Why using a VPN at work might get you fired
Using a VPN at work can be the sensible response to a security problem, yet it may expose an employee to disciplinary action. A consumer VPN sends traffic through a third-party server and can conceal the ultimate destination from the local network. An employer’s remote-access VPN has a different purpose: it creates a controlled tunnel to company systems. Both use encryption, but mixing one in for the other can look like unauthorised software, concealment or a breach of the code of conduct.
The danger is rarely the tunnel alone. It is the combination of secrecy, personal use and lost visibility. In Australia, dismissal may follow a clear workplace rule, contract, misconduct finding and proportionate process, rather than a supervisor’s general dislike of privacy tools. The Fair Work Act 2009 covers most employees, while state awards and workplace laws matter in some hospitality and retail roles; employment contracts, enterprise policies and, for some data, privacy laws can all shape the case. Whether a dismissal is lawful depends on the facts; using a VPN is not automatically misconduct.
What an employer can technically see
On a company laptop, the IT department may already see far more than the websites an employee opens. Endpoint-management software can inventory running applications, while a corporate DNS server or secure web gateway can record domains, timestamps and traffic volume. It can also flag personal VPN clients, altered proxy settings or connections that bypass the normal gateway. A Sydney finance worker might assume the office network sees nothing because a personal VPN is active, when the device agent still reports the software and its configuration.
Remote work changes the vantage point, not the need for trust. On a home NBN or Telstra connection, the internet provider can often see that the employee has connected to a VPN provider rather than the individual destination. It generally cannot read encrypted traffic. The employer may still receive device inventory, VPN usage or authentication records from its own systems, especially if the laptop is managed, contains corporate data or uses an identity-aware proxy. A Melbourne contractor using a company-managed laptop can therefore be visible to both the network operator and the client organisation.
Technical visibility is not the same as proof of every action, and good logs preserve metadata rather than page contents. Workplace controls, advertising brokers and ordinary internet services also operate different business models, as the wider analysis at Twenty of Time explains. For an employee, the practical lesson is simple: a VPN reduces network visibility but does not make a managed device, account or workplace action invisible.
When personal VPN use crosses a policy line
Many Australian employers permit reasonable personal use but prohibit tools that defeat security controls. A personal VPN may be categorised as unapproved software, especially if it changes the route used for corporate data. It can also bypass filters that block risky downloads, conceal an upload or make an incident harder to investigate. A written rule does not make every enforcement decision fair, but ignoring a clear rule gives the employer a genuine disciplinary rationale.
The reason for connecting matters as much as the technical effect. During lunch in a Melbourne office, an employee might open a personal lifestyle site such as Sassy Mahogany Wife while using a personal VPN. If the policy permits occasional personal browsing, that may be harmless. If the policy forbids personal devices on managed laptops, the same activity looks like deliberate circumvention. A domain visible in a proxy log can raise questions even when the employer cannot prove what was viewed.
Concealment can turn an arguable policy issue into a serious trust problem. “The VPN was for privacy” may sound reasonable, but an employer may ask why company credentials and customer records were routed through a service the organisation did not assess. Australian workplace chats can be casual—‘not a big deal’, ‘all good’, or ‘can you sort it before arvo?’—even when policies are vague. That informality does not remove the need to explain the purpose, request approval or accept a reasonable restriction for the sake of system security.
Legitimate work can still create friction
There are situations where a VPN is the least risky way to complete legitimate work. A Brisbane support analyst may need a US payroll dashboard that is unavailable from Australia, while a Canberra contractor may need access to a European client’s test region. If IT approves a company VPN, that is often the cleanest solution. Installing a consumer VPN subscription can create a second problem: corporate traffic is routed through a vendor whose logging, retention and jurisdiction terms the employer has never accepted.
Approval should match the actual task. Permission to use an approved VPN for an Australian client does not automatically authorise a consumer service for personal browsing, and a manager’s verbal approval may not satisfy a security policy. Duties of confidentiality, client contracts and data-handling rules can restrict the workaround even when it solves an access problem. Asking IT for the right route before acting is more defensible than connecting first and explaining later.
Encryption is also not the same as anonymity, and secure messaging is a separate control from network tunnelling. This explanation of encrypting your messages is useful when discussions blur those distinctions. A VPN may protect the path between a device and a provider; end-to-end encryption protects message content between participants. Using the wrong tool for a workplace policy problem can expose sensitive chats while leaving the network behaviour unchanged.
Remote work, devices and Australian legal reality
Australia’s privacy framework is more nuanced than a blanket claim that employers may monitor everything. For most private-sector organisations, the Privacy Act 1988 does not apply to employee records in the same way it does to customer information. It can still govern other records held by the business, while public agencies in each state and territory operate under their own privacy regimes. Many small Australian firms rely on cloud suites, contractors or managed service providers, so customer-data duties can reach well beyond the employee’s own laptop and account.
Employee monitoring should still be tested against necessity and proportionality, whether the records sit under the federal scheme or a state public-sector law. Transparency matters: employees should know what is collected, why it is collected, how long it is kept and who can see it. The Australian Information Commissioner’s guidance is influential even where the Privacy Act does not directly apply to the employment relationship. A customer’s information remains customer information; hiding it inside a personal VPN does not turn employer monitoring into an unrestricted right.
Device hygiene provides another reason employers resist unapproved tunnels. A travel or removable-media checklist may tell staff to scan a USB drive before bringing it into the network, while approved VPNs carry particular configuration requirements. A VPN that bypasses those controls can increase the risk that malware or unauthorised data reaches an Australian office. The employer’s response should still match the evidence and the employee’s role rather than assume every VPN user is a threat.
A safer way to decide and document
Start with the purpose and the type of access: Is the connection needed for a work system, a regulated system or a personal task? Can IT provide an approved service with the same location or identity? Would a personal device and account remove the conflict, subject to workplace policy? These questions expose a legitimate business need without treating privacy as either a right to secrecy or a prohibited practice. The commercial reality of tracking and surveillance, discussed through the surveillance business model, is relevant because workplace monitoring can affect people outside the organisation as well.
| VPN choice | Likely employer view | Principal risk | Evidence that clarifies the position |
|---|---|---|---|
| Employer-approved remote-access VPN | Authorised security control | Misconfiguration or misuse of shared access | IT approval and the agreed connection scope |
| Consumer VPN with written approval | Acceptable only within the approved purpose | Scope may still exceed permission | Written approval naming service, device and task |
| Consumer VPN without permission | Potential breach of security or conduct rules | Software and traffic may breach policy | A documented request before installation |
| VPN used to bypass controls or hide personal activity | Evidence of concealment and possible misconduct | Loss of trust and possible data-security breach | An honest account of purpose and consent |
A defensible disciplinary process gives the employee a chance to respond. The employer should identify the rule relied upon, provide the relevant evidence, consider whether other employees received the same treatment, and separate a genuine safety rule from an improvised restriction. Serious misconduct may justify summary dismissal; an ordinary policy breach commonly calls for investigation and an opportunity to respond. Under Australian unfair-dismissal law, an eligible employee can seek free help from the Fair Work Ombudsman, and an application generally has a seven-day time limit, subject to exceptions and jurisdictional limits.
Remember that the technology is rarely what determines the outcome. A VPN can enable legitimate work, but installing it without permission, using it for personal activity or using it to evade monitoring can make an ordinary policy breach look like misconduct. What an employee should remember is that authorisation, transparency and proportionality are the real safeguards: protection matters only when it is obtained in a way an employer can recognise as responsible.