If you're buying commercial electronic security in NSW in 2026, there are three layers of compliance to think about: the installer's licensing, your industry's sector-specific framework, and privacy law covering the data your system captures. Here's how each layer works and what to check before you sign anything.
Layer 1: Installer licensing
This one's on the installer, not on you — but you should still verify it. Anyone installing or maintaining electronic security in NSW on behalf of a third party must hold an NSW Master Licence under the Security Industry Act 1997.
NSW Master Licence
Issued by NSW Police (SLED — Security Licensing & Enforcement Directorate). The licence is a 6-digit number (ours is 102039) and is public — look it up at police.nsw.gov.au. Sub-classes you'll see on commercial work:
- Class 1A/1B/1C — guards, patrols, bodyguards. Not relevant for pure electronic security.
- Class 1F — monitoring centre operations.
- Class 2A — advising, installing, maintaining, repairing security equipment. This is the one your electronic security installer will hold.
- Class 2B — selling security equipment.
- Class 2C — individual technician licence (held by every tech on site, not just the business).
What to ask any installer: their Master Licence number, the specific sub-classes covered, and confirmation that each tech on site holds their individual 2C.
ASIAL membership
The Australian Security Industry Association Limited is the industry body. Membership isn't legally required but it's a voluntary standard. ASIAL grades members bronze, silver, and gold; gold membership requires an audit of insurance, operations, and compliance. Not every installer bothers — but the ones who hold it are typically the ones who take the operational discipline seriously.
ACMA Cabler Registration
Separate from the security licence. Any technician connecting cabling to the public telecoms network needs Cabler Registration through ACMA. The "Open" registration (plus structured cabling and fibre endorsements) covers most commercial installs. Worth confirming if your project includes data cabling as well as security — if the installer doesn't hold ACMA registration they'll have to sub-contract that part.
Insurance
Not technically compliance, but standard due diligence. For commercial installs you want to see current certificates of currency for public liability (minimum $20M), professional indemnity, and product liability. Reputable installers will have these on request.
Layer 2: Sector-specific frameworks
Beyond the installer's licence, your industry probably has a framework that touches security requirements. These vary significantly in scope and specificity.
National Quality Standard (NQS) — childcare and early-childhood
Element 2.2.1 of the NQS covers "supervision and safe environment" and effectively requires controlled entry, visitor sign-in, and in many cases CCTV coverage of common areas. The ACECQA assessor won't prescribe a specific technology but will fail you if entry isn't controlled or if your visitor register is paper and incomplete. Interactive visitor management + access control at main entries is the pragmatic answer.
Australian Privacy Principles (APP) — anywhere health info is handled
The Privacy Act 1988 (Cth) applies to any organisation with turnover over $3M, and to all health service providers regardless of size. Relevant APPs for electronic security:
- APP 5 (notification of collection): visible signage at the entrance of CCTV-covered sites.
- APP 11 (security of personal information): your footage, access control logs, visitor register are personal information. They need reasonable protection — encrypted transmission, access-controlled storage, named user accounts on the management software.
- APP 11.2 (destruction or de-identification): documented retention policy, with footage overwritten on schedule.
NSW Liquor & Gaming (OLGR) — licensed venues
Any venue with gaming machines or a hotel liquor licence operates under conditions that specify CCTV coverage of gaming floors, cashier points, entrances, and retention of footage for a minimum of 30 days. Audit is regular and specific — footage missing or system offline during an incident is a licence problem, not just a security problem.
TGA Good Distribution Practice — pharmaceutical logistics
GDP doesn't name a number of days for retention, but requires "sufficient" coverage and retention to support product traceability. In practice sites we install under GDP run 90-day retention minimum, with the policy documented in the client's quality system.
Aged Care Quality Standards
No Commonwealth mandate for a specific retention period, but the standards require that you can investigate complaints — which can be lodged weeks after the event. Most aged care providers we work with run 60-90 days of CCTV retention and access control covering restricted areas (medication storage, resident records, administration).
Security of Critical Infrastructure Act (SOCI)
Operators designated under the SOCI Act (electricity, water, telecoms, data storage, defence industry base, financial services, among others) have sector-specific risk management obligations that include physical security. Requirements come from the Cyber and Infrastructure Security Centre. If you're a designated operator you know you are, and the answer comes from your sector's risk management program.
Layer 3: What any auditor will want to see
Across sectors, if an auditor or regulator comes knocking, the document trail they'll ask for is pretty consistent:
- As-built drawings and cable schedule from the installer
- Device inventory with firmware versions
- Credential register with cardholder list and access rights
- CCTV retention policy and evidence it's being enforced
- Service log from the last 12 months with each visit documented
- Backup test results — can you actually restore the management database
- Named user accounts on the management software with role-based permissions
- Visitor register with timestamps and host names
- Any CCTV signage and the Privacy Policy that describes the collection
- Insurance certificates (your own, not the installer's)
If you can produce these within an hour of an auditor asking, you're in good shape. If any one of them doesn't exist or is years out of date, that's the one the audit will focus on.
What to ask your installer about compliance
Specific questions worth putting to any installer before signing:
- What's your Master Licence number and which sub-classes does it cover?
- Do you provide as-built documentation at handover?
- Will the system you're proposing meet [name your sector's framework] — can you point to a comparable client?
- What retention period are you sizing the storage for, and where does that number come from?
- How are user accounts and audit logs handled on the management software?
- What's the backup and restore procedure, and is it tested?
- What written response SLA will you provide on compliance-critical faults?
What changes in 2026
A few compliance items worth being aware of this year:
- Notifiable Data Breaches: OAIC has been more active in 2026 on CCTV-related breach notifications. Treat footage retention and access controls on the NVR with the same seriousness as any other personal information store.
- ACMA cabler compliance: ACMA has signalled tighter audit of cabler registration on commercial fit-outs. Ask your installer whether their techs hold current open-level registration.
- Aged care: the Aged Care Quality and Safety Commission has been clearer about incident-investigation capability as a standards expectation. 30-day CCTV retention is the new effective floor for aged care sites.
Where to start
If you're scoping a commercial security install or upgrade and want the compliance side done properly from day one, get in touch. We'll walk your site, map your sector's compliance obligations against what the system needs to do, and give you a design and a quote that satisfies both. See our FAQs for broader compliance questions, or the buying guides for sector-specific detail.
