CCTV and surveillance on strata common property: the privacy rules
Whether the Privacy Act reaches your cameras depends on whether your managing-agent business is a covered entity. Your state's surveillance-devices law and the scheme's own common-property authorisation and by-laws apply either way. The rule that holds across New South Wales, Victoria and Queensland is audio: using a listening device to record a private conversation you are not a party to is a criminal offence in all three. Optical rules differ by state, so aim cameras at shared areas rather than private lots, and tell residents and visitors that recording is taking place. If your business is a covered APP entity, the Australian Privacy Principles add a further layer over the footage.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
Three layers of law sit over a strata camera
It is easy to assume "CCTV equals a privacy issue equals the Privacy Act." In strata that is only partly true, and the Privacy Act is usually the least important of three layers:
- State surveillance-devices law is the first and most universal layer, and the instrument is not called the same thing everywhere. New South Wales has the Surveillance Devices Act 2007, Victoria the Surveillance Devices Act 1999 and Western Australia the Surveillance Devices Act 1998, while Queensland has no Surveillance Devices Act at all: its instrument is the Invasion of Privacy Act 1971, which regulates listening devices only. Whichever applies, this layer binds regardless of your turnover and regardless of the Privacy Act. Check the current instrument for the state the building is in.
- Strata law and the scheme's own authorisation are the second layer. Installing a camera on common property is a change to common property that the owners corporation has to authorise. In New South Wales that means a special resolution: Strata Schemes Management Act 2015 (NSW) s 108(2) provides that any such action "may be taken by the owners corporation or owner only if a special resolution has first been passed by the owners corporation that specifically authorises the taking of the particular action proposed". Victorian and Queensland schemes authorise common-property works through their own owners-corporation and body-corporate processes, and a scheme may also make a by-law or rule about how the cameras are used. Without that authorisation, the installation itself can be challenged before it ever becomes a privacy question.
- The Privacy Act and the APPs are the third layer, and they only bind you if your managing-agent business is a covered entity. The main triggers are an annual turnover of more than A$3 million in a financial year that has ended since the provision commenced (once crossed, that is permanent: Privacy Act 1988 (Cth) s 6D(4)(a)), being a related body corporate of an entity that is covered (s 6D(9)), or one of the other s 6D(4) triggers, such as disclosing personal information about someone for a benefit. An owners corporation whose turnover has never crossed the threshold, and which is not caught by one of the other triggers, is a small business operator and sits outside this layer. Work out your own position rather than assuming it.
The important honesty point: even a manager who is genuinely exempt from the Privacy Act is not free of surveillance rules. The first two layers still apply in full.
The rules that bind you regardless of the Privacy Act
These come from state surveillance-devices law and the by-law, and they apply to every scheme, exempt or not:
- Video only. No private conversation. Using a listening device to overhear or record a private conversation you are not a party to is a criminal offence: Surveillance Devices Act 2007 (NSW) s 7(1)(a), Surveillance Devices Act 1999 (Vic) s 6, and Invasion of Privacy Act 1971 (Qld) s 43(1). The maximum penalties sit in the Acts (500 penalty units for a corporation under the New South Wales provision; 40 penalty units or 2 years' imprisonment under the Queensland one). A common-property camera is never a party to what it records, so keep cameras video-only: do not enable microphones, and disable audio on any camera or video intercom that has it. Common-property cameras must be video-only.
- Aim cameras at shared areas, not into private lots. How hard this bites depends on the state. In Victoria it is an offence to knowingly install, use or maintain an optical surveillance device to record or observe a private activity you are not a party to, without consent (Surveillance Devices Act 1999 (Vic) s 7). New South Wales is narrower: its optical offence turns on entry onto premises or a vehicle, or interference with a vehicle or object, without consent (Surveillance Devices Act 2007 (NSW) s 8(1)). Queensland has no general optical offence. Everywhere, though, a camera looking into a lot, a courtyard or a window is the position most likely to breach state law, the scheme's by-law or, for a covered business, the APPs.
- Notice. The surveillance legislation in New South Wales, Victoria and Queensland does not itself require CCTV signage. The duty to tell people comes from elsewhere: APP 5 if your business is a covered entity (the OAIC's position is that such an organisation must "tell you that your image may be captured before you're recorded"), and the scheme's own by-law or rules. Signage at the monitored areas is the standard way to do it, and it is worth doing either way.
- Controlled footage access. Store footage securely and let only authorised people view it, for a defined purpose. Where that is a legal duty rather than good practice: APP 11 if your business is a covered entity; in Victoria, Surveillance Devices Act 1999 (Vic) s 11 restricts communicating or publishing a record of a private conversation or activity; and in Queensland, footage kept as a body-corporate record runs through the access regime in Body Corporate and Community Management Act 1997 (Qld) s 205. Footage is not there for a committee member to trawl through.
Because these obligations do not depend on the Privacy Act, "we are under the small-business exemption" is not an answer to a surveillance-law problem. This is the single most misunderstood point in strata CCTV.
Audio is the hard line
The sharpest rule to get right is audio. Optical surveillance is treated differently in each of the three states covered here (Victoria has an offence for recording a private activity, New South Wales an offence keyed to entry or interference, Queensland none), and a common-property camera is often lawful with the right setup. Audio is the constant: recording a private conversation you are not a party to is a criminal offence in all three (Surveillance Devices Act 2007 (NSW) s 7(1)(a); Surveillance Devices Act 1999 (Vic) s 6; Invasion of Privacy Act 1971 (Qld) s 43(1)). Many modern cameras, doorbells and video intercoms record sound by default, and in a strata setting that default can turn a lawful camera into an unlawful listening device. Treat audio as off unless you have confirmed a specific legal basis in your own state.
The states are not the same, and Queensland is the outlier
Surveillance-devices law is state law and it differs materially, so a NSW policy is not a national policy.
- Victoria makes it an offence to knowingly install, use or maintain an optical surveillance device to record or observe a private activity you are not a party to, without consent (Surveillance Devices Act 1999 (Vic) s 7). New South Wales regulates optical surveillance more narrowly: under s 8(1) of the Surveillance Devices Act 2007 (NSW) the offence bites only where the installation, use or maintenance "involves (a) entry onto or into the premises or vehicle without the express or implied consent of the owner or occupier .. or (b) interference with the vehicle or other object without the express or implied consent of the person having lawful possession or lawful control". Either way, keeping cameras off private lots is the safe position, and for a covered business the APPs apply to the footage.
- Queensland is the outlier of the three states covered here: it has no general optical-surveillance (CCTV) offence. The Invasion of Privacy Act 1971 (Qld) regulates listening devices only, and s 43(1) makes it an offence to use a listening device to overhear, record, monitor or listen to a private conversation (maximum 40 penalty units or 2 years' imprisonment), with an exception at s 43(2)(a) where the user is a party to the conversation. Common-property visual recording is therefore largely lawful in Queensland, subject to Criminal Code 1899 (Qld) ss 227A-227B (observing or recording where a reasonable adult would expect privacy), to nuisance and trespass, and to body-corporate authorisation. ⚠️ Reform has been recommended, not enacted. The Queensland Law Reform Commission recommended a new surveillance-devices regime, including offences covering optical surveillance, in Report No 77 (February 2020, tabled 29 June 2020, with a draft Bill), and the Queensland Department of Justice has since consulted on civil surveillance reform. No such offence had commenced as at the date on this page, so treat the Queensland position as current rather than settled, and check before you rely on the gap.
If you manage schemes outside NSW, Victoria and Queensland, do not assume any of the above transfers. Check your own state's Surveillance Devices Act before you install or write a policy. Read: strata CCTV rules by state.
If your business is covered, the APPs add a layer
Where your managing-agent business is a covered APP entity, CCTV footage of identifiable people is personal information, so the Australian Privacy Principles apply on top of the surveillance-devices rules.
- Collect only what is reasonably necessary (APP 3.2). An organisation must not collect personal information unless it is reasonably necessary for one or more of its functions or activities, so each camera should have a purpose. Do not blanket a building with cameras because you can.
- Notify before recording (APP 5). The OAIC's security-cameras guidance puts it as: a covered organisation must "tell you that your image may be captured before you're recorded".
- Keep footage secure and destroy or de-identify it when no longer needed (APP 11). The same guidance: "make sure recorded personal information is secure and destroyed or de-identified when it is no longer needed".
- Notify before recording (APP 5). Signage and a clear collection notice, so people know the footage is being captured and by whom.
- Keep footage secure and destroy or de-identify it when no longer needed (APP 11). A retention rule for footage, not indefinite storage, and controlled access.
If your managing-agent business is covered, a footage breach can also be a notifiable data breach. Part IIIC of the Privacy Act requires an entity that has reasonable grounds to suspect an eligible data breach to take all reasonable steps to complete an assessment within 30 days (s 26WH(2)), and, where serious harm is likely, to notify affected individuals and the Commissioner (ss 26WK, 26WL). Read: a data-breach response plan for strata managers.
Facial recognition and number-plate cameras are the highest-risk zone
Ordinary CCTV is one thing. Cameras that identify individuals biometrically are another. If your managing-agent business is a covered APP entity, facial recognition and automatic number-plate recognition (ANPR) are the highest-risk surveillance you can run. Biometric information that is to be used for automated biometric verification or biometric identification, and biometric templates, are sensitive information under s 6(1) of the Privacy Act, and APP 3.3 sets a higher bar for collecting sensitive information. The OAIC's Bunnings determination (29 October 2024) found breaches of APP 1, APP 3 and APP 5 for facial-recognition use. On 4 February 2026 the Administrative Review Tribunal affirmed the APP 1 and APP 5 findings, holding that Bunnings "failed to provide appropriate notice to individuals of its use of FRT", but set aside the APP 3.3 finding, holding that Bunnings was entitled to rely on an exception to the consent requirement "for the limited purpose of combatting retail crime and protecting their staff and customers from violence, abuse and intimidation". Treat any biometric or ANPR proposal as a stop-and-get-advice moment. Read: facial recognition, ANPR and smart surveillance in strata buildings.
A note on the new statutory tort
Separately from all three layers above, Separately from the three layers above, a statutory tort of serious invasion of privacy was enacted in the Privacy and Other Legislation Amendment Act 2024 (Cth) and commenced on 10 June 2025. It is narrow, and all of its conditions have to be met: Schedule 2 cl 7(1) requires an intrusion on seclusion or a misuse of information, a reasonable expectation of privacy, conduct that was intentional or reckless (carelessness is not enough), a serious invasion, and a public interest in privacy that outweighs any countervailing public interest. It is one more reason to get the authorisation, the camera aim and the audio setting right the first time.
Common questions
Does the Privacy Act govern our strata cameras?
Usually not as the main law. Cameras on common property are governed first by your state's surveillance-devices law and your scheme's by-law, which apply regardless of turnover. The Privacy Act and the APPs only add a layer if your managing-agent business is a covered entity (turnover over A$3 million or part of a larger covered group).
What are the privacy rules for CCTV on strata common property?
Three layers sit over a common property camera, and only one of them is the Privacy Act. Your state's surveillance-devices law binds the cameras whatever your turnover, the scheme's own authorisation and by-laws have to permit the installation, and the Australian Privacy Principles apply on top only if your managing-agent business is a covered entity. The rule that holds across New South Wales, Victoria and Queensland is audio: using a listening device to record a private conversation you are not a party to is a criminal offence in all three.
Is CCTV legal at a residential property in Australia?
For strata common property, which is what this page covers, the answer is that cameras aimed at shared areas are generally permissible where the scheme has authorised them and the state's surveillance-devices law is observed, while audio recording is the hard line. Cameras aimed into a private lot are a different question and the state optical rules differ, so check your own jurisdiction rather than reading a New South Wales answer as national. This page does not cover a stand-alone house or a rental property, where the rules are not the same.
Can we record audio on common-property CCTV?
Treat audio as off. Recording a private conversation with a listening device without consent is a criminal offence under state surveillance law across the states. Many cameras and video intercoms record sound by default, so disable it unless you have specific, verified legal ground in your state to record it .
We turn over under $3 million, so are we exempt from the CCTV rules?
No, not from all of them. The small-business exemption is a Privacy Act concept, and state surveillance-devices law plus your scheme's by-law bind you independently of it. An exempt manager still cannot use a listening device to record a private conversation it is not a party to (Surveillance Devices Act 2007 (NSW) s 7(1)(a); Surveillance Devices Act 1999 (Vic) s 6; Invasion of Privacy Act 1971 (Qld) s 43(1)), and still has to work within the scheme's authorisation and by-laws and within its own state's optical-surveillance rules, which differ. The signage and footage-security duties in the Australian Privacy Principles, by contrast, apply only if your business is covered.
Is Queensland really different?
Yes, materially. Queensland has no general optical-surveillance offence and regulates only audio under the Invasion of Privacy Act 1971, so common-property visual recording is largely lawful there, subject to nuisance, trespass and stalking limits . Victoria has an activity-based optical-surveillance offence and New South Wales a narrower one , so their rules are stricter than Queensland's. Do not treat one state's policy as national.
Who is allowed to view the footage?
Only authorised people, for a proper purpose, and stored securely. Footage is not there for a committee member to browse. In Victoria, communicating or publishing a record of a private conversation or activity is separately restricted (Surveillance Devices Act 1999 (Vic) s 11); in Queensland, footage kept as a body-corporate record runs through the access regime in Body Corporate and Community Management Act 1997 (Qld) s 205; and if your business is a covered APP entity, APP 11 applies to the footage and a leak can be a notifiable data breach.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state surveillance-devices law and state strata law apply separately and vary by jurisdiction, and the position in Queensland (and the exact scope of each state's offence) differs materially from New South Wales and Victoria. Surveillance and strata law change over time, so check you are working from a current version and confirm your own state's requirements before installing cameras or relying on this page. For advice on your specific circumstances, consult a qualified Australian legal practitioner.