Recording business calls in Australia: what to tell callers

Recording business phone calls can be lawful in Australia, but only if you handle it properly. Federal law treats secretly recording a call as it passes over the phone network as interception, state and territory laws set their own consent rules, and the Privacy Act may apply to what you do with the recordings.

The practical answer for most businesses is the same everywhere: tell people the call is being recorded before the conversation starts, give them a way to say no, and look after the recordings. This guide explains why, in plain terms. It is general information, not legal advice, so get advice for your own situation if you are unsure.

Is it legal to record phone calls in Australia?

Yes, in many situations, provided the people on the call know it is being recorded. Three layers of law are relevant to a business:

1. Federal telecommunications law, which deals with calls as they travel over the phone network.
2. State and territory surveillance or listening devices laws, which deal with recording private conversations.
3. The Privacy Act 1988, which deals with how covered businesses collect, store and use personal information, including recordings.

How these laws interact for a particular recording can be technical, and calls often cross state lines. That is why most businesses take the simple route of telling everyone on the call and keeping records of how they do it.

What does the federal law say?

The Telecommunications (Interception and Access) Act 1979 prohibits intercepting communications passing over a telecommunications system, except in limited circumstances such as under a warrant. Section 6 defines interception as listening to or recording, by any means, a communication in its passage over that system without the knowledge of the person making the communication.

The key words are “without the knowledge”. If callers are told the call is being recorded, for example by a message at the start of the call, they have that knowledge. This is one reason the “calls may be recorded” message is so common in Australia.

How do state and territory laws differ?

Each state and territory has its own law on listening or surveillance devices. They generally cover recording a “private conversation”, and they differ on whether someone who is part of the conversation can record it without the other parties agreeing.

State or territory	Main law	Can a party to the conversation record it without everyone’s consent?
New South Wales	Surveillance Devices Act 2007	Generally no. All principal parties must consent, unless one party consents and the recording is reasonably necessary to protect their lawful interests, or is not made to share with people outside the conversation.
Victoria	Surveillance Devices Act 1999	Generally yes. The ban on recording applies to conversations you are not a party to. Separate rules restrict communicating or publishing records of private conversations.
Queensland	Invasion of Privacy Act 1971	Generally yes. The ban does not apply where the person using the device is a party to the conversation.
Western Australia	Surveillance Devices Act 1998	Generally no. Each principal party must consent, unless one party consents and the recording is reasonably necessary to protect their lawful interests.
South Australia	Surveillance Devices Act 2016	Generally no. All principal parties must consent, unless the recording is reasonably necessary to protect the lawful interests of the person recording.
Tasmania	Listening Devices Act 1991	Generally no. Similar to NSW: all principal parties must consent, with exceptions for protecting lawful interests or recordings not made to share with others.
Australian Capital Territory	Listening Devices Act 1992	Generally no. Similar to NSW and Tasmania, with exceptions for protecting lawful interests or recordings not made to share with others.
Northern Territory	Surveillance Devices Act 2007	Generally yes. The ban applies to conversations you are not a party to.

This is a simplified summary. Each law has further exceptions, definitions and penalties, and “lawful interests” has a narrow meaning in practice. Business call recording is usually routine and ongoing, and it is not the kind of recording these exceptions were written for. Relying on one of them is risky when a simple notice would get consent instead.

What does the Privacy Act require?

The Privacy Act and the Australian Privacy Principles (APPs) apply to many businesses, but not all. Small businesses under the turnover threshold are generally exempt, although some are covered regardless of size, including health service providers and businesses that trade in personal information. The OAIC’s small business guidance sets out who is covered.

If you are covered, a call recording or transcript that identifies someone is personal information. The main obligations to think about are:

• Collection notice (APP 5). Tell people about the collection at or before the time it happens, or as soon as practicable afterwards. The OAIC’s APP 5 guidelines suggest explaining the matters at the start of a phone call, or providing them soon after, for example by referring to your website.
• Security and retention (APP 11). Take reasonable steps to protect recordings from misuse and unauthorised access, and destroy or de-identify them once you no longer need them, unless the law requires you to keep them.
• Access (APP 12). People can ask for access to personal information you hold about them, which can include recordings of their calls. Organisations need to respond within a reasonable period.

Your privacy policy should also mention call recording and transcription, why you do it and how people can ask about it.

What should you tell callers?

A clear, consistent notice does most of the work. Good practice looks like this:

1. Add a recorded notice to your greeting. Something like “Calls may be recorded and transcribed for training and quality purposes” before callers reach a person, a queue or an AI receptionist.
2. Tell people on outbound calls. Your greeting does not play when you call out. Staff should say the call is recorded at the start, or you can choose not to record outbound calls.
3. Offer an opt-out. If a caller does not want to be recorded, have a way to stop recording or offer another way to deal with them, such as email.
4. Tell your staff. Employees are parties to the calls too. The OAIC notes that employers must follow any relevant laws on monitoring and recording telephone conversations, and some states have specific workplace surveillance laws. Put your recording policy in writing.
5. Limit who can access recordings. Give access only to the people who need it, use strong passwords and multi-factor authentication where available, and keep an eye on who downloads what.
6. Set a retention period. Decide how long you keep recordings and transcripts, and delete them after that unless there is a reason to keep a particular one.

Do AI transcription and call summaries count?

Treat them as recordings. A transcript or AI-generated summary captures what was said in the call, and if it identifies someone it is personal information in the same way as the audio. Your notice should cover transcription as well as recording, and the same access and retention rules should apply.

The same goes for an AI receptionist that listens to callers and transcribes what they say. Our guide to AI receptionists covers telling callers they are speaking with an AI.

How CloudLine helps

Call recording and call transcription are built into our Hosted PBX. Calls can be transcribed as they happen, with a short summary of key points and action items afterwards, and transcripts are searchable. When we set up your system, we can add a recording notice to your greeting so every inbound caller hears it before they reach your team.

Because CloudLine is part of an ISO 27001 certified IT company, we can also help you think through who in your business should have access to recordings and how that access is secured. If you are still weighing up a cloud phone system, our explainer on what a hosted PBX is is a good place to start.

Frequently asked questions

Do you have to tell callers that calls are recorded?

In practice, yes. Federal law treats recording a call without the knowledge of the person making it as interception, and several states generally require everyone’s consent. A notice at the start of the call is the simplest way to cover both.

Is “calls may be recorded for training and quality purposes” enough?

It is a good start and is widely used. If your business is covered by the Privacy Act, you may also need to tell people other matters, such as how to contact you and where to find your privacy policy. Your website and privacy policy can carry that detail.

Can you record calls on a mobile?

The same principles apply to mobile calls. Tell the other person you are recording, and check your state or territory’s law if you are unsure.

How long should you keep call recordings?

There is no single answer. Keep them only as long as you need them for a clear purpose, unless another law or industry rule requires longer, then delete them. If the Privacy Act covers you, it requires you to destroy or de-identify personal information you no longer need.

Does a transcript need the same care as a recording?

Yes. A transcript contains the same conversation in text form, so include it in your notice, access controls and retention period.

If you would like call recording and transcription set up with a clear notice on your greeting, see our Hosted PBX or call 1800 256 830. For advice on your specific obligations, speak with a lawyer.