Union GDPR lawful basis and balancing test Documented assessment, plus clear information to staff
United Kingdom Data protection law, least intrusive means Impact assessment for high-risk monitoring; covert use only exceptionally
Canada Reasonable and proportionate Monitoring must be tied to a legitimate business purpose
Australia State and territory laws Notice and signage rules in some jurisdictions, thinner rules in others

Under the EU’s GDPR, monitoring needs a lawful basis, often legitimate interest, and a documented balancing test showing it is not excessive. Employers must also tell staff what is monitored, why, how long data is kept and what rights they have.

The UK regulator adds a point any employer can learn from: just because a form of monitoring is available does not make it the best way to achieve an aim, and employers should weigh the effect on worker trust and wellbeing. In Canada, the Ontario privacy commissioner has warned that biometrics and algorithmic management create new risks by enabling continuous, real-time tracking of activity and performance.

Workplace surveillance laws in Australia

Australia is where the rules differ most from the US, and where many readers searching this topic are based. There is no single national workplace surveillance statute. The Office of the Australian Information Commissioner explains that employers must follow the relevant state or territory laws. State laws generally cover CCTV, and some states have specific workplace surveillance legislation. Monitoring email, internet and other computer-resource use is generally allowed after staff have been told.

The ACT: the strictest model

The Australian Capital Territory’s Workplace Privacy Act 2011 is the most detailed. Employers must give written notice of surveillance, keep optical devices clearly visible and place a sign at each workplace entrance, and they must consult workers in good faith. Notice must come at least 14 days before surveillance starts unless a shorter period is agreed or the worker is new, and it must specify the device, conduct, subjects, timing, duration and purpose. Data surveillance must follow a clear employer policy that workers can reasonably be assumed to understand before monitoring begins.

ACT surveillance notice timing and required details

New South Wales and Victoria

New South Wales has its own Workplace Surveillance Act 2005. A legal explainer on the Act describes a similar 14-day written notice requirement, signage at entrances and a ban on cameras in toilets, change rooms and showers. It also describes covert surveillance as generally prohibited without a magistrate’s authority.

Victoria is different. A Victorian parliamentary document notes that the state has no dedicated workplace surveillance law. Instead, the Surveillance Devices Act 1999 prohibits optical and listening surveillance in workplace toilets, washrooms, change rooms and lactation rooms, and requires consent for location tracking and the recording of private activities and conversations. The same document says most workplace surveillance falls outside the Act’s scope. A 2024 union submission to a Victorian inquiry likewise argued that workers have limited protections against intrusive surveillance. Reform is under discussion, so check current law before relying on any summary, including this one.

New South Wales and Victoria — overview diagram

What the law means for employee monitoring in practice

Legal minimums are one thing. A defensible program is another. These habits hold up in most of the jurisdictions above.

  1. Write a policy and get acknowledgments. State what is monitored (email, web use, devices, vehicles, cameras), why and for how long data is kept.
  2. Give notice before you start, not after something goes wrong. Where a statute sets a period, such as 14 days in the ACT, count it from delivery.
  3. Match the tool to the problem. A camera over a cash register answers a theft risk. Keystroke logging of an entire office answers almost nothing.
  4. Keep monitoring out of private areas and off personal devices and accounts unless the employee has clearly agreed.
  5. Limit who sees the data and delete it on a schedule.
  6. Treat protected activity carefully. Monitoring used to interfere with employees discussing pay or working conditions can create legal exposure of its own, so get advice from an employment lawyer before acting on what you find.

Perspective: why broad surveillance is rarely the answer

We see the same pattern again and again. An owner senses money is going missing or that a staff member is leaking information, and the instinct is to watch everyone. It feels decisive. It is usually the wrong move, legally and practically.

Blanket monitoring creates compliance risk, damages trust and often produces evidence that cannot be used. A targeted investigation does the opposite. It starts from a specific concern, uses the least intrusive method that can answer it, and records what it finds in a form a tribunal or court can rely on.

That is how our team works. Our investigators are experienced former police, ex-military and polygraph specialists, and our firm has operated since 2006. We tailor every engagement to the client’s situation and collect photo and video evidence intended to stand up in legal proceedings. We will also tell you when a case does not justify surveillance at all, because a sound policy or an HR process is the better fix. Our work for businesses covers workplace misconduct, employee theft and payroll fraud.

— P.i Melbourne

When to bring in a licensed investigator

Monitoring tools watch everyone. An investigation looks at one question. Consider an investigator when:

  • You have a specific suspicion of theft, falsified timesheets, fraud or leaking of confidential data.
  • You need evidence that will be used in a disciplinary hearing, a workers’ compensation dispute or court.
  • Covert methods may be justified. The UK, NSW and other regimes treat these as exceptional, so the legal footing needs to be right before anyone is filmed.
  • Your business operates in more than one country and you need someone who understands that local rules differ.

Surveillance is the core of what many of these jobs involve, and doing it properly is a skill. We explain our approach in surveillance services done the right way. Our published pricing for a surveillance engagement is $1,000-$1,450, one-off, as set out on our cost page. Other services are scoped to the case.

Hiring former law enforcement and military for advice

Some employers want more than surveillance. They want a former federal agent or soldier to review security, assess an insider threat or advise on a sensitive situation. Experience of that kind is useful for threat assessment, interviewing and evidence handling. It does not replace legal advice, and a good adviser will tell you so.

If you want that kind of background, ask any firm the same questions: which of its people actually have that experience, what licenses they hold in the jurisdiction where the work happens, and how they will document findings so they can be used lawfully. We can discuss former FBI experience and ex-military expertise for advisory work and investigations. We will say plainly what is legal and appropriate in the place where you operate.

Investigations that cross borders

People, assets and evidence do not stay in one country. A fraud may involve a supplier overseas, or a former employee may have moved abroad. We handle locating people and gathering evidence internationally, and you can see an example in a missing person case we resolved in the UK. The legal rules where the person is located decide what can be done, so every overseas job starts with that check.

Work with us

If you are weighing monitoring against an investigation, we can talk through your situation and tell you which route fits. We run corporate investigations for employers dealing with fraud, theft, misconduct and staff concerns, and all work is discreet.

Pi melbourne

To discuss a matter, start from our private investigation services or contact us through pimelbourne.com.au.

FAQ

Generally yes, if it is disclosed where required, limited to a legitimate purpose and kept out of private areas. In the US, federal law is permissive and states add notice or consent rules. In places such as the ACT and the UK, notice and proportionality are central.

Do employers need to tell employees about workplace cameras?

In many places, yes. The ACT requires written notice and signs at each entrance, and several US states require written notice for electronic monitoring. Even where no statute applies, telling staff in writing is the safest practice.

Can employers monitor work email and computer use?

Usually, on company systems and with notice. The ECPA generally permits monitoring of company-owned devices, and Australian regulators say monitoring computer-resource use after notifying staff is generally allowed. Personal accounts and devices are a different matter.

Are home surveillance laws different from workplace ones?

Yes. Home cameras are usually governed by general surveillance and privacy rules, not employment rules. Recording sound, filming into neighbors’ private spaces or monitoring a home worker are the typical problem areas, and they vary by state or country, so check local law first.

Sources