Skip to main content
zatersio

Avoid $75,000 Fines: Complying With Call Recording Laws in Australia

Avoid $75,000 Fines: Complying With Call Recording Laws in Australia

Decorative call recording law title card

Recording a phone call or conversation without telling the other person is illegal in New South Wales, the ACT, South Australia, and Western Australia unless an exception applies, and legal but restricted in Queensland, Victoria, Tasmania, and the Northern Territory. Because those rules split roughly down the middle, the safest move for any business is to assume all-party consent everywhere: play a clear notice at the start of every call, give people a real way to opt out, and keep a record of that consent. If you’re unsure which rule applies to a specific call, pause and get advice tailored to your situation before you hit record.

TL;DR:

  • Recording conversations in New South Wales, the ACT, South Australia, and Western Australia requires all-party consent, meaning every participant must agree beforehand.
  • In Queensland, Victoria, Tasmania, and the Northern Territory, you can legally record your own conversations without informing others, but sharing or publishing the recordings may still breach the law.
  • Penalties for unlawful recording can reach up to $75,000 for corporations in South Australia, and courts scrutinize covert workplace recordings, favoring open, consented ones.
  • To ensure compliance, businesses should implement clear, immediate consent notices with real opt-outs, log consent events, and automate retention and access restrictions across systems.
  • Using engineering controls like encrypted, Australian-resident storage and automated data management supports responsible compliance and reduces legal risks.
Zatersio
Build Compliance Into Your Systems
Zatersio combines bespoke engineering and AI-driven automation to support consent, data handling, and efficient administrative workflows.
Explore Zatersio

Table of Contents

Australia doesn’t have one national answer to “can I record this?” Each state and territory runs its own surveillance or listening devices legislation, and the split between them is the single most important fact in this whole topic.

All-party consent states require every person on the call to agree before you record:

  • New South Wales — Surveillance Devices Act 2007
  • Australian Capital Territory — Listening Devices Act 1992
  • South Australia — Surveillance Devices Act 2016
  • Western Australia — Surveillance Devices Act 1998

One-party consent states let you record a conversation you’re part of, even without telling the other side, though publishing or sharing that recording is a separate matter:

  • Queensland — Invasion of Privacy Act 1971
  • Victoria — Surveillance Devices Act 1999
  • Tasmania — Listening Devices Act 1991
  • Northern Territory — Surveillance Devices Act 2007

State and territory surveillance laws genuinely diverge on this point, and Sprintlaw’s summary of the all-party versus one-party split is worth bookmarking if you operate across borders. Queensland’s own Legal Aid guidance confirms that recording a conversation you’re part of isn’t illegal there, but warns that communicating or publishing it can still breach the law.

Penalties are not trivial. South Australia’s Surveillance Devices Act 2016 sets a maximum corporate penalty of $75,000 for unlawfully using a listening device to record a private conversation, with individuals facing separate fines and possible imprisonment. Most states carry comparable exposure. Personal-use exceptions exist in some jurisdictions, but they’re narrow, and courts and tribunals still exercise discretion over whether a recording made “for personal reference” is actually admissible.

Voice Recording Consent Australia: State-by-State Rules — overview diagram

Courts and regulators recognize two paths to lawful consent, and understanding the difference changes how you script your calls.

  1. Express consent is unambiguous agreement, spoken or via a clear action like pressing a button. Someone says “yes, that’s fine” or presses 1 to continue, and that moment is your consent record.
  2. Implied consent happens when a person is told plainly that the call is being recorded, given a genuine chance to object or leave, and chooses to continue anyway. Silence after a clear notice, paired with a real opt-out, is generally treated as implied agreement.

What doesn’t count: a line buried in your website’s terms and conditions, or a privacy policy nobody reads before dialing your number. Consent has to be contemporaneous with the interaction itself, not a policy sitting on a webpage three clicks away. A simple “we record calls for quality purposes” statement on your homepage does not establish consent under Australian law unless it’s repeated at the point the call starts.

A workable opening notice sounds like this: “This call may be recorded for training purposes. If you’d prefer not to be recorded, press 2 or let us know now.” That sentence serves to provide notice and an option to opt out.

Pro Tip: If your business takes calls from customers anywhere in Australia, don’t try to run a state-by-state script. Default to the strictest standard, NSW and SA’s all-party rule, and apply it nationally. One consistent notice-and-opt-out flow is far easier to audit than four different scripts tied to caller location.

Recording at Work: Employees, Covert Recordings, and Evidence

Workplace recordings sit at the intersection of state surveillance law and Fair Work Commission practice, and the two don’t always point in the same direction.

An employee who secretly records a disciplinary meeting is still bound by their state’s surveillance law. In NSW, SA, WA, or the ACT, recording that meeting without telling anyone is likely unlawful, even if the recording later helps their case. In Victoria, Queensland, Tasmania, or the NT, a one-party recording is more likely to be lawful, but that doesn’t guarantee it gets accepted as evidence.

  • Fair Work Commission members hold discretion over admissibility and can exclude covert recordings even where the recording itself broke no law, particularly if it damages trust in the workplace relationship.
  • Recordings made openly, with the employer’s knowledge, carry far less risk and are far more likely to be accepted in a hearing.
  • Publishing or forwarding a recording, even a lawfully made one, can trigger separate offences under privacy and defamation law. Recording law is fairly consistent on this: one-party permission to record doesn’t equal permission to distribute.
  • Employers should have a written recording policy that covers meetings, calls, and CCTV audio, so nobody is caught relying on an implied right that doesn’t exist.

Building a Compliant Call Recording Process

Getting this right isn’t complicated, but it needs to be deliberate. A defensible process looks like this:

  1. Script the opening notice. State that the call may be recorded and why (training, quality, dispute resolution), then offer the opt-out in the same breath.
  2. Build a real opt-out flow. A caller who says “please don’t record this” needs an actual alternative, whether that’s a live transfer to an unrecorded line or simply switching the recorder off mid-call.
  3. Log the consent event. Timestamp the notice, the caller’s response (or lack of one), and which line handled the call. This becomes your evidence if the recording is ever challenged.
  4. Set retention limits. Decide how long recordings are kept and delete them on schedule rather than indefinitely.
  5. Encrypt and restrict access. Recordings often contain names, account details, and sometimes health or financial information, all personal information under the Privacy Act.
  6. Prepare for data breach response. The OAIC’s Notifiable Data Breaches scheme requires certain breaches involving personal information to be reported, and a leaked archive of call recordings qualifies.
  7. Train staff on escalation. Anyone taking calls needs to know what to do when a caller objects, asks about the recording policy, or calls from a jurisdiction with stricter rules.
  8. Map your data flows. A basic privacy impact assessment, tracking where recordings are stored, who can access them, and where they’re backed up, catches gaps before a regulator does.

Businesses that treat recording as a compliance function rather than a backend feature tend to avoid the costly surprises. A 2016 SA penalty structure that caps corporate fines at $75,000 is a meaningful number to weigh against the cost of building a proper consent flow upfront.

The Fastest Checklist for Turning on Call Recording

If you’re switching on a recording line or deploying a voice agent this week, work through this in order:

  1. Add a spoken notice at the start of every recorded interaction, no exceptions.
  2. Give callers a simple, working opt-out, not a buried instruction.
  3. Offer a non-recorded alternative channel for anyone who declines.
  4. Encrypt stored recordings and restrict access to people who need it for their role.
  5. Set a retention period and automate deletion once it expires.
  6. Keep a consent log and a written privacy impact assessment on hand for audits.

Data Residency and Engineering Controls That Back Up the Law

Policies only matter if the systems behind them enforce the rules automatically. Implementing engineering controls can help ensure compliance.

  • Store voice recordings with Australian data residency where possible, and document any cross-border data flow.
  • Apply encryption at rest and in transit, role-based access controls, and audit logs to track access to recordings.
  • Automate retention enforcement to delete files on schedule.
  • Design AI voice agent consent flows with a pre-recorded notice, a press-key opt-out, and an automatic audit trail.

Pro Tip: Engineering controls such as automated retention enforcement and encrypted, access-logged storage support responsible data handling, in line with OAIC guidance.

What Counts as a Private Conversation vs a Listening Device

The legal definitions matter more than most people assume. A “private conversation” is generally one where at least one party has a reasonable expectation it won’t be overheard by outsiders, whether that’s a phone call, a face-to-face meeting behind closed doors, or a video call. Conversations shouted across a public street, or spoken in a crowded café at normal volume, usually don’t qualify. Context and location shape the legal answer, not just the words themselves.

A “listening device” is defined broadly across most state Acts. It covers any device capable of recording or listening to a private conversation, which includes obvious tools like dictaphones and hidden microphones, but also smartphones, laptops with built-in microphones, and smart speakers running in the background. You don’t need specialized surveillance equipment to trigger these laws. A phone left recording on a table during a meeting is a listening device under the same rules that govern a covert bug.

The overlap between “private conversation” and “listening device” is where most accidental breaches happen. Someone records a call thinking it’s casual, or leaves a voice memo app running during what they assumed was an informal chat, without realizing the law treats it the same as a deliberate covert recording. If there’s any doubt about whether a conversation is private, the safer assumption is that it is, and the safer action is to ask before recording.

Recording Phone and VoIP Calls: What’s Different Technically

Traditional phone laws generally apply the same way to VoIP calls, video conferencing platforms, and mobile apps. The medium doesn’t change the legal test. What changes is how consent gets captured and where the data ends up.

VoIP platforms often record calls server-side by default, sometimes without a clear on-screen indicator that recording is active. That default setting can create a compliance gap if your business hasn’t explicitly configured a notice-and-opt-out flow before the platform starts capturing audio. Check your provider’s settings rather than assuming recording only happens when you press a visible “record” button.

Cloud-based storage adds a data residency question that traditional phone lines never raised. Many VoIP and call center platforms route or store data through servers outside Australia, which means a recording captured lawfully under state surveillance law can still create a Privacy Act exposure if it’s held or processed overseas without proper safeguards. Businesses using international platforms should confirm where recordings are stored and whether the vendor can offer Australian data residency, or at minimum, clear documentation of cross-border flows.

Mobile call recording apps carry the same state-law obligations as a landline, but they add a practical wrinkle: recording quality and reliability vary widely, and a recording made without proper consent doesn’t become more defensible just because the technology is convenient. The legal test stays the same whether the call travels over copper wire or fiber.

Recording Phone and VoIP Calls: What's Different Technically — overview diagram

Using Recordings as Evidence in Court

Beyond workplace disputes, recordings surface constantly in criminal matters, family law, neighbor disputes, and commercial litigation. A recording made unlawfully doesn’t automatically vanish from a case, but it faces a much steeper path to being accepted.

Courts weigh several factors when deciding whether to admit a recording obtained in breach of surveillance law: how serious the breach was, whether the recording is central to proving the case, and whether admitting it would be unfair to the other party. Judges hold real discretion here, and outcomes vary by case rather than following a fixed formula. A recording made lawfully under a one-party consent rule tends to face far less scrutiny than one made in breach of an all-party jurisdiction’s law.

Chain of custody matters too. A recording that’s been edited, partially deleted, or can’t be verified as unaltered is vulnerable to challenge regardless of how it was obtained. Courts generally want the original file, metadata intact, and a credible account of who made it and how it’s been stored since.

Civil cases, contract disputes, tenancy disagreements, consumer complaints, tend to give recordings more practical weight because the stakes and formality are lower than criminal proceedings. Even so, a recording obtained by breaching someone’s state’s surveillance law can still be excluded, and the person who made it can face their own separate liability regardless of whether the recording ultimately helped their case.

Recording in Public Spaces vs Private Spaces

Location changes the analysis significantly, and it’s one of the most misunderstood parts of this topic. Recording audio or video in a public space, a street, a shopping center, a public transport platform, generally carries far fewer restrictions than recording inside a private space, because the expectation of privacy is lower in public.

That said, “public” doesn’t mean “anything goes.” Filming or recording someone in a way that harasses them, or capturing audio specifically to invade someone’s private affairs even in a public setting, can still breach state laws around surveillance, stalking, or harassment. The physical location of the recorder doesn’t matter as much as whether the conversation itself was private in nature. Two people having a hushed, deliberate conversation in the corner of a public café may still have a reasonable expectation of privacy, even though they’re technically in a public space.

Private spaces, homes, offices, private meeting rooms, carry the strongest protections. Recording inside someone’s home or a closed-door business meeting without required consent is treated seriously across every state, regardless of whether the conversation touches on sensitive topics. Businesses that record customers on their own premises, retail stores, clinics, workshops, should apply the same all-party notice standard used for phone calls, since audio recording in a private consultation room raises identical legal questions to a recorded phone call.

Federal Law vs State Law: Which One Actually Governs

This is where a lot of confusion sets in, because Australia runs two separate legal layers on this topic and they don’t overlap the way most people assume.

The Telecommunications (Interception and Access) Act 1979 (Cth) is a federal law, but it’s aimed at a narrower problem: intercepting communications between parties who are not the person doing the intercepting, think wiretapping by a third party or law enforcement accessing a call without either participant’s knowledge. It generally doesn’t govern a participant recording their own conversation. That job falls to state and territory surveillance or listening devices legislation, which is why the all-party versus one-party split described earlier does the real work in day-to-day business situations.

There’s no direct conflict between the two frameworks in most everyday cases, because they’re regulating different conduct. The federal Act is about interception by outsiders; state laws are about whether someone inside the conversation can record it. Where things get genuinely complex is interstate calls, where a business in Queensland (one-party) is speaking with a customer in NSW (all-party). In that scenario, the safer legal position is to comply with the stricter jurisdiction, since a court in the customer’s home state could apply that state’s law to the dispute. National call centers should log caller location where practical and default to the toughest standard rather than gambling on which state’s law a regulator or court will apply.

Quality Assurance, Training, and Customer Feedback Recordings

“This call may be recorded for quality and training purposes” is one of the most repeated lines in Australian business, and it’s also one of the most frequently misapplied. Recording for quality assurance, staff training, or customer feedback still triggers the exact same consent obligations as any other recording. There’s no special carve-out in state surveillance law for internal business purposes.

The notice has to be genuine and contemporaneous, delivered before or at the very start of the interaction, not folded into a policy document the customer never reads. And the opt-out has to be real. If a customer says “please don’t record this call,” the business needs an actual mechanism to honor that, whether it’s disabling the recorder for that call or transferring to an unrecorded line, rather than recording anyway and hoping nobody asks.

Once a QA or training recording exists, the Privacy Act obligations kick in regardless of the original purpose. That recording likely contains a customer’s name, account details, and sometimes financial or health information, which means it needs the same encryption, access restriction, and retention limits as any other recording holding personal information. A common mistake is treating QA recordings as lower risk because they’re “just for internal training,” then storing them indefinitely with broad staff access, which is precisely the kind of practice the OAIC’s data breach expectations are designed to catch.

Why I’d Rather See Businesses Over-Comply Than Guess

The instinct to treat consent as a formality, a line in a script nobody really listens to, is where most businesses get into trouble. I’d argue the conventional advice to “check your state’s rule and record accordingly” undersells how messy that gets the moment a business takes calls from more than one state, which is nearly every business with a phone number.

Standardizing on all-party notice and opt-out isn’t overcautious. It’s the only approach that scales cleanly across a national customer base without someone in your call center trying to remember which four states need extra care. Where a one-party recording genuinely serves a narrow, documented purpose, personal note-taking, a specific internal audit, it can still make sense, but only with clear limits on who sees it and what it’s used for.

Legal advice tells you what the rule is. Engineering controls, automated retention, encrypted storage, logged opt-outs, are what make that rule actually hold up when someone challenges it eighteen months later. Businesses that treat these as one problem tend to solve it properly. Businesses that treat them as separate, legal on one side, technical on the other, are usually the ones explaining themselves to the OAIC.

— Lakitha

Build Compliant Recording Into Your Systems From Day One

Retrofitting consent flows onto an existing phone system is harder than building them in from the start, and that’s exactly the kind of problem Zatersio was built to solve fast. Instead of spending months on a compliance overhaul, Zatersio delivers working software, including AI voice agents with built-in notice-and-opt-out logic, encrypted storage, and Australian data residency, in under two weeks.

Zatersio

A typical engagement starts small: a privacy impact assessment to map where your call data currently lives, a consent flow design that matches your actual call volume and customer mix, and a pilot build you can test before committing to a full rollout. Zatersio’s AI voice agents are built with press-key opt-outs and audit trails from the ground up, not bolted on afterward, and every build runs on fixed pricing so there’s no scope creep once the project starts. If eligible, the work can also qualify for the R&D Tax Incentive, offsetting part of the build cost.

If you’re planning to switch on call recording, deploy a voice agent, or automate customer feedback capture, start with a conversation about your MVP development options and get a working, compliant pilot in front of your team within weeks rather than quarters.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Sources

FAQ

Can I sue someone for recording me without permission in Australia?

Yes, if the recording breached your state’s surveillance or listening devices law, you may have grounds for a civil claim or a complaint to police, depending on the jurisdiction and how the recording was used.

Do I have to tell someone I’m recording them?

In NSW, the ACT, SA, and WA, yes, you generally need their consent first; in QLD, VIC, TAS, and NT, you can usually record a conversation you’re part of without telling the other person, though sharing that recording is a separate issue.

Generally yes. South Australia’s Surveillance Devices Act 2016 requires all-party consent for recording private conversations and activities, with corporate penalties up to $75,000 for breaches.

Are you allowed to record a phone conversation in Australia?

It depends on your state. NSW, the ACT, SA, and WA require every participant’s consent, while QLD, VIC, TAS, and NT generally allow you to record a call you’re part of without telling the other person, subject to restrictions on sharing that recording.