Employee Monitoring in New Zealand: Your Rights & Employer Obligations (2026)

If you work in New Zealand and your employer uses software to track your keystrokes, read your emails, or monitor your location via GPS, you have specific privacy rights under the Privacy Act 2020. This guide explains what your employer can and cannot do, and what to do if you suspect your rights have been breached.

1. What Counts as Employee Monitoring?

Employee monitoring includes any systematic collection of data about your work activities. Common examples in NZ workplaces:

• Keylogging – recording every keystroke you type
• Email monitoring – reading incoming/outgoing emails (including personal emails on work systems)
• GPS tracking – tracking company vehicles or work phones in real time
• Screen recording / webcam activation
• Internet and app usage logs
• Biometric data (fingerprint scans, facial recognition for timekeeping)

2. The Privacy Act 2020 – Your Key Protections

The Privacy Act 2020 sets out 13 Information Privacy Principles (IPPs). The two most relevant for monitoring are IPP 1 and IPP 3.

IPP 1 – Purpose of Collection

Your employer must only collect monitoring data for a lawful purpose that is necessary for their business. For example:

• Preventing theft of client data (keylogging on sensitive systems)
• Ensuring vehicle safety (GPS tracking for delivery drivers)
• Complying with industry regulations (e.g., financial services recording calls)

Monitoring for vague reasons like “improving productivity” without a specific, documented need is likely a breach of IPP 1.

IPP 3 – Collection Must Be Fair and Not Unlawful

Under IPP 3, your employer must collect information in a way that is fair and does not intrude to an unreasonable extent on your personal affairs. Secret monitoring (e.g., hidden cameras in break rooms, undisclosed keyloggers) is almost always a breach of IPP 3.

3. The Notification Requirement – You Must Be Told

Under IPP 3 (read together with section 22 of the Privacy Act), your employer must take reasonable steps to make you aware that monitoring is happening. This includes telling you:

• That monitoring is occurring (e.g., “We use GPS tracking on all company vehicles”)
• What type of data is collected (e.g., keystrokes, emails, location)
• Why it is being collected (the purpose)
• Who will have access to the data
• How long it will be kept

Notification should be in your employment agreement, an employee handbook, or a clear policy that you have acknowledged. A vague mention in a staff meeting is not enough.

4. Specific Monitoring Types – What’s Allowed?

Keylogging

Keylogging is high-risk. It can capture passwords, personal messages, and confidential information. The Privacy Commissioner has said keylogging should only be used in exceptional circumstances (e.g., investigating a specific security breach) and with clear, prior notice. Blanket keylogging of all staff is almost never justified.

Email Monitoring

Employers can monitor work emails for legitimate business purposes (e.g., data loss prevention). However, if you use your work email for personal messages (which many NZ employees do), your employer must have a policy that explains how they handle personal content. They cannot read your personal emails without a very good reason (e.g., a court order or serious misconduct investigation).

GPS Tracking

GPS tracking of company vehicles or work phones is generally acceptable if the purpose is work-related (e.g., route optimisation, safety). But tracking outside work hours or tracking personal vehicles without consent is likely a breach. The employer must also ensure the data is not used to monitor personal activities.

5. What to Do If You Think Your Rights Are Breached

1. Check your employment agreement and policies – see if monitoring is disclosed.
2. Ask your employer in writing – request a copy of the monitoring policy and what data is collected.
3. Raise a formal complaint – if you are not satisfied, you can raise a personal grievance (within 90 days of the breach).
4. Complain to the Privacy Commissioner – the Office of the Privacy Commissioner can investigate and issue compliance notices.

6. Best Practice for Employers (and What Staff Should Expect)

Employers who want to avoid personal grievances and Privacy Act complaints should:

• Conduct a privacy impact assessment before implementing monitoring
• Have a written monitoring policy that is clear and accessible
• Only collect data that is strictly necessary
• Limit access to monitoring data to authorised personnel
• Delete data when it is no longer needed

If you are an employer or manager looking for a compliant monitoring solution, ShiftScript’s employee monitoring tools are designed with NZ privacy law in mind – including built-in notification workflows and data minimisation features.

7. Summary – Your Rights at a Glance

• Your employer must have a lawful purpose for monitoring (IPP 1).
• You must be notified before monitoring starts (IPP 3).
• Monitoring must be fair and not intrusive (IPP 3).
• Secret monitoring is almost always a breach.
• You can raise a personal grievance if your rights are violated.