Installing a CCTV system is one of the most effective steps you can take to deter theft, support safety, and give your property or business peace of mind. But once you point a camera at customers, employees, or visitors, you're handling personal information subject to strict Australian laws.

The good news? With the right setup, signage, and policies, most businesses and homeowners can use CCTV lawfully and responsibly. If you're still deciding whether CCTV is right for you, read our guide on 5 reasons why CCTV cameras are a must-have for your home security.

Here's what you need to know.

What are the CCTV laws in Australia?

There is no single "CCTV law" that applies nationwide. Instead, a few legal frameworks work together:

• State and territory surveillance laws regulate how you can record people, especially audio, and when notice or consent is required
• Workplace surveillance laws in some states and territories set rules for monitoring staff, including CCTV in offices, warehouses, and retail floors
• The Privacy Act 1988 (Cth) governs how eligible businesses collect, store, use, and disclose personal information, which can include identifiable video footage
• Other rules such as strata bylaws, tenancy agreements, and local council conditions can set additional site-specific requirements

As a starting point, most businesses and homeowners can lawfully install CCTV to protect people and property, provided you are transparent about it and avoid private areas like bathrooms and change rooms.

It is also important to understand the difference between video and audio. Audio recording is usually far more restricted and in many cases unlawful without consent. If your cameras have built-in microphones, consider disabling audio by default.

CCTV in the workplace: notice, consent, and employee rights

Using CCTV at work is common, but the rules tighten when employees are involved. Across Australia, you generally need to tell staff that surveillance is happening, where cameras are located, and why you are using them.

Some jurisdictions go further. In New South Wales, the Workplace Surveillance Act requires employers to provide prior written notice and visible signage, and restricts covert surveillance except in very limited circumstances. Other states rely on their Surveillance Devices Acts and general employment law principles.

Practical steps for compliance:

• Give clear written notice to staff before surveillance starts and whenever it changes
• Use visible signage at entrances and in all monitored areas
• Limit cameras to areas with a legitimate business purpose such as stock rooms, entry points, and shop floors
• Avoid private spaces including bathrooms, change rooms, and prayer rooms, and be cautious around break areas
• Set clear rules on who can view footage and under what circumstances

Privacy Act and data protection: using CCTV footage lawfully

CCTV footage that can identify a person is personal information. If your business is covered by the Privacy Act, you need to meet the Australian Privacy Principles (APPs). In practical terms, this means:

• Collect footage only when reasonably necessary for safety and security, and in a lawful and transparent way
• Inform people about the collection through signage and privacy notices
• Store footage securely using a security recorder, restrict access to authorised personnel, and delete it when no longer needed
• Only use or disclose footage for the purpose it was collected, unless an exception applies such as a law enforcement request
• Be prepared to handle access or correction requests in line with the APPs

A clear, up-to-date privacy policy that covers CCTV is a practical way to demonstrate compliance. It should explain why you capture video, how long you retain it, who you share it with, and how someone can contact you with questions.

If your CCTV system is compromised and footage is accessed or leaked, it may trigger obligations under the Notifiable Data Breaches scheme. Having a data breach response plan in place ensures your team knows what to do if something goes wrong. See also our guide on how to protect your IP camera system from hackers.

Where you can install cameras and where you cannot

As a general rule, outdoor cameras should only cover areas you own or control. Pointing a camera at a neighbouring property, a shared driveway, or a public footpath can expose you to claims of trespass or breach of privacy. Our guide on where to place security cameras covers compliant positioning in detail.

Cameras must never be positioned to capture areas where people have a reasonable expectation of privacy. This includes bathrooms, change rooms, and bedrooms, regardless of whether the property is residential or commercial. For indoor monitoring, indoor Wi-Fi cameras should be positioned to cover entry points and common areas only.

Managing footage: storage, access, and sharing

Installing cameras is only half the story. Day-to-day compliance depends on how you manage the footage.

Retention and deletion:

• Keep footage only as long as needed for your stated purpose, typically 30 to 90 days for incident review, unless required for an active investigation or legal matter. Read our guide on how to optimise NVR storage settings to manage retention effectively
• Automatically purge old footage on a rolling basis using your NVR or DVR recorder, with exceptions documented for active matters

Security and access controls:

• Restrict access to authorised personnel only and log all access or downloads
• Use strong passwords, multi-factor authentication, and encryption where available. See our tips on hack-proofing your security cameras
• Define when footage can be reviewed, for example in response to a suspected incident, safety concern, or lawful request
• Apply vendor due diligence if your system uses cloud storage or a third-party monitoring service

Disclosing footage:

• Only share footage in line with your privacy policy and stated purpose, for example providing an incident clip to police on request
• If someone requests footage that includes other people, consider blurring faces or providing a still image where appropriate
• Avoid posting footage online, as this can breach privacy and damage trust even if well-intentioned

What legal documents should you have?

The right documentation makes your CCTV program clear and defensible. Consider having the following in place:

• A privacy policy that explains why you collect CCTV footage, how you store it, who you share it with, and how someone can raise a concern
• A workplace surveillance or monitoring policy that sets expectations for staff and clarifies where cameras are used and when footage may be reviewed
• An information security policy that outlines access controls, storage, retention, and deletion procedures
• A data breach response plan that sets a clear process for containing and reporting incidents if footage is accessed improperly
• Third-party data processing terms if you use a security contractor or cloud provider

Key takeaways

• CCTV is lawful in Australia when used transparently and for a legitimate purpose. Focus on signage, notice, and avoiding private areas
• Workplace surveillance carries extra obligations. Tell staff in writing, place clear signs, and limit monitoring to what is reasonable for safety and security
• Video that identifies a person is personal information. If the Privacy Act applies to your business, you need clear notices, secure storage, limited use, and timely deletion
• Audio recording is far more restricted. Disable microphones unless you have a lawful basis and the right consents in place
• Strong internal controls matter. Access logs, retention schedules, and vendor agreements help you manage footage responsibly

Choosing the right system

At Secure On Australia, we stock professional-grade CCTV systems from Hikvision, Dahua, EZVIZ, and HiLook, designed for both residential and commercial use. Our team can help you select cameras with the right coverage angles, storage capacity, and features to meet your security needs without overstepping legal boundaries.

Not sure where to start? Read our complete CCTV buying guide, explore the common types of CCTV products, or find out how many cameras you actually need.

Browse our IP security cameras, outdoor cameras, and NVR and DVR recorders, or get in touch if you'd like advice on a compliant setup for your property.

Please note: This article is intended as general guidance only and does not constitute legal advice. Laws vary by state and territory and are subject to change. For legal advice specific to your situation, consult a qualified legal professional.