CCTV and surveillance on strata common property: the privacy rules
Mostly the Privacy Act is not the law that governs your cameras. CCTV on strata common property is governed first by your state's surveillance-devices law and the scheme's by-law, which bind you whether or not your business is under the Privacy Act. The core rules: video only, never record a private conversation, never point into private lots, and post signage. If your business is a covered entity, the Australian Privacy Principles add a layer.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
Three layers of law sit over a strata camera
It is easy to assume "CCTV equals a privacy issue equals the Privacy Act." In strata that is only partly true, and the Privacy Act is usually the least important of three layers:
- State surveillance-devices law is the first and most universal layer. Each state's Surveillance Devices Act (NSW SDA 2007, Vic SDA 1999, WA SDA 1998) governs what may be recorded on common property. This applies regardless of your turnover and regardless of the Privacy Act.
- Strata law and the by-law are the second layer. Fixing a camera to common property is a change to common property that the owners corporation must authorise (in NSW by special resolution under the changes-to-common-property provision, Strata Schemes Management Act 2015 s 108), and schemes commonly pass a by-law for the cameras as well. Without that authorisation, the installation itself can be challenged before it ever becomes a privacy question.
- The Privacy Act and the APPs are the third layer, and they only bind you if your managing-agent business is a covered entity (turnover over A$3 million, or a related body corporate of a larger covered group). Many smaller managers and most owners corporations sit outside this layer entirely.
The important honesty point: even a manager who is genuinely exempt from the Privacy Act is not free of surveillance rules. The first two layers still apply in full.
The rules that bind you regardless of the Privacy Act
These come from state surveillance-devices law and the by-law, and they apply to every scheme, exempt or not:
- Video only. No private conversation. Recording a private conversation with a listening device, without the consent of the parties, is a criminal offence under state surveillance law. Common-property cameras must be video-only. Do not enable microphones, and disable audio on any camera or video intercom that has it.
- Do not capture private lots or private areas. Cameras must be aimed at genuinely common property (foyers, car parks, bin rooms, entries). They must not look into a lot, a courtyard, a window, or any place a resident would reasonably expect privacy.
- Signage. Residents and visitors must be told cameras are operating, with signage at the monitored areas.
- Controlled footage access. Footage must be stored securely and viewed only by authorised people for a proper purpose. It is not there for a committee member to trawl through, and handing it out is where most strata surveillance disputes actually arise.
Because these obligations do not depend on the Privacy Act, "we are under the small-business exemption" is not an answer to a surveillance-law problem. This is the single most misunderstood point in strata CCTV.
Audio is the hard line
The sharpest rule to get right is audio. Across the states, optically recording on common property is regulated (Victoria has an offence for recording a private activity; New South Wales regulates it more narrowly; Queensland has no general optical offence) and is often lawful on common property with the right setup, while recording a private conversation is a criminal offence almost everywhere. Many modern cameras, doorbells and video intercoms record sound by default. In a strata setting that default can turn a lawful camera into an unlawful listening device. Treat audio as off unless you have specific, verified legal ground to record it in your state .
The states are not the same, and Queensland is the outlier
Surveillance-devices law is state law and it differs materially, so a NSW policy is not a national policy.
- Victoria makes it an offence to optically record a private activity without consent; New South Wales regulates optical surveillance more narrowly (its offence turns on entry or interference) . Either way the "do not point into private lots" rule holds, backed by the reasonable-expectation-of-privacy test and, for a covered business, the APPs.
- Queensland is the material outlier: it has no general optical-surveillance (CCTV) offence and regulates only audio, under the Invasion of Privacy Act 1971, so common-property visual recording is largely lawful subject to nuisance, trespass and stalking limits. ⚠️ Reform is under way: the Queensland Law Reform Commission has recommended criminal prohibitions covering optical surveillance, and the Department of Justice has consulted on introducing them in stages. Nothing has commenced, so this is the position today rather than a settled one.
If you manage schemes outside NSW, Victoria and Queensland, do not assume any of the above transfers. Check your own state's Surveillance Devices Act before you install or write a policy. Read: strata CCTV rules by state.
If your business is covered, the APPs add a layer
Where your managing-agent business is a covered APP entity, CCTV footage of identifiable people is personal information, so the Australian Privacy Principles apply on top of the surveillance-devices rules. The OAIC's position on security cameras is that a covered entity must:
- Collect only what is reasonably necessary (APP 3). Do not blanket a building with cameras because you can. Each camera should have a purpose.
- Notify before recording (APP 5). Signage and a clear collection notice, so people know the footage is being captured and by whom.
- Keep footage secure and destroy or de-identify it when no longer needed (APP 11). A retention rule for footage, not indefinite storage, and controlled access.
If you are a covered manager, a footage breach can also be a notifiable data breach: you must assess a suspected eligible breach within about 30 days and notify affected people and the OAIC where serious harm is likely. Read: a data-breach response plan for strata managers.
Facial recognition and number-plate cameras are the highest-risk zone
Ordinary CCTV is one thing. Cameras that identify individuals biometrically are another. If your managing-agent business is a covered APP entity, facial recognition and automatic number-plate recognition (ANPR) are the highest-risk surveillance you can run. A facial image used to identify a person is biometric information, which is sensitive information under the Privacy Act and carries a higher bar. The OAIC's Bunnings determination (29 October 2024) found breaches of APP 1, 3 and 5 for facial-recognition use; on appeal the tribunal (4 February 2026) affirmed the transparency and notification (APP 1 and APP 5) breaches . Treat any biometric or ANPR proposal as a stop-and-get-advice moment. Read: facial recognition, ANPR and smart surveillance in strata buildings.
A note on the new statutory tort
Separately from all three layers above, a statutory tort of serious invasion of privacy was legislated in 2024 and commenced on 10 June 2025, giving a person a direct right to sue for an intentional or reckless serious invasion of privacy. It is narrow, but egregious strata surveillance (a camera trained into a bedroom window, covert recording of a resident) is exactly the kind of conduct it exists for. It is one more reason to get the by-law, the aim and the audio setting right the first time.
Common questions
Does the Privacy Act govern our strata cameras?
Usually not as the main law. Cameras on common property are governed first by your state's surveillance-devices law and your scheme's by-law, which apply regardless of turnover. The Privacy Act and the APPs only add a layer if your managing-agent business is a covered entity (turnover over A$3 million or part of a larger covered group).
Can we record audio on common-property CCTV?
Treat audio as off. Recording a private conversation with a listening device without consent is a criminal offence under state surveillance law across the states. Many cameras and video intercoms record sound by default, so disable it unless you have specific, verified legal ground in your state to record it .
We turn over under $3 million, so are we exempt from the CCTV rules?
No. The small-business exemption is a Privacy Act concept. Surveillance-devices law and your by-law bind you independently of the Privacy Act, so an exempt manager still cannot record private conversation, point cameras into private lots, or skip signage.
Is Queensland really different?
Yes, materially. Queensland has no general optical-surveillance offence and regulates only audio under the Invasion of Privacy Act 1971, so common-property visual recording is largely lawful there, subject to nuisance, trespass and stalking limits . Victoria has an activity-based optical-surveillance offence and New South Wales a narrower one , so their rules are stricter than Queensland's. Do not treat one state's policy as national.
Who is allowed to view the footage?
Only authorised people, for a proper purpose, and stored securely. Footage is not there for a committee member to browse. Uncontrolled access and casual disclosure are where most strata surveillance complaints come from, and for a covered manager a leak of footage can be a notifiable data breach.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state surveillance-devices law and state strata law apply separately and vary by jurisdiction, and the position in Queensland (and the exact scope of each state's offence) differs materially from New South Wales and Victoria. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. Surveillance and strata law change over time, so check you are working from a current version and confirm your own state's requirements before installing cameras or relying on this page. For advice on your specific circumstances, consult a qualified Australian legal practitioner.