It’s a question I’m asked regularly, “Can we monitor our staff?” The short answer is yes, you can. But the long answer, and the part many employers miss, is that monitoring is only lawful when it’s reasonable, clearly communicated, and aligned with your obligations under the Privacy Act 2020 and the Employment Relations Act. Whether you’re using CCTV, vehicle GPS, email monitoring or time-tracking apps, the key is transparency and fairness.
Monitoring includes anything that tracks or records an employee’s activity such as cameras, tracking devices, email or internet logs, access cards or productivity software. If the information can identify a person and you’re the one collecting it, then the Privacy Act applies. One of the biggest mistakes employers make is assuming they don’t need to tell people. In reality, you must tell employees what you’re monitoring, why you’re doing it, how the information will be used, who will have access, and how long it will be kept. This is a legal requirement, not an optional courtesy. Secret monitoring is almost never justified unless there is a genuine and immediate concern about serious misconduct, and even then you should get advice first.
CCTV is lawful when it is used for legitimate purposes such as health and safety, security or theft prevention. What you can’t do is use cameras to quietly monitor productivity or keep an eye on staff without telling them. Signage should be visible, employees should be informed, and cameras must never be placed in private areas such as bathrooms, changing rooms or staff rooms. The same transparency applies to GPS tracking in company vehicles. Tracking is common for safety, route efficiency and asset protection, but employees must know the system exists and understand why it is used. If vehicles are allowed for personal use, tracking should be disabled outside of work hours unless the employee has explicitly agreed otherwise.
Email, internet and message monitoring is another area where businesses often get caught out. You are generally entitled to monitor company systems to ensure appropriate use, protect security, and investigate issues, but only if staff have been told this may occur. You cannot monitor personal accounts such as Gmail or private social media, and you should not access an employee’s personal phone without their consent. Even when messages appear on work systems, employers still need a legitimate reason to review them, typically linked to policy breaches or misconduct.
Time-tracking and productivity apps are increasingly common for remote and hybrid workplaces. These tools can be lawful when they are necessary, proportionate and clearly explained to employees. Recording hours worked or login times is usually fine. More intrusive features, such as taking webcam photos or monitoring keystrokes, are rarely reasonable or appropriate in a New Zealand context.
A good test is to ask “Is this reasonable?”. The Privacy Commissioner expects employers to collect only what they need, keep the information safe, and use it for the purpose they’ve stated. If you don’t need it, don’t collect it. If you do need it, be upfront about it.
During an investigation into potential misconduct, you may be able to review CCTV footage, GPS logs or emails if this has already been communicated as part of your workplace systems. The usual fair process still applies. Outline the issue, provide the evidence, invite the employee to respond, and make a decision after considering their explanation. What you should not do is secretly track someone in the hope of catching them out. That approach almost always creates bigger problems than it solves.
For all of this to work smoothly, workplaces need the right foundations. A clear Privacy Policy, CCTV or security camera policy, IT and communications policy, and company vehicle policy (if applicable) should be shared with employees at commencement of employment and accessible at all times. Good documentation reduces risk, protects trust, and helps avoid misunderstandings when problems arise.
Monitoring is not a free-for-all, but it can absolutely be used and in many cases should be to support good operations and workplace safety. The key is doing it properly, be open, be fair, and be reasonable. And if you’re ever unsure whether something crosses the line, get advice before switching anything on.
