Home / Guides / Call recording laws in Australia
Compliance · 9 min read
Do you have to tell someone you are recording the call?
Australia does not have one call recording law. It has a federal interception Act, a privacy Act, and eight separate state and territory surveillance laws that disagree with each other. Here is what they actually say, and the practical position most businesses end up taking.
The short version
If your business records customer calls, three separate bodies of law apply at once, and they answer different questions:
- Federal interception law asks whether the recording happened without anyone on the call knowing.
- State surveillance law asks whether a party to a private conversation may record it, and the states genuinely disagree.
- Privacy law asks whether you told the person what you were collecting and why.
Because the state rules conflict, and because most businesses take calls from more than one state, the workable answer for almost everyone is the same: tell the customer the call is recorded, at the start, every time. A notification satisfies the strictest state, satisfies the Privacy Act, and costs one sentence.
This is general information, not legal advice. Surveillance and privacy law changes, the exceptions are fact-specific, and the consequences of getting it wrong are not trivial. Confirm your own position with a qualified adviser before relying on any of it.
The federal layer: interception
The Telecommunications (Interception and Access) Act 1979 (Cth) prohibits intercepting a communication passing over a telecommunications system without the knowledge of the person making the communication.
The phrase that matters is without the knowledge of. That is the whole hinge. A recording the caller knows about is not an interception in the sense the Act is aimed at. This is precisely why the announcement exists: it converts a recording into one the customer knows about.
The state layer, where it gets messy
Every state and territory has its own surveillance devices or listening devices law, and they split into two camps on the question that matters most to a business: may a party to the conversation record it without asking the other party?
| State / territory | Governing Act | Can a party record without consent? |
|---|---|---|
| Queensland | Invasion of Privacy Act 1971 | Generally yes, a party may record |
| Victoria | Surveillance Devices Act 1999 | Generally yes, a party may record |
| Northern Territory | Surveillance Devices Act 2007 | Generally yes, a party may record |
| ACT | Listening Devices Act 1992 | Generally yes, a party may record |
| New South Wales | Surveillance Devices Act 2007 | Generally no, consent expected, with limited exceptions |
| Western Australia | Surveillance Devices Act 1998 | Generally no, consent expected |
| South Australia | Surveillance Devices Act 2016 | Generally no, consent expected, with limited exceptions |
| Tasmania | Listening Devices Act 1991 | Generally no, consent expected |
Read that table as a map of the problem rather than a compliance checklist. The exceptions in the stricter states, particularly around protecting a person's lawful interests, are real but they are argued after the fact, and a business does not want its recording policy to depend on winning that argument.
The practical consequence: a national inbound line is governed by the caller's state, not yours. A Queensland business taking a call from Perth cannot assume the Queensland position applies.
The privacy layer
A call recording that identifies a person is personal information. Under the Privacy Act 1988 (Cth), Australian Privacy Principle 5 requires that you notify the individual, at or before the time of collection, of matters including who is collecting it, why, and who it may be disclosed to.
Not every small business is covered - the Act generally applies to organisations with turnover above three million dollars, plus certain others such as health service providers regardless of size. Health providers are worth calling out, because a small medical or allied health practice is usually covered even though a similarly sized retailer is not.
Where it applies, the practical requirement is the same one the surveillance laws push you toward: say what you are doing, before you do it.
What a compliant notification actually sounds like
It does not need to be long, and it does not need to be a legal recital. It needs to be audible, at the start, and honest about the purpose:
"Just to let you know, this call is recorded for quality and training purposes."
Three things make it work. It happens before the conversation starts rather than buried at the end. It states a purpose, which is what APP 5 is really asking for. And it is consistent - a notice that plays on some calls and not others is harder to defend than one that always plays.
If your recordings are also reviewed by an automated system, saying "quality and training" already covers it. Review by software is still review.
Inbound is easy, outbound is the gap
On inbound calls the announcement is trivial: it goes in the greeting or the IVR, before the call reaches a person. Most phone systems do this out of the box, and most businesses that record have it in place.
Outbound is where the gap usually sits. Many business phone systems, including 3CX, have no native way to play a message to the person you are calling at the moment they answer. That leaves three realistic options:
- The person says it. A scripted line in the opening. Free, works today, and legally the notification is what counts, not who delivers it.
- The carrier plays it. Some SIP providers can play an on-answer announcement at trunk level. Worth one email to yours.
- A custom call flow. Technically possible on most platforms, but it changes how every person on the team dials, which is a high price.
Most businesses land on the first one. It is worth auditing, though: if your inbound greeting announces recording and your outbound calls do not, you have a gap you probably did not know about.
How long should you keep recordings?
There is no single retention period in Australian law for ordinary business call recordings. What there is instead is a set of competing pressures:
- Keep long enough to resolve the disputes recordings exist to resolve. If a customer complains six weeks later and the call is gone, the recording did you no good.
- Do not keep indefinitely. APP 11.2 requires destroying or de-identifying personal information you no longer need. "We kept everything forever" is not a privacy position.
- Sector rules may override both. Financial services, credit and telco have their own record-keeping obligations that can be considerably longer.
In practice a defined period, applied automatically, with a documented reason for the number, is a far stronger position than an unbounded archive nobody has looked at. The number matters less than being able to say why you chose it.
Where automated review fits
Reviewing recordings with software does not change your recording obligations. The recording already happened; the review is what you do with it afterwards. If you were compliant before, adding review does not make you less so.
Two things are worth getting right anyway. First, where the audio and the transcript go. A review tool that ships call content offshore, or into a general-purpose AI service that may retain it, is a disclosure you now have to account for. WiseSentry stores and processes call content in Australia and never sends it to OpenAI, Google or Anthropic - see data and security for how that works.
Second, what gets redacted. Card numbers, dates of birth and licence numbers have no business sitting in a transcript that lands in a manager's inbox. If your review tool cannot remove them, that is a gap you are creating.
Common questions
Do I have to tell someone an outbound call is recorded in Australia?
It depends on the state the other person is in, and the states disagree. Queensland, Victoria, the Northern Territory and the ACT generally permit a party to a conversation to record it. New South Wales, Western Australia, South Australia and Tasmania generally expect consent. Because a business usually cannot control which state it is calling, notifying on every call is the practical position.
Is a beep tone enough notification?
A periodic tone tells the other person something is happening but does not tell them what is being collected or why, which is what Australian Privacy Principle 5 asks for. A short spoken statement of purpose is a stronger position and costs no more.
Does an AI reviewing my call recordings change my obligations?
Not your recording obligations - the recording already occurred. It does raise where the content is stored and processed, and whether sensitive details are removed before a transcript is emailed. Those are worth confirming with any review tool.
How long can we keep call recordings?
There is no single statutory period for ordinary business calls. APP 11.2 requires destroying or de-identifying personal information once it is no longer needed, while some sectors have specific longer obligations. A defined, automatically applied period with a documented rationale is a stronger position than keeping everything.
See what a full review of your calls turns up
WiseSentry reads every recorded call and raises only the ones where your business let the customer down. Talk to us about a review of your own call history.