In Australia, businesses can legally use CCTV for a genuine security purpose, as long as they notify people (clear signage), avoid private areas like toilets and change rooms, and handle footage securely. There’s no single national CCTV law it’s a mix of the federal Privacy Act 1988 and each state’s surveillance devices laws. The biggest trap is audio: recording sound is far more restricted than video, and is often illegal without consent.
Is CCTV legal for businesses in Australia?
Yes video surveillance for a legitimate business purpose (security, safety, theft prevention) is lawful across Australia. What makes it compliant is how you do it: transparency, placement, and footage handling.
The catch is that there’s no single “CCTV Act.” Three layers of law work together:
- State and territory surveillance devices laws — govern how you can record people, especially audio, and when notice or consent is needed.
- Workplace surveillance laws (in some states) — extra rules for monitoring staff.
- The federal Privacy Act 1988 — governs how covered businesses collect, store and use identifiable footage.
Does the Privacy Act apply to your CCTV footage?
This surprises a lot of business owners: video footage that can identify a person is “personal information” under the Privacy Act. If your business is covered, the Australian Privacy Principles (APPs) apply to your CCTV.
Your business is generally covered by the Privacy Act if it:
- Has an annual turnover of $3 million or more, or
- Is a health service provider (of any size), or
- Falls into certain other categories (some franchises, businesses trading in personal information, and more).
If the Act applies, you must:
- Notify people their image may be captured (before you record) usually via signage and a privacy notice.
- Have a reasonable purpose for collecting the footage.
- Store it securely and restrict who can access it.
- Only use it for the purpose you collected it (or a directly related one).
- Delete or de-identify footage when you no longer need it.
What can’t you record? The prohibited zones
Regardless of your state, cameras must never be placed where people have a reasonable expectation of privacy. This is the clearest line in the law:
- Toilets and bathrooms — never.
- Change rooms and fitting rooms — never.
- Staff break/rest areas — avoid; heavily restricted (Victoria, for example, limits employer surveillance in areas like washrooms).
- Prayer rooms — avoid.
- Anywhere pointing into a neighbour’s private space (bedroom, backyard, pool) — use privacy masking to black these out.
The biggest trap: can CCTV record audio?
This is where most businesses unknowingly break the law. Audio recording is far more restricted than video and many CCTV systems ship with microphones on by default.
Under state surveillance devices laws, it’s generally a criminal offence to record a private conversation without the consent required in your state:
- All-party consent states (NSW, WA, SA, Tasmania, ACT): everyone in the conversation must consent.
- Participant-consent states (Queensland, Victoria): you can record a conversation you’re part of, but there are strict limits on using or sharing it and recording conversations you’re not part of is an offence.
Because a CCTV camera records conversations it isn’t a “party” to, capturing audio of customers or staff talking can land you in serious trouble almost anywhere in Australia.
Practical rule: turn microphones off unless a lawyer has told you otherwise. Video-only CCTV is dramatically easier to keep compliant.
What are the CCTV signage requirements?
Signage is your main tool for staying compliant, because it provides the notice the law requires. In 2026, good practice is:
- Clear, legible signs at every entrance and in monitored areas.
- Wording that states the area is under CCTV surveillance.
- A contact/identifier for who’s responsible for the footage (business name or website) — regulators increasingly expect this.
- If (and only if) you lawfully record audio, signage must explicitly warn of “audio and video recording.”
Extra rules for recording staff: workplace surveillance
Monitoring employees carries additional obligations, and they vary by state. New South Wales is the strictest example under its Workplace Surveillance Act, employers must give prior written notice and display visible signage, and covert surveillance is banned except in very limited, authorised circumstances.
Wherever you operate, workplace CCTV is safest when:
- You have a clear, legitimate purpose (security, safety, incident investigation).
- You use the least intrusive option that meets it (entry points, not close-ups of desks).
- You notify staff in writing before surveillance starts, and again if it changes.
- You avoid private areas and set rules on who can view footage.
How long can (and should) you keep CCTV footage?
The Privacy Act principle is simple: keep footage only as long as you reasonably need it, then securely delete or de-identify it. There’s no single mandated retention period for general business CCTV, but common practice is 30 to 90 days, unless footage is needed for a specific incident or investigation.
Storing footage indefinitely creates risk it’s more data to secure, and it undercuts the “only keep what you need” principle. Secure storage and access controls matter as much as the recording itself.
How to set up compliant CCTV: a checklist
- Define a clear purpose — security, safety, theft prevention. Write it down.
- Plan camera placement — cover entries and risk areas; avoid all private zones.
- Disable audio unless you have legal advice and audio signage.
- Use privacy masking to black out neighbouring private property.
- Put up clear signage at entrances and monitored areas.
- Notify staff in writing if you’re monitoring employees.
- Secure the footage — strong passwords, restricted access, encryption, MFA.
- Set a retention period (e.g. 30–90 days) and delete on schedule.
- Write it down — a short record of purpose, placement, audio-off, and retention.
Byteway Expert Insight
When we review CCTV setups for Melbourne businesses, two problems come up again and again and both are avoidable. The first is audio recording left switched on by default; owners have no idea their cameras are capturing conversations, which is often the single biggest legal exposure in the whole system. The second is placement: a camera angled so it clips a neighbour’s yard, or one quietly covering a staff break area, installed by someone focused on coverage, not compliance.
What we’ve learned is that compliant CCTV is a design decision, not an afterthought. Before a single camera goes up, it’s worth mapping the purpose of each one, disabling audio unless there’s a specific lawful reason, masking private zones, and getting the signage and staff notice right. Most installers sell you cameras. The value is in setting the system up so the footage is actually usable and legal if you ever need it.
Is Byteway a good choice for compliant CCTV in Australia?
Yes for Australian businesses that want CCTV set up to be compliant, not just functional. Byteway installs business CCTV with compliance built in: purpose-based camera placement, audio disabled by default, privacy masking for private zones, correct signage guidance, secure footage storage with access controls, and sensible retention plus local support. It’s security that protects your business legally as well as physically.
Where Byteway differs from a camera-only installer:
- Compliance-aware design — placement, audio and masking planned around the law, not just coverage.
- Secure footage handling — encryption, access controls and retention aligned to the Privacy Act.
- One local team for CCTV, cyber security, networks and IT support so your footage is protected like any other sensitive data.
No installer can give you legal advice but a good one sets your system up so staying compliant is easy, and points you to a lawyer for the grey areas.
Install with confidence, not guesswork
CCTV is one of the best security investments a business can make as long as it’s set up on the right side of the law. The mistakes (audio left on, cameras in the wrong spot, no signage) are easy to make and easy to avoid.
Book a free CCTV compliance review. We’ll check your existing or planned setup against Australian privacy and surveillance rules placement, audio, signage, storage and retention and show you exactly what to fix.
👉 Get your free CCTV compliance review
Frequently Asked Questions
What can a business legally record on CCTV in Australia?
Businesses can record video in areas with a legitimate security purpose — entrances, shop floors, stock rooms, car parks — provided there’s clear signage and footage is stored securely. You cannot record in private areas (toilets, change rooms), and recording audio is generally prohibited without consent.
Is it illegal for CCTV to record audio in Australia?
Usually yes. Recording private conversations via CCTV is generally a criminal offence under state surveillance devices laws, because the camera isn’t a party to the conversation. Since many systems enable microphones by default, the safest approach is to disable audio unless you have legal advice and explicit audio signage.
Do I need signage for CCTV at my business?
Yes. Clear, visible signage at entrances and monitored areas provides the legal notice that people are being recorded, which is required under privacy and surveillance laws. Best practice in 2026 is to include who’s responsible for the footage. Home CCTV usually doesn’t legally require signage, but it’s recommended.
Can I put CCTV cameras where staff work?
Generally yes, for a legitimate purpose, but workplace surveillance laws apply. In NSW especially, you must give staff prior written notice and display signage, and covert surveillance is largely banned. Cameras should cover security-relevant areas rather than constantly monitor individuals, and never private spaces.
Does the Privacy Act apply to my security cameras?
It applies if your business is covered — generally turnover of $3 million or more, health providers, and some other categories. Then CCTV footage that identifies people is personal information, so you must notify people, secure it, limit its use, and delete it when no longer needed. Home cameras for personal use are exempt.
How long can a business keep CCTV footage?
There’s no single mandated period, but the principle is to keep footage only as long as reasonably necessary, then securely delete it. Many businesses retain footage for 30–90 days unless it’s needed for a specific incident, in line with the Privacy Act’s “don’t keep what you don’t need” approach.
What happens if my CCTV breaks privacy law?
Consequences range from privacy complaints and regulator action to criminal offences for unlawful audio recording or filming in prohibited areas. You may also be unable to lawfully use footage as evidence. Setting the system up correctly — video-only, signposted, private zones avoided — prevents almost all of this.