Employee Monitoring Software: Pros, Cons, Law

Modern monitoring software can record almost everything an employee does on a computer. Keystrokes, mouse movement, every website, every app and how long it was open, screenshots every few minutes, and in some products the webcam. All of it rolls up into a tidy dashboard with a "productivity score".

So the technical question, "can we track our staff?", has a simple answer. Yes, easily. The harder questions are whether the data tells you what you think it does, what it costs you in trust, and what the law requires before you switch it on. Let's take them in order.

What monitoring tools actually measure

Most products fall into three bands:

• Light: time tracking against projects or clients, sign-in records, which business apps are in use. Common in professional services where time is billed.
• Medium: websites and apps visited, active versus idle time, file and USB activity, email sent outside the organisation. A lot of this is also collected by ordinary security tools.
• Heavy: keystroke logging, regular screenshots, screen recording, webcam or microphone capture, location tracking on phones.

The key point is that "activity" is not "work". A mouse jiggling is activity. An accountant reading a contract on paper is idle. A senior engineer staring at a whiteboard for forty minutes and then fixing the problem in four lines of code looks, to the dashboard, like a terrible employee.

The case for monitoring

There are genuinely good reasons to collect some of this data:

• Security. This is the strongest argument. Spotting a compromised account downloading the whole client folder at 3am, or a departing employee copying the customer list to a USB stick, depends on logging activity. Managed detection and response is built on exactly this kind of telemetry.
• Accurate billing and costing. If you bill by the hour or quote by the job, knowing where time actually goes improves your pricing.
• Workload visibility. Data can show that one person is consistently working until 9pm while another is underloaded. Used well, that's a wellbeing tool.
• Evidence. If there's a dispute about misconduct or a leak, logs are far better than recollections.

The case against heavy monitoring

Here's where the maths gets interesting. Say your tool takes a screenshot every ten minutes across an eight-hour day. That's 48 screenshots per person per day. Over about 220 working days, it's roughly 10,500 screenshots per employee per year. For a team of 20, that's over 200,000 images.

Now think about what's in them. Payslips. A staff member's own medical appointment booking. Their partner's text message on WhatsApp Web. Client personal information. You've just built a large, sensitive database that nobody will ever look at systematically, and that has to be secured, retained and eventually deleted. Under Australian Privacy Principle 11 you need to protect it, and if it leaks, it's your breach.

Then there are the human costs:

• Trust erodes. Heavy monitoring sends a clear message about how management sees staff, and your best people, the ones with options, are the most likely to take that message to a competitor.
• People game the metric. Measure keyboard activity and you get keyboard activity. Mouse-jiggler gadgets are cheap and widely sold.
• It measures the wrong thing. Output is what matters: matters closed, jobs completed, tickets resolved, sales made. Most activity metrics are a poor substitute.
• Legal exposure. Getting the notice requirements wrong can turn your monitoring into unlawful surveillance.

And, uh... it's worth pausing on this. We can record every keystroke a person makes for their entire career. We can. Whether a business that needs to do that has a monitoring problem or a management problem is the question the software vendor never asks.

What NSW law requires

New South Wales has a specific law for this: the Workplace Surveillance Act 2005. It covers camera, computer and tracking surveillance of employees. The main obligations are:

• Written notice at least 14 days before surveillance starts (an employee can agree to a shorter period). For new starters, notice must be given before they begin work.
• The notice must say what kind of surveillance (camera, computer or tracking), how it will be done, when it will start, whether it's continuous or intermittent, and whether it's for a limited period or ongoing.
• Computer surveillance must follow a written policy that employees have been notified of in a way that means they're reasonably likely to understand it.
• Blocking emails or websites must also be done under a notified policy, and in many cases the employee must be told when an email to or from them has been blocked.
• Surveillance outside work is restricted. Computer surveillance of an employee when they aren't at work is only allowed on equipment or resources the employer provided. Monitoring an employee's personal phone on the weekend is off limits.
• Covert surveillance, meaning without notice, generally requires a covert surveillance authority from a magistrate, and only for investigating suspected unlawful activity.

Other states and territories handle this differently, through surveillance devices laws, and the ACT has its own workplace privacy legislation. If you employ people across borders, check each one.

A note on the Privacy Act: many private sector employers rely on the employee records exemption, which covers acts directly related to the employment relationship and an employee record. It's narrower than people assume. It doesn't cover job applicants, contractors, or information that isn't part of an employee record, and the new statutory tort for serious invasions of privacy applies separately. Treat all of this as general information, and get employment law advice before deploying anything beyond basic security logging.

A sensible middle path

For most small and mid-sized businesses we recommend something like this:

1. Monitor for security, not productivity. Sign-in logs, endpoint protection, email filtering, data loss alerts. These protect the business and the staff, and most people accept them readily when it's explained.
2. Measure outputs, not inputs. Agree on what good work looks like for each role and track that.
3. Be transparent. Give the statutory notice, publish the policy, and explain in plain English what's collected, why, who can see it and how long it's kept. A one-page summary on top of the formal policy helps.
4. Minimise and delete. Collect the least data that does the job and set a retention period. Screenshots kept for seven years serve nobody.
5. Restrict access to the data. Monitoring logs should be visible to a small number of named people, and access should itself be logged.

This fits naturally into your acceptable use policy, which in NSW is the logical place to disclose computer surveillance anyway. And if remote-work security is what's really driving the interest in monitoring, our work-from-home laptop checklist addresses the actual risk more directly.

Frequently asked questions

Is it legal to monitor employees' computers in NSW?

Yes, if you comply with the Workplace Surveillance Act 2005: give written notice at least 14 days before it starts, describe the kind and method of surveillance, and carry out computer surveillance under a written policy employees have been notified of. Covert surveillance generally needs a magistrate's authority. This is general information, not legal advice.

Do I have to tell employees they are being monitored?

In NSW, yes. Written notice is required before surveillance begins, and computer surveillance must follow a notified policy. Other states have different rules, but transparency is good practice everywhere.

Can my employer monitor my personal phone?

Under the NSW Act, computer surveillance of an employee outside work is only permitted on equipment or resources provided by the employer. A well-run BYOD programme separates work data from personal data so the business only manages the work apps, not the whole phone.

Does employee monitoring improve productivity?

It can surface workload issues and improve time billing, but heavy activity tracking tends to measure activity rather than output, encourages people to game the metrics and can damage trust. Measuring results usually works better.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want security monitoring that protects the business without spying on your team? Talk to us — we'll set it up properly and help you get the notices and policies right.