Drone Licence Australia 2026: Privacy, Surveillance and Data Laws Every Commercial Drone Pilot Must Know

Short Direct Answer

CASA regulates how a drone flies, but it does not decide whether recording people is lawful. Commercial pilots must separately assess privacy, surveillance, work health and safety, contract and data-security duties before capturing or sharing footage.

Meta description: Drone licence Australia guide to privacy, surveillance and data duties for commercial pilots. Build compliant systems and book your training today.

Detailed Explanation: Why flight compliance is only half the job

A commercial drone can collect more than aerial images. It may record faces, voices, vehicle plates, location details, work activities or information about a private home. Some of that material may identify a person, directly or when combined with other details.

That creates a compliance gap for operators. They may check airspace, aircraft registration and flight approvals, but overlook what the camera or microphone collects. A lawful flight does not automatically make every recording, use or disclosure lawful.

Think of the rules as two separate layers:

• Aviation rules: CASA regulates aircraft, pilots and flight operations.
• Privacy and surveillance rules: The Privacy Act and state or territory laws may regulate personal information, recordings and private activities.
• Workplace and contract rules: Work health and safety duties, client terms and consent arrangements can add requirements.
• Data security: Operators and clients must decide who can access footage, how long they keep it, and when they delete it.

The Office of the Australian Information Commissioner’s drone guidance explains that the Privacy Act can apply when a covered organisation records identifiable images. The Act generally covers Australian Government agencies and organisations with annual turnover above $3 million, as well as some other entities. Therefore, small-business status does not remove every privacy obligation.

Even when the Privacy Act does not apply, state and territory surveillance-device laws may still restrict recording conversations or private activities. These laws differ by jurisdiction. Audio recording is particularly sensitive, so a microphone should not remain active just because a drone has one.

What counts as personal information?

Personal information is information or an opinion about an identified person, or a person who could reasonably be identified. A clear face is an obvious example. However, a name, uniform, vehicle, address, distinctive location or combination of details can also identify someone.

Footage does not need to show a person’s face to create a privacy issue. For example, a video of someone entering a named home may identify them through the property or surrounding context. Likewise, a live video feed can disclose personal information even if the operator never saves a file.

Privacy Act duties: covered organisations

Where the Privacy Act applies, the Australian Privacy Principles (APPs) set rules for handling personal information. In practice, an operator may need to:

• Collect only information reasonably needed for the job.
• Collect information lawfully and fairly.
• Give people notice about collection, where required.
• Use or disclose footage only for an allowed purpose.
• Protect recordings from loss, misuse and unauthorised access.
• Destroy or de-identify personal information when no longer needed, unless a law or other requirement says otherwise.

Importantly, privacy law does not always require consent for every image. However, a client’s permission is not the same as consent from every person whose image or conversation the drone captures.

Key Facts Table: Which rules may apply?

There is no single national “drone privacy law” that answers every case. In addition, no universal retention period applies to all commercial drone footage. The required approach depends on the information, purpose, contract, industry and applicable law.

State and territory surveillance rules

Surveillance-device legislation can apply even if the pilot or business is not covered by the Privacy Act. The laws vary, and their precise application depends on the recording and circumstances.

Examples include:

• Queensland: The Invasion of Privacy Act 1971 restricts certain listening-device use involving private conversations.
• Victoria: The Surveillance Devices Act 1999 addresses listening devices and optical surveillance, including some private activities.
• New South Wales: The Surveillance Devices Act 2007 covers listening, optical, tracking and data-surveillance devices.
• Western Australia: The Surveillance Devices Act 1998 regulates listening, optical and tracking devices.
• Tasmania: The Listening Devices Act 1991 addresses listening devices and private conversations. Other workplace, police and general laws may also matter.

These are practical signposts, not legal advice or a complete statement of the law. Check the current legislation for the state or territory where you will fly. The Australian Government’s state and territory drone rules guide is a useful starting point.

Step-by-Step Process: Build privacy checks into every job

A short, repeatable process helps pilots meet their duties and gives clients confidence. Use these steps before accepting a job.

1. Define the purpose. Write down what the client needs and what data the job requires. Avoid collecting footage “just in case.”
2. Identify the people and places involved. Note homes, backyards, workplaces, public areas, schools, events and sensitive sites.
3. Check the applicable rules. Confirm the Privacy Act position, state or territory surveillance laws, WHS duties, site rules and contract terms.
4. Plan notice and consent. Agree who will notify workers, residents, visitors or event attendees. Use signs, notices or direct communication where appropriate.
5. Reduce unnecessary capture. Choose a flight path and camera angle that focus on the task. Disable audio unless it is necessary and legally cleared.
6. Set access and storage controls. Decide who receives footage, where it is stored, how it is transferred and who can view it.
7. Set a retention and deletion rule. Keep material only as long as needed for the documented purpose, unless a legal, safety or contract duty requires longer.
8. Record the process. Keep the client brief, approvals, notices, risk checks, transfer records, deletion dates and any complaints or incidents.

The process should appear in the operator’s documented procedures, not live only in the pilot’s memory. Use consent forms where consent is needed, but do not treat a signed client form as permission from unrelated people.

Secure client footage from capture to deletion

Data control continues after landing. A pilot should avoid personal cloud accounts or open file-sharing links for sensitive work. Use controlled access, strong passwords and secure transfer methods. Also, remove footage from memory cards and devices when the approved copies are safely stored.

Set a deletion date when you create the project folder. If the client requests a longer period, record the reason and identify who may access the material. For covered organisations, APP 11 requires reasonable steps to protect personal information and to destroy or de-identify it when no longer needed.

A serious data breach may trigger notification duties under the Notifiable Data Breaches scheme, if the organisation and incident fall within the scheme. Therefore, include lost devices, misdirected emails and exposed share links in your response plan.

Examples: How the rules work in the field

Example 1: Roof inspection beside a private courtyard

A contractor hires a pilot to inspect roof damage. The planned camera angle also looks into a neighbour’s courtyard. The client’s permission to inspect its roof does not grant authority to record unrelated private activity next door.

The pilot can adjust the route, narrow the camera view, pause when people enter the frame, and crop or blur unrelated images. If the job cannot avoid intrusive capture, the operator should seek legal advice before proceeding.

Example 2: Council asset survey in a public park

A council asks a drone team to document paths and lighting. The task may incidentally capture park visitors. The operator and council should agree on notices, flight timing, access to footage and a retention period before launch.

A council contract may require extra approvals or reporting. In addition, the operator must manage aviation and workplace safety requirements. The council’s status as client does not remove the pilot’s own responsibility to fly safely and follow applicable recording rules.

Example 3: Thermal inspection after dark

A building manager requests thermal images of a roof at night. Thermal equipment can reveal activity or heat patterns associated with people, even when it does not capture a conventional photograph.

The operator should use only the detail needed for the inspection. They should also tell the client what the sensor can capture, restrict access and avoid recording private spaces. Separately, any night flight must meet applicable CASA requirements and approvals.

Common Mistakes Commercial Pilots Should Avoid

A good checklist prevents these frequent errors:

• Assuming CASA approval covers privacy. It does not. CASA regulates flight operations, not every recording or use of personal information.
• Treating client permission as universal consent. A landowner or client cannot automatically consent on behalf of neighbours, staff or visitors.
• Leaving the microphone on. Audio can capture private conversations and trigger specific state or territory restrictions.
• Keeping every file indefinitely. Unneeded footage increases privacy and security risk.
• Sharing raw footage too widely. Send only the required files to approved recipients.
• Posting client footage online without checking terms. A work contract may limit publication, even if the footage appears harmless.
• Ignoring incidental images. A person, address, vehicle or workplace detail may identify someone.
• Relying only on signage. Notices help, but they do not replace legal checks or operational controls.
• Using personal devices without safeguards. Lost phones, unsecured memory cards and public links can expose client data.
• Assuming small businesses have no privacy duties. Privacy Act coverage has exceptions, and other laws may still apply.

Documented privacy procedures can become a commercial advantage. Councils, construction firms, utilities and other clients often want evidence that a contractor can manage data responsibly. Clear notices, secure storage and consistent deletion controls help build trust.

CASA and Regulator Considerations: Separate but connected duties

CASA sets aviation rules. Before each flight, check the current requirements for aircraft, pilot credentials, airspace, location, operating conditions and any required approval. Read CASA’s drone guidance and review Ace Aviation’s guides to drone registration, accreditation and legal obligations and night operations, controlled airspace and ReOC pathways.

However, neither a RePL nor a ReOC gives a pilot blanket permission to record private conversations or activities. An AROC supports aeronautical radio operations where required; it does not replace privacy checks. Similarly, a ReOC supports a business operating framework but does not override privacy, WHS or contract duties.

Work health and safety obligations also matter. A person conducting a business or undertaking must manage risks to workers and others, so far as reasonably practicable. For drone work, that can include site access, exclusion zones, worker notification, public safety and safe handling of recorded material.

Insurance provides another separate check. A policy may not cover every privacy or data claim. Review Ace Aviation’s guide to drone insurance and public liability and confirm cover with a qualified broker.

Training can turn compliance into capability

A professional pathway helps pilots understand how flight planning, radio use, site risk and record keeping fit together. Ace Aviation delivers CASA-approved training under CASA.ReOC.1421 and has trained more than 4,000 students. Its global footprint includes Australia, Singapore, Dubai, Korea and Malaysia.

For many commercial pilots, the practical pathway includes:

• RePL: Remote Pilot Licence training for pilot competence.
• AROC: Aeronautical Radio Operator Certificate training for relevant radio operations.
• Certificate III in Aviation: A formal qualification delivered in partnership with Reach Community College.

Students can explore Ace Aviation’s course options and learn about the academy’s approach on Why Ace. Benefits such as Altitude+ support the student experience, while the DroneWork job board helps qualified pilots explore commercial opportunities. Neither training nor job-board access guarantees work; pilots must still meet each client’s requirements.

Local training options include drone course Brisbane, drone course Sydney, drone course Melbourne, a drone pilot course Perth, and drone training Hobart. The law may vary by state, so pilots should check local surveillance rules as well as CASA requirements.

Frequently Asked Questions

1. Can I film people with a drone without their consent?

Sometimes an image may be captured without individual consent, but that does not make every recording lawful. Privacy Act, surveillance, site, workplace and contract rules may apply. Minimise incidental recording and provide notice where required.

2. Can I fly over private property?

CASA flight rules still apply, and property access or local restrictions may affect the operation. Flying over a property does not give you permission to record private activities. Check both flight and privacy requirements.

3. Can I use a drone as a security camera?

A drone used for security may engage privacy and surveillance-device laws. Define the purpose, limit what it records, give notice where required and check the law in the state or territory.

4. How long can I store client footage?

There is no single retention period for all drone footage. Follow the contract, relevant law and the organisation’s documented retention schedule. Delete or de-identify material when it is no longer needed, unless a valid requirement says otherwise.

5. Can a council hire a drone operator to film public areas?

Yes, but the council and operator should agree on purpose, notices, access, storage and retention. The operator must also meet aviation, privacy, surveillance and workplace duties.

6. Is night surveillance allowed?

The answer depends on the purpose, location, recording type and applicable laws. In addition, CASA requirements for night flying apply separately. A flight approval does not automatically authorise intrusive recording.

7. Does thermal imaging raise privacy concerns?

It can. Thermal images may reveal information about people or activities. Use only the detail needed for the task, restrict access and avoid private spaces.

8. What should I do after a data breach?

Secure the affected accounts or devices, preserve relevant records and follow your incident plan. Assess whether the Notifiable Data Breaches scheme or a client contract requires notification. Seek legal or privacy advice promptly.

9. Does CASA regulate drone privacy?

No. CASA regulates aviation safety and flight operations. Privacy and surveillance duties sit with the relevant privacy and state or territory regulators, along with contractual and workplace responsibilities.

10. Do small drone businesses need to follow the Privacy Act?

Some small businesses are exempt, but exceptions apply. Also, state or territory surveillance-device laws and client contracts may apply regardless of Privacy Act coverage.

11. Do I need consent to record audio from a drone?

Do not assume you can record audio. Rules differ by state and territory, and private conversations receive specific protection. Disable the microphone unless the need and legal basis are clear.

12. Is signage enough to notify people?

Signage can help people understand that recording may occur. However, signage alone may not meet every legal, contract or workplace requirement. Use the notice method suited to the operation.

13. Can I publish footage captured for a client?

Check the contract and obtain any required permissions before publishing. Footage collected for one purpose may not be suitable for a different purpose, such as marketing or social media.

14. Does a live video feed count as data collection?

It may. Live viewing can capture or disclose identifiable information even if no file is saved. Apply suitable access controls and limit the feed to authorised viewers.

15. What privacy duties apply when filming workers?

Workplace monitoring rules, WHS duties, privacy laws and employment policies may apply. Coordinate with the employer, notify workers where required and limit collection to the stated work purpose.

16. Are drone privacy rules the same in every Australian city?

No. Federal privacy rules apply where relevant, but surveillance-device laws differ by state and territory. Local site, council and workplace rules may also vary.

17. Do clients need to provide consent forms?

There is no single answer for every job. The client should help manage access and notices, but the operator should confirm who is responsible for consent, notification and handling incidental footage.

18. Can I keep footage for training or marketing?

Only when the contract, privacy requirements and any necessary permissions allow it. Remove identifying details where appropriate, and do not assume operational footage is automatically available for promotion.

Summary

A drone licence Australia pathway gives a pilot essential aviation skills, but it does not settle privacy or surveillance questions. CASA governs the flight. The operator must also check the Privacy Act where it applies, state and territory recording laws, workplace duties, client contracts and data-security controls.

Build privacy into each mission. Define the purpose, notify people where required, avoid unnecessary audio or visual capture, secure files and follow a clear retention schedule. These steps reduce risk and help clients trust your operation.

Ace Aviation’s RePL, AROC and Certificate III in Aviation pathways support pilots who want to develop professional flying and compliance skills. For training details, contact the Ace Aviation team.

Ready to start? Book your training at aaa.edu.au or call 1300 336 366.

{“@graph”:[{“@id”:”https://aaa.edu.au/#organization”,”url”:”https://aaa.edu.au/”,”name”:”Ace Aviation Aerospace Academy”,”@type”:”Organization”,”telephone”:”+61 1300 336 366″,”description”:”Ace Aviation Aerospace Academy provides CASA-approved drone pilot training, RePL, AROC, ReOC support and Certificate III in Aviation pathways.”},{“@type”:”Article”,”image”:[“https://cdn.marblism.com/UjAn-Mkw4uU.jpeg”,”https://cdn.marblism.com/I-nXKhkBgS3.jpeg”,”https://cdn.marblism.com/M5DWP1PxXiT.jpeg”,”https://cdn.marblism.com/jNtPe0gMCeV.jpeg”],”author”:{“@id”:”https://aaa.edu.au/#organization”},”headline”:”Drone Licence Australia 2026: Privacy, Surveillance and Data Laws Every Commercial Drone Pilot Must Know”,”keywords”:[“drone licence australia”,”commercial drone licence australia”,”drone privacy Australia”,”drone surveillance laws”,”commercial drone data handling”,”RePL”,”AROC”,”Certificate III in Aviation”],”publisher”:{“@id”:”https://aaa.edu.au/#organization”},”inLanguage”:”en-AU”,”description”:”A practical guide to privacy, surveillance, work health and safety, and data-handling duties for Australian commercial drone operators.”,”dateModified”:”2026-10-12″,”datePublished”:”2026-10-12″,”articleSection”:[“Drone Training”,”CASA Compliance”,”Privacy”,”Surveillance”,”Commercial Drone Operations”]},{“@type”:”FAQPage”,”mainEntity”:[{“name”:”Can I film people with a drone without their consent?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Sometimes an image may be captured without individual consent, but that does not make every recording lawful. Privacy Act, surveillance, site, workplace and contract rules may apply. Minimise incidental recording and provide notice where required.”,”@type”:”Answer”}},{“name”:”Can I fly over private property?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”CASA flight rules still apply, and property access or local restrictions may affect the operation. Flying over a property does not give you permission to record private activities. Check both flight and privacy requirements.”,”@type”:”Answer”}},{“name”:”Can I use a drone as a security camera?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”A drone used for security may engage privacy and surveillance-device laws. Define the purpose, limit what it records, give notice where required and check the law in the state or territory.”,”@type”:”Answer”}},{“name”:”How long can I store client footage?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”There is no single retention period for all drone footage. Follow the contract, relevant law and the organisation’s documented retention schedule. Delete or de-identify material when it is no longer needed, unless a valid requirement says otherwise.”,”@type”:”Answer”}},{“name”:”Can a council hire a drone operator to film public areas?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Yes, but the council and operator should agree on purpose, notices, access, storage and retention. The operator must also meet aviation, privacy, surveillance and workplace duties.”,”@type”:”Answer”}},{“name”:”Is night surveillance allowed?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”The answer depends on the purpose, location, recording type and applicable laws. In addition, CASA requirements for night flying apply separately. A flight approval does not automatically authorise intrusive recording.”,”@type”:”Answer”}},{“name”:”Does thermal imaging raise privacy concerns?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”It can. Thermal images may reveal information about people or activities. Use only the detail needed for the task, restrict access and avoid private spaces.”,”@type”:”Answer”}},{“name”:”What should I do after a data breach?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Secure the affected accounts or devices, preserve relevant records and follow your incident plan. Assess whether the Notifiable Data Breaches scheme or a client contract requires notification. Seek legal or privacy advice promptly.”,”@type”:”Answer”}},{“name”:”Does CASA regulate drone privacy?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”No. CASA regulates aviation safety and flight operations. Privacy and surveillance duties sit with the relevant privacy and state or territory regulators, along with contractual and workplace responsibilities.”,”@type”:”Answer”}},{“name”:”Do small drone businesses need to follow the Privacy Act?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Some small businesses are exempt, but exceptions apply. Also, state or territory surveillance-device laws and client contracts may apply regardless of Privacy Act coverage.”,”@type”:”Answer”}},{“name”:”Do I need consent to record audio from a drone?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Do not assume you can record audio. Rules differ by state and territory, and private conversations receive specific protection. Disable the microphone unless the need and legal basis are clear.”,”@type”:”Answer”}},{“name”:”Is signage enough to notify people?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Signage can help people understand that recording may occur. However, signage alone may not meet every legal, contract or workplace requirement. Use the notice method suited to the operation.”,”@type”:”Answer”}},{“name”:”Can I publish footage captured for a client?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Check the contract and obtain any required permissions before publishing. Footage collected for one purpose may not be suitable for a different purpose, such as marketing or social media.”,”@type”:”Answer”}},{“name”:”Does a live video feed count as data collection?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”It may. Live viewing can capture or disclose identifiable information even if no file is saved. Apply suitable access controls and limit the feed to authorised viewers.”,”@type”:”Answer”}},{“name”:”What privacy duties apply when filming workers?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Workplace monitoring rules, WHS duties, privacy laws and employment policies may apply. Coordinate with the employer, notify workers where required and limit collection to the stated work purpose.”,”@type”:”Answer”}},{“name”:”Are drone privacy rules the same in every Australian city?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”No. Federal privacy rules apply where relevant, but surveillance-device laws differ by state and territory. Local site, council and workplace rules may also vary.”,”@type”:”Answer”}},{“name”:”Do clients need to provide consent forms?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”There is no single answer for every job. The client should help manage access and notices, but the operator should confirm who is responsible for consent, notification and handling incidental footage.”,”@type”:”Answer”}},{“name”:”Can I keep footage for training or marketing?”,”@type”:”Question”,”acceptedAnswer”:{“text”:”Only when the contract, privacy requirements and any necessary permissions allow it. Remove identifying details where appropriate, and do not assume operational footage is automatically available for promotion.”,”@type”:”Answer”}}]}],”@context”:”https://schema.org”}