A mate of mine runs a little auto repair shop in Caringbah. A few months ago, two blokes broke in after midnight, jimmied the roller door, and pinched about eight grand worth of tools. The cops came, looked at his cameras, and told him the footage was useless. Grainy, dark, and the camera pointing at the side gate had a spider web across it. The next thing they asked wasn’t about the camera quality, though. They wanted to know where his CCTV signs were. He didn’t have any. At all.
That’s when he found out the hard way that having cameras isn’t the same as having a compliant system. He didn’t end up with a 50,000 fine, thank God, but a local cafeˊ down the road did get stung 16,000 because their cameras were pointed directly at the footpath without proper warning signs. It’s no joke. Commercial CCTV compliance might sound like a boring Saturday morning task until you realise ignoring it could cost you more than a fully kitted-out work ute.
Think of this as CGF Security’s straight-talking guide to CCTV compliance. We’ll walk you through what the law actually expects, the fines you could face, and how to get your security setup right without the legal headaches.
A few things to tuck in your back pocket
- There’s no single CCTV rulebook for Australia. It’s a mix of federal privacy law, NSW surveillance laws, and workplace regulations. Think of it like a three-headed beast you’ve got to feed carefully.
- The massive Bunnings privacy case in 2026 showed everyone that even big companies get it wrong. They used facial recognition without proper consent and got a very public smack.
- Recording people without their knowledge or without a clear reason can land you with penalties well over $50,000, plus the kind of bad press you can’t scrub off Google.
- Real compliance isn’t a one-off job. It’s about signage, policies, data security, and making sure every staff member knows the basics.
- In NSW, two laws in particular rule the roost: the Workplace Surveillance Act 2005 and the Surveillance Devices Act 2007.
Alright, let’s get down to brass tacks.
What do the laws actually say? (I’ll keep this bit short)
I could fill a whole book with legal jargon here, but let’s keep it useful.
Federal Privacy Act
The federal Privacy Act generally applies if your business turns over more than $3 million a year, but even if you’re smaller, you can’t just ignore privacy. The real teeth in NSW come from the state laws.
Workplace Surveillance Act
The Workplace Surveillance Act demands that you give your employees 14 days’ written notice before you start filming them. And you must put up clear, visible signs. If you don’t, you’re already on shaky ground.
Surveillance Devices Act
The Surveillance Devices Act makes it a criminal offence to install or use a camera to record someone’s private activities without their consent. We’re not talking about filming a public car park, we’re talking about recording staff in a lunchroom, for instance. Max penalty? Up to 100 penalty units (that’s $11,000 right now) or even 5 years behind bars in extreme cases. Yeah, you read that right.
Notifiable Data Breaches scheme
Then there’s the Notifiable Data Breaches scheme. If your CCTV hard drive gets swiped, or someone at your office posts footage of a customer on Facebook, and it causes harm, you legally have to notify the Office of the Australian Information Commissioner and the people affected. No excuses.
The Bunnings case in 2026 was the wake-up call. They deployed facial recognition across multiple stores and the Privacy Commissioner found they’d breached the Privacy Act. It proved that just because the tech can spy on faces, doesn’t mean the law lets you. There are plenty of legal considerations for commercial CCTV installation that most business owners don’t think about until it’s too late.
Your step-by-step "keep out of trouble" checklist
Let’s break this into bite-sized pieces. Follow this little CCTV compliance checklist and you’ll sleep a lot better at night.
Step 1: Know why you’re filming
Sounds simple, right? But you’d be surprised how many people haven’t thought it through. Are you worried about break-ins? Shoplifting? Staff safety near heavy machinery? Write down your reason. Legitimate purpose is the foundation. Without it, everything else crumbles.
Step 2: Put up those bloody signs
This is the easiest, cheapest, most effective thing you can do and it’s mandatory. Your CCTV signage needs to be in-your-face obvious. At every entrance, in every monitored area, tell people who’s filming, why, and how they can get more info. No sign, no consent, and you’re collecting personal data illegally. Boom.
Step 3: Draft a privacy policy that actually means something
You need a written CCTV privacy policy that spells out your purpose, how the footage is stored, who can access it, and how long you hang onto it. Put it on your website, have a printout behind the counter, or post it on your noticeboard. Let people know they can request access to footage of themselves that’s a legal right under the Privacy Act. This document is your best friend if someone ever complains.
Step 4: Lock down your recordings like Fort Knox
You’re sitting on a pile of personal information. So, only let trusted people view the footage. The Australian standard AS 4806.2 recommends keeping recordings for at least 31 days and making them tamper-evident and timestamped. If your footage leaks, it’s on you. So treat that hard drive like it’s the key to your safe.
Step 5: Train your crew and check your gear
Everyone in your business needs to know the score. Show them the privacy policy. Tell them who can access the system and what to say if a customer asks about the cameras. And check your gear maybe every day. A camera with a dirty lens or a spiderweb is as good as nothing. Get a licensed pro to do a formal inspection every six months. Workplace surveillance laws aren’t set-and-forget.
So, what happens if you ignore all this?
Okay, if the thought of a legal headache doesn’t make you sweat, maybe the money will. The fines are properly scary. A breach of the NSW Surveillance Devices Act can cost you up to 11,000 per offence. In Queensland, a pub got fined over16,000 for not meeting CCTV requirements. And those are just the government fines.
Then there’s the civil side. If you misuse footage and someone’s privacy is trashed, they can sue you for damages. The Bunnings case cost them a fortune in legal fees and brand damage, way more than any fine. And the $50,000 figure isn’t pulled from thin air. Serious or repeated breaches of the Privacy Act can attract civil penalties that high, especially for corporations. So suddenly, a non-compliant camera system looks like the most expensive corner you’ve ever cut.
What this means for your business right now
][0lo.oLook, you can’t just screw a few cameras to the wall and call it a day. You need a system that’s designed with compliance baked in from the start. There are serious legal considerations for commercial CCTV installation that go way beyond picking the right lens. A professional installer, like our team at CGF Security, will help you understand where cameras can legally go, what signs you need, and how to configure storage to meet the standards. If your system is illegal from day one, every single day you record is a potential liability.
And let’s talk about the real commercial video surveillance system cost. The hardware and installation are one thing. The true cost comes from cutting corners. A compliant system might run you a few grand now. A non-compliant one could end up costing you 10, 20, even 50 times that in fines, lawsuits, and lost customers. Think of compliance as the single most valuable feature of your security setup.
FAQs
Yes. Absolutely. Under NSW law, you must notify people that they’re being recorded. Clear, visible signs at every entrance are the simplest way to get that consent.
No, not unless you’ve got a very specific, legitimate reason like a history of serious theft and even then, you’d need to be extremely careful. Recording private activities without consent is a criminal offence. The lunchroom is generally off limits.
The Australian standard suggests a minimum of 31 days for most security systems. After that, you should have a policy for secure deletion.
Cooperate, but have a policy in place. Make sure your privacy policy tells customers and staff that you may share footage with law enforcement. Don’t just hand over a hard drive without a proper record of the request.
Not really. Even if the federal Privacy Act doesn’t apply, NSW surveillance laws still do. Small business doesn’t mean small responsibilities.
After the Bunnings case, you’d want to be extremely careful. The Privacy Commissioner made it clear that using facial recognition without proper consent is a breach. Unless you have a very strong legal basis and have taken expert advice, probably don’t.
Wrapping it all up
A commercial CCTV system is a brilliant tool. It scares off bad guys, protects your staff, and gives you peace of mind when you’re not on site. But it’s got to be used fairly and legally. The rules are there to protect everyone, and they’re pretty clear.
So, do the homework now. Put up the signs, write the policy, secure the data, and train your team. It’s a small investment of time that can stop you getting hit with a penalty that could really hurt.
If you’re anywhere in Sydney and you want a commercial CCTV setup that keeps you safe and legal, give CGF Security a shout.
