Employee Records and Privacy in Australia: What the Exemption Covers

Australia's Privacy Act contains a broad employee records exemption that removes most of a private-sector employer's handling of current and former staff records from the Australian Privacy Principles, but it does not cover job applicants, contractors handling another organisation's records, or volunteers.

This article addresses the private-sector employee records exemption at section 7B(3) of the Privacy Act 1988 (Cth), current as at 19 July 2026. It does not address state or territory public-sector employment privacy regimes, which are separate, or the law governing workplace surveillance devices such as CCTV, computer monitoring or vehicle tracking, which is regulated separately by state and territory legislation and covered in recordinglaw.com's guide to workplace surveillance and monitoring in Australia.

What the Employee Records Exemption Covers

Section 7B(3) of the Privacy Act 1988 (Cth) exempts an act done, or practice engaged in, by an organisation that is or was an employer of an individual, where that act or practice is directly related to a current or former employment relationship between the employer and the individual, and to an employee record held by the organisation relating to the individual. In practice, this removes most of a private-sector employer's day-to-day handling of an existing or former staff member's personnel file, including that it does not have to grant an employee access to that file under the Privacy Act. The exemption exists alongside the broader Privacy Act framework, so it applies only to the extent the handling actually relates to the employment relationship and to a genuine employee record; conduct outside that scope is not automatically covered.

What Counts as an "Employee Record"

An employee record is defined under section 6(1) of the Privacy Act 1988 (Cth) as a record of personal information relating to the employment of the employee. The OAIC's guidance lists examples including health information about an employee, and personal information relating to engagement, training, disciplining, resignation or termination of employment, terms and conditions of employment, personal and emergency contact details, performance or conduct, hours of employment, salary or wages, membership of a professional or trade association or a trade union, recreation, long service, sick, maternity, paternity or other leave, and taxation, banking or superannuation affairs.

Not Everything an Employer Holds Is Automatically an Employee Record

An employer cannot assume that everything it holds relating to an employee counts as an employee record. The OAIC's own example is instructive: an employee's bank details may form part of their employee record, but emails an employee receives from their financial institution through a work email account may not, since they may not relate to the employment of the employee at all. Whether particular content sent or received by an employee forms part of their employee record depends on the circumstances. This distinction matters in practice because information an employer holds that falls outside the employee record, for example a record of workplace monitoring not directly related to the employment relationship, can remain subject to the Australian Privacy Principles even though the general employee records exemption exists.

Job Applicants and Unsuccessful Candidates Are Not Covered

The exemption applies only to a current or former employment relationship; it does not extend to a future or prospective one. This means the exemption does not cover the collection of personal information about job applicants who are not subsequently employed, including unsuccessful candidates. If you applied for a private-sector job and were not successful, you may be able to access information the organisation holds about you under the Australian Privacy Principles, including a referee's report, subject to limited exceptions such as where access would breach a confidentiality obligation. Once an employment relationship does form, records the employer holds relating to that person's earlier pre-employment checks become part of the employee record and fall within the exemption from that point.

Contractors Handling Someone Else's Employee Records Are Not Covered

The exemption is written to cover an organisation that is or was the employer, not a third party handling employee information on that employer's behalf. It does not cover contractors and subcontractors who handle another organisation's employee records, regardless of the contractual arrangements in place. This means the exemption is unlikely to apply to organisations providing recruitment, human resources management, or medical, training or superannuation services under contract to an employer, and it does not cover workers compensation insurers that are not themselves the employer of the individual concerned. A contractor or subcontractor that collects employee records from an employer must comply with the Australian Privacy Principles in handling that information, including the notice requirements at APP 5.

Volunteers Are Not Covered

The exemption does not extend to an organisation's handling of a volunteer's personal information, because an organisation and a volunteer are not considered to have an employment relationship for the purposes of the exemption in section 7B(3). An organisation working with volunteers needs to consider its obligations under the Australian Privacy Principles in the ordinary way for that information.

Public Sector Employees Sit Outside the Exemption Entirely

The exemption is a private-sector concept. The Privacy Act 1988 (Cth) covers Australian Government and Norfolk Island administration employee records in full, meaning the Australian Privacy Principles apply to the handling of personal information in current and past employee records for those employees, including a right to access the personal information in your own record. If you are, or were, employed in the private sector, you generally cannot rely on the Privacy Act itself to access your employee record; workplace laws separately require certain records to be made and kept for each employee, and the Fair Work Ombudsman is the relevant contact for accessing those records under workplace law rather than privacy law.

Workplace Surveillance Sits Outside the Privacy Act Framework

The employee records exemption is about the Privacy Act 1988 (Cth), not about whether an employer can lawfully record or monitor you at work. The OAIC's own guidance states that the Privacy Act does not specifically cover surveillance in the workplace; instead, an employer conducting surveillance or monitoring staff must follow the relevant state or territory surveillance or listening devices law, and in some states a dedicated workplace surveillance statute. That state or territory framework applies regardless of whether the resulting record would otherwise be exempt as an employee record under the Privacy Act. The OAIC also notes that if an employer keeps a record of workplace monitoring, such as CCTV footage or computer logs, that does not directly relate to the employment relationship, the Australian Privacy Principles may still apply to that record even though the general employment relationship is otherwise exempt. Recordinglaw.com's guide to workplace surveillance and monitoring in Australia covers the state-by-state surveillance rules that actually govern whether monitoring can occur and what notice it requires.

Complaining About the Handling of Your Employee Record

If your situation falls within the exemption, for example a private-sector employer's handling of your own genuine employee record, the Privacy Act's complaint process generally does not apply, since the Australian Privacy Principles do not govern that conduct. Where your situation falls outside the exemption, such as a contractor mishandling your records or an unsuccessful job application, you can use the ordinary Privacy Act complaint path; see recordinglaw.com's guide to making a privacy complaint in Australia, part of the wider Australia data privacy laws hub, which also covers the Australian Privacy Principles that apply outside the exemption. Other legal frameworks, such as workplace law, discrimination law or work health and safety law, may also be relevant to an employment dispute involving personal information, but they are outside the scope of the Privacy Act and this article.

The Exemption's Future: Proposed Reform, Not Current Law

Reforming or narrowing the employee records exemption has been identified as a candidate for a second tranche of Privacy Act reform, alongside other proposals such as removing the small business operator exemption. As at July 2026, the government has indicated it is progressing consideration of a further reform Bill, but no Bill addressing the employee records exemption has passed and no commencement date has been fixed. The exemption at section 7B(3) remains fully in force. Treat any description of the exemption's removal as a proposal under discussion, not as current law, until a Bill actually passes and commences.

This article provides general legal information about the private-sector employee records exemption under the Privacy Act 1988 (Cth), current as at 19 July 2026. It is not legal advice and does not account for your individual circumstances. For advice about a specific employment or privacy dispute, consult a legal practitioner admitted in the relevant Australian state or territory.