Can employers monitor emails and internet use?

In many workplaces, the answer is yes, particularly where the email account, network, device or software is provided by the business. The important question is whether the monitoring is lawful, reasonable, transparent and connected to a genuine business need.

Monitoring may include email security scanning, website access logs, downloads, use of business systems, file transfers, device activity or alerts for malware and data loss. Each type of monitoring has a different privacy impact. Recording that a security event occurred is different from routinely reading message content, capturing screenshots or tracking every keystroke.

What rules apply to employee monitoring in Australia?

Privacy and personal information

Employee monitoring can involve personal information, even when it occurs on a company device. Employers should consider what information is collected, why it is collected, who can access it, how long it is retained and whether it is disclosed to a third party such as a software provider.

The Privacy Act 1988 may apply depending on the organisation and circumstances. Do not assume that the employee records exemption resolves every issue, particularly where information is collected before it becomes an employment record or is used for a separate purpose. A privacy impact assessment is sensible for high-intrusion tools.

State and territory workplace surveillance laws

Employment contracts and workplace policies

A contract or acceptable-use policy should set expectations from the start. It can explain that business systems belong to the employer, personal use is limited, security controls may operate automatically and misuse may lead to investigation or disciplinary action. A policy cannot override legislation, and changing an existing monitoring arrangement may require consultation or updated notice.

How should an employer introduce monitoring?

1. Define the business purpose. Write down the problem the monitoring solves—such as malware prevention, protection of client data or investigation of a specific incident.
2. Choose the least intrusive method. Prefer aggregated reports, access logs or security alerts over content inspection where the less intrusive method will achieve the same outcome.
3. Check the legal setting. Review privacy obligations, applicable surveillance legislation, awards, contracts and existing policies. Specialist advice is worthwhile before deploying keystroke logging, covert monitoring or personal-device tracking.
4. Give clear notice. Explain what systems are covered, what data may be collected, the purposes, access controls, retention period and possible consequences. Make the policy easy to find.
5. Train managers and administrators. Monitoring information should not be used casually, shared in group chats or accessed by people without a business reason.
6. Review the arrangement. Remove unnecessary collection, test the policy against real incidents and update it when systems, laws or work arrangements change.

What should the monitoring policy say?

A useful policy should answer the questions employees and managers will actually ask. State whether monitoring covers company email, internet traffic, laptops, mobile devices, cloud applications, messaging platforms and remote work connections. Explain whether limited personal use is permitted and what employees must do with sensitive client or employee information.

Set out the purpose in plain English. Include security, legal compliance, business continuity and investigation of suspected misuse only where those purposes genuinely apply. Describe who may access reports, when content may be reviewed, how long records are kept and how an employee can raise a concern.

Link the policy to the employer’s HR best practice guidance, workplace policy documents and employment contract process. These documents should not contradict each other.

Can monitoring evidence justify dismissal?

Monitoring data may be relevant, but it is not automatically proof of misconduct. An unusual login, blocked website or message flag may have an innocent explanation. Before disciplinary action, verify the data, explain the allegation, provide the employee with a reasonable opportunity to respond and consider the response genuinely.

For serious allegations, preserve relevant evidence, maintain confidentiality and separate the investigator from the final decision-maker where practical. Consistency matters: applying a policy to one employee but ignoring similar conduct by others can create a fairness problem. Employers should also consider whether the monitoring itself complied with the policy and relevant law.

Where termination is being considered, follow a defensible process and obtain advice early. The Fair Work Commission can examine whether a dismissal was harsh, unjust or unreasonable, while general protections risks may arise if an adverse action reason is connected to a workplace right or complaint.

Practical employer checklist

• Identify the purpose and document why monitoring is needed.
• Map the devices, systems and information covered.
• Check jurisdiction-specific surveillance requirements.
• Update the acceptable-use and privacy policies.
• Give notice before monitoring starts or changes.
• Restrict access and set a retention period.
• Use monitoring evidence carefully and follow procedural fairness.
• Review the arrangement at least annually or after a technology change.

Employee monitoring can protect a business, but poorly designed monitoring can create privacy complaints, employee relations problems and litigation risk. A clear, proportionate policy gives employers a stronger foundation than secret inspection or vague wording.