Call Recording Laws in Australia: What Businesses Need to Know

Whether your business can record a phone call in Australia is decided first by state and territory law, and only second by what your phone system is capable of. There is no single national rule. Each state and territory has its own surveillance or listening devices Act, and the Acts differ on whether taking part in a call is enough to record it. This page does not tell you which side of that line you are on. It names the Act for each jurisdiction and links the official version, so you, or your solicitor, can read it.

This guide points you to the legislation for each jurisdiction, explains how federal telecommunications law and state surveillance law fit together, what a "this call may be recorded" announcement is meant to achieve, and the practical questions that decide whether your phone system can support a compliant setup. It is written for the 1 to 20 seat Australian business that just had call recording appear as a tick box in a VOIP portal and does not know what turning it on commits them to.

Why Call Recording Has a Legal Dimension

When a business records phone calls, the recording may be personal information where a person on the call is identified or reasonably identifiable, such as when it is linked to a customer file. That sits across two separate areas of law: telecommunications and surveillance law, which govern whether the act of recording is lawful at all, and privacy law, which governs how the resulting recording is stored, used, disclosed and eventually destroyed.

Those two questions are separate, though they can overlap: where the Privacy Act applies, a recording made unlawfully may also breach the requirement to collect personal information by lawful and fair means. A recording can be lawfully made and still be handled unlawfully. Where an employer or a hosted provider records calls automatically, who counts as the person using the recording device, and whether that person is a party to the call, is itself a question for legal advice.

The rules also do not care whether the call was a copper landline, a mobile, or a VOIP extension on a hosted phone system. Surveillance device legislation is written around the act of recording a private conversation, not around the technology carrying it. The NBN migration affected many copper landline services, but whether a business now uses VoIP depends on its provider, access technology and service; some business, Special Services, Fixed Wireless and satellite services were not disconnected by NBN.

The Two Layers of Law That Apply

Federal: the Telecommunications (Interception and Access) Act 1979

The federal Telecommunications (Interception and Access) Act 1979 (Cth) prohibits intercepting a communication passing over a telecommunications system. The operative words are "passing over". The prohibition turns on whether a communication is listened to or recorded in its passage over the telecommunications system without the knowledge of the person making it, rather than simply on whether the recorder is a third party.

The generally accepted position is that a participant recording a call at their own end of it is not intercepting it, because the communication has already arrived. That is why the practical question for an ordinary business is almost always the state or territory surveillance law, not the federal Act. It is not a licence to ignore the federal Act entirely, and it is worth raising with your solicitor if your setup does anything unusual with the call path.

State and territory: surveillance and listening device law

Every state and territory has its own Act governing the use of listening devices to record a private conversation. They were written at different times, they use different wording, and they land in materially different places. This is the layer that decides whether you may record at all, and it is the layer most "is call recording legal in Australia" answers get wrong by giving a single national answer.

Privacy law sits on top of both

Where a business is covered by it (see the small business exemption below), the Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how a recording is collected and what happens to it once it exists. The relevant principles in practice are notification of collection, use and disclosure limits, security of stored personal information, and destruction or de-identification once the information is no longer needed. If a recording captures health information, credit information or other sensitive categories, additional obligations apply.

Most small businesses (annual turnover of $3 million or less) still sit outside the Privacy Act under the small business exemption, with carve outs including health service providers and businesses that trade in personal information. Removing that exemption has been a live reform proposal rather than settled law, and separate reforms have already pulled additional categories of business into scope. Do not assume the exemption still covers you. Confirm your current position against OAIC guidance and with your solicitor rather than relying on what was true when you last checked.

State by State: Where to Read the Law

Each state and territory regulates the recording of private conversations through its own Act. The Acts differ on whether being a party to a conversation is enough, on what consent they require, and on their exceptions. This page deliberately does not summarise where each one lands: a one line summary of a statute is exactly what a business ends up relying on, and it is the thing most likely to be wrong for your facts.

The Act for each state and territory, at its official register:

• Australian Capital Territory: Listening Devices Act 1992 (ACT)
• New South Wales: Surveillance Devices Act 2007 (NSW)
• Northern Territory: Surveillance Devices Act 2007 (NT)
• Queensland: Invasion of Privacy Act 1971 (Qld)
• South Australia: Surveillance Devices Act 2016 (SA)
• Tasmania: Listening Devices Act 1991 (Tas)
• Victoria: Surveillance Devices Act 1999 (Vic)
• Western Australia: Surveillance Devices Act 1998 (WA)

What to read for, or ask your solicitor about:

• Whether the Act's prohibition applies to a person who is a party to the call.
• What consent the Act requires, and from whom.
• Which exceptions the Act contains, and whether any of them fits the way your business actually records.
• What the Act says about using, communicating or publishing a recording once it exists, which is usually a separate provision from making it.

Each Act has its own definitions and its own list of exceptions. Read the provisions that apply to you, or have your solicitor read them, before you build a process on top of anyone's one line summary, including a provider's.

Statutory exceptions are a question for your solicitor

Several of the Acts contain exceptions, such as recording that is reasonably necessary to protect a party's lawful interests. Whether any exception covers a particular recording practice turns on the facts, and that assessment belongs with a solicitor rather than with a general guide or a provider's sales page.

One distinction is worth taking into that conversation. Recording every inbound call by default so the team can review them later for training is a general business practice, not a decision about any particular conversation. Ask your solicitor directly whether a blanket recording policy is covered in the jurisdictions you take calls from, or whether you need callers' consent, and design the setup around the answer.

The Cross Border Problem Nobody Warns You About

Here is the practical difficulty that makes any state by state summary less useful than it looks. Your business might be in Melbourne. Your caller might be in Perth. Your hosted phone system might be running in a Sydney data centre, and the staff member answering could be working from home in Queensland that day. Which state's law governs the recording is a genuinely contested question, and it is not one a general guide can resolve.

A 1300 or 1800 number makes this worse rather than better, because the whole point of an inbound service number is that it is national. If you advertise a 1300 number, you have effectively invited calls from every jurisdiction in the country, including any whose Act takes a stricter view than your own.

One approach is to stop trying to pick a jurisdiction and instead announce the recording on every call, give the caller a genuine opportunity to object, and document the process. Announcing costs nothing where it was not required, and it avoids an argument about which Act governed a call that crossed a state border. Whether that is enough for your situation is a question for your solicitor.

What "For Quality and Training Purposes" Actually Has to Do

The recorded announcement everyone has heard is not a magic formula. It is a mechanism for obtaining consent, and it only works if it actually obtains consent. The reasoning is that a caller who is clearly told at the start that the call will be recorded, and who then chooses to continue the call, has impliedly consented. That reasoning collapses if any of the conditions behind it are missing.

For an announcement to do the job it is supposed to do, it needs to satisfy a few things in practice:

• It plays before recording starts, not after. If your platform starts the recording at call answer and plays the message a few seconds later, the first seconds were recorded without consent. Check what your provider actually does rather than assuming.
• It is clear that recording is happening. "Your call is important to us" is not a recording notice. "This call is being recorded" is.
• The caller has a real opportunity to decline. Consent implied from continuing the call only holds up if hanging up was a genuine option and the caller understood it. If the only way to reach your business is through a recorded line, be prepared to explain how a caller who objects is meant to deal with you.
• It covers outbound calls too. Outbound-call recording and notification depend on platform configuration and should be checked separately from inbound settings.
• It says something about why, if you are relying on it for privacy notification. Privacy notification and surveillance consent are different obligations. An announcement can help with both, but a bare "this call is recorded" does not tell anyone what you will do with it.

Whether continuing a call after an announcement amounts to consent for the purposes of a specific state's Act is exactly the kind of question that needs a lawyer rather than a guide. What an announcement plus a documented process does give you is evidence that callers were told, which silence does not.

Recording Your Own Staff Is a Separate Question

If you are recording calls to review staff performance, you are doing two things at once: recording the customer, and monitoring the employee. The second one has its own obligations that are easy to miss because the phone system treats both as one feature.

Some jurisdictions have dedicated workplace surveillance legislation with notice requirements that sit on top of the general surveillance device law, and employment law considerations apply regardless. In practice the reasonable baseline is that staff should know in writing that calls are recorded, know who can listen to them, know what the recordings will and will not be used for, and know how long they are kept. Putting that in a short written policy that everyone acknowledges is cheap, and it is the first document anyone will ask for if a recording is ever used in a performance or disciplinary process.

The specific workplace surveillance obligations vary by state and are worth confirming for your jurisdiction rather than assuming the general recording rules cover it.

Where the Recordings Live: the Part Your Phone System Decides

This is the part that is genuinely a phone system question rather than a legal one, and it is the part most businesses never look at. On a hosted VOIP service the recordings are not on a machine in your office. They are on the provider's platform, or in cloud storage connected to it, under default settings until you change them.

Default retention and automatic-deletion behaviour vary by provider, plan and configuration; confirm the setting that applies to your service. That default is a problem in both directions. It may be far shorter than an industry record keeping obligation that requires you to retain call evidence for years, and it may be far longer than is defensible for the ordinary sales enquiries you had no reason to keep at all. Neither of those is the provider's decision to make for you, but it becomes their default if you never touch it.

The other questions worth settling before you enable the feature:

• Which country the recordings are stored in. Offshore storage is not unlawful in itself. Whether it is a cross-border disclosure under APP 8, and what an APP privacy policy must say, depends on the contractual arrangement, effective control and whether personal information is likely to be disclosed to an overseas recipient.
• Who can play them back. Administrative access varies by platform and role configuration; verify who can play, download or delete recordings. If your bookkeeper and your junior receptionist both have admin logins, both may be able to listen to every recorded customer call.
• Whether individual recordings can be deleted on request. Confirm whether recordings can be exported and deleted. An APP entity may have to provide access to personal information in a recording, subject to exceptions, but the Privacy Act does not create a general right to erasure or an unconditional right to receive the entire original audio file.
• Whether calls that capture card details are excluded. Taking payment over a recorded line can capture the card security code, which PCI DSS does not allow to be stored after authorisation, even in an audio file. Ask whether the platform supports pausing the recording.
• What happens if the recordings are breached. A set of customer call recordings is personal information. If it is exposed, the Notifiable Data Breaches scheme may apply to you.

Five Mistakes Australian Businesses Make With Call Recording

• Assuming there is one Australian rule. Depending on where your callers, staff and recording systems are, the federal interception law and one or more of eight different state and territory surveillance statutes can apply, with privacy and sometimes workplace rules potentially adding further obligations. Any answer that starts "in Australia, you can record if..." is summarising a patchwork of state Acts as if it were one rule.
• Turning it on because it was included. Call-recording availability and pricing vary by provider and plan. Free to enable is not the same as free to run. If you cannot say who reviews the recordings and why, you are carrying the obligations without getting the benefit.
• Announcing on inbound only. Depending on configuration, outbound calls may also be recorded and may require separate notification settings.
• Treating "quality and training" as a licence. A blanket recording policy for general business improvement is a business preference, not a legal basis. Ask your solicitor what basis your recording rests on in each jurisdiction you take calls from.
• Never setting a retention period. The provider default becomes your policy by inaction. Years later there is an archive of customer conversations nobody has reviewed, nobody has secured, and nobody can justify keeping.

A Practical Call Recording Checklist

Work through this before you enable the feature, not after the first complaint:

1. Write down why you want recordings and what you will actually do with them. If there is no clear answer, do not enable it.
2. Identify your state or territory, and accept that your callers will not all be in it.
3. Confirm with a solicitor how the applicable Act, and any cross border exposure, applies to your specific setup.
4. Configure a clear recording announcement on inbound calls, and confirm it plays before the recording starts.
5. Decide and configure how outbound calls are handled.
6. Set an explicit retention period rather than accepting the provider default, and align it with any industry record keeping obligation you have.
7. Restrict playback access to named roles, and remove access when people change roles or leave.
8. Confirm where recordings are stored, including which country, and update your privacy policy to match.
9. Put a short written policy in front of staff covering what is recorded, who can listen, and how it will be used.
10. Establish how you will respond to a request for a copy of a recording, and to a request to delete one.
11. Confirm you can pause recording if card details are ever taken over the phone.
12. Diarise a review. Legislation, your provider's platform, and your own obligations all change.

Who to Contact for Legal Advice on Call Recording

For advice on your specific business situation, a solicitor with experience in privacy or telecommunications law is the right starting point. They can tell you what applies to your business based on your state, industry and customer base. Law societies in each state and territory maintain referral services if you need help finding one:

• Law Society of NSW
• Law Institute of Victoria
• Queensland Law Society
• Law Society of WA
• Law Society of SA
• Law Society of Tasmania
• ACT Law Society
• Law Society NT

For Privacy Act and Australian Privacy Principles questions, the Office of the Australian Information Commissioner (OAIC) is the federal regulator for privacy law. Their website includes plain-English guidance on how the Privacy Act applies to businesses, including the handling of personal information in call recordings.

• OAIC website
• OAIC: Australian Privacy Principles guidance

Where to Find the Official Legislation

If you or your solicitor want to review the relevant laws directly, the official sources are listed below. All links go to the official government legislation databases. Laws can be amended, and Queensland's framework in particular has been the subject of law reform review, so confirm with a solicitor that you are reading the version currently in force.

Federal:

• Telecommunications (Interception and Access) Act 1979 (Cth) - Federal Register of Legislation
• Privacy Act 1988 (Cth) - Federal Register of Legislation

State and territory surveillance and listening device legislation:

• Surveillance Devices Act 2007 (NSW)
• Surveillance Devices Act 1999 (Vic)
• Invasion of Privacy Act 1971 (Qld)
• Surveillance Devices Act 1998 (WA)
• Surveillance Devices Act 2016 (SA)
• Listening Devices Act 1991 (Tas)
• Listening Devices Act 1992 (ACT)
• Surveillance Devices Act 2007 (NT)

What to Ask Your Phone Provider

Once you have clarity on the legal side, these are the practical questions to ask any business phone provider before activating call recording:

• Is call recording on by default, or does it need to be enabled?
• Does the recording announcement play before recording begins, and can it be customised?
• Are outbound calls recorded, and can they be announced separately?
• Where are recordings stored, and in which country?
• How long does the provider retain recordings, and can you set your own retention period?
• Can access to recordings be restricted to specific staff or roles?
• Can recording be paused mid-call, for example while card details are taken?
• Can recordings be exported or deleted on request?

A reputable provider will have clear answers to all of these. If they cannot tell you where recordings are stored or how to delete them, that is worth factoring into your decision.

Getting the Phone System Side Right

Once the legal question is answered for your business, choosing a phone system where call recording is a properly configurable feature, with announcement control, retention settings, role based access and the ability to pause mid-call, is the part we can help with.

• Get a personalised recommendation
• Compare business phone providers
• What does a business phone system cost?
• Guide to the best small business phone system in Australia
• VoIP vs traditional phone comparison