Call Recording and Consent in NSW: What to Sort Out Before You Automate Your Phones
The short answer
We cannot tell you whether your call recording setup is compliant, and neither can any vendor who sells you one. What this post does is describe an AI phone system precisely enough that a lawyer can answer the question in an afternoon: what it captures, where the audio goes, who can play it back, and how long it is kept.
It is the question that comes up right after "does it actually sound human". Someone works out that an AI receptionist has to hear the call to answer it, and asks the obvious next thing: are we allowed to record these, and do we have to tell people?
It deserves a straight answer rather than a shrug or, worse, a confident one from a vendor with an interest in the answer being yes.
Before anything else: we are not your lawyers
Nothing on this page is legal advice. We build phone systems. We are not qualified to tell you what your obligations are, and any vendor who tells you your setup is compliant is telling you something they are not in a position to know.
So why publish anything at all? Because you cannot get useful advice on a system nobody has described to you. A lawyer can answer "are we allowed to do this" in an afternoon if you can tell them exactly what the system does, what it captures, where it goes and who can hear it. Most businesses cannot, and that is the gap this post is trying to close.
Everything below is general orientation, written in August 2026. This area changes. Check the current position before you rely on any of it.
Three questions people mush into one
Almost every confused conversation about this is really three separate questions wearing one coat.
**Are you allowed to make the recording?** This is surveillance and listening-device law, and in Australia it is mostly state law.
**What may you do with it afterwards?** This is privacy law, mostly federal, and it applies to storage, access, retention and disclosure long after the call ends.
**Does the caller know they are talking to an AI?** A different question again, not really about recording at all, and one that is becoming more prominent rather than less.
They have different sources, different tests and different answers. Treating them as one question is how businesses end up solving the easy one and missing the other two.
Why "what does NSW say" is not the whole answer
NSW has the Surveillance Devices Act 2007, and its general position on private conversations is that the people taking part need to consent to being recorded. There are exceptions written into it, including one concerning the protection of a party's lawful interests, and exceptions are precisely the kind of thing you do not want to be interpreting on your own.
But NSW is only part of it, for a reason that catches people out. Every state and territory has its own version of this legislation and they do not all say the same thing. Your business is in Sydney; your callers are not necessarily. A Sydney trades business takes calls from people who have just moved from Brisbane. A clinic gets calls from a patient on holiday in Melbourne. The moment a call crosses a border, "what does NSW say" stops being the only question.
Sitting over the top of all that is federal law, both on telecommunications and, separately, on privacy. Those are different regimes with different tests, and satisfying one tells you nothing about the other.
If that sounds like a lot, here is the useful part: it is exactly why almost everyone ends up at the same practical answer regardless.
The answer almost everyone lands on
Tell the caller, at the start, in plain words, and give them a way to keep going without being recorded.
This is what nearly every contact centre in the country does, and it is not a coincidence. Consent that is clearly sought and clearly given removes most of the argument before it starts. It is also the version that survives a caller in another state, a change in your call volume, or someone asking you three years later what you did.
Plain words matter more than legal ones here. A caller who is told, in a sentence they actually understand, that the call is recorded and why, has been genuinely informed. A caller who has been read a paragraph of legalese at speed has been processed.
The other half is the part businesses skip: giving them somewhere to go. A disclosure with no alternative is not really a choice. If someone would rather not be recorded, there should be a path that still gets them helped, whether that is continuing without the recording or being put through to a person.
What we build so you can actually answer for it
This is the part we do control, and the part worth knowing before you talk to anyone about compliance.
**The disclosure is in the greeting, before anything is captured.** Not buried, not after the caller has already explained their problem. You approve the exact wording, because it is your business making the statement.
**Recording is a setting, not a fixture.** An AI receptionist needs to understand the call in the moment. It does not follow that it must keep an audio file afterwards, and plenty of our clients run with retention turned right down or off. What is kept is a decision you make deliberately rather than a default we impose.
**There is a path for callers who decline.** We set it with you: transfer to a person, continue without retaining the recording, or take a callback. The point is that saying no does not mean being stuck.
**You can say where the data lives and how long it stays.** Retention periods, who on your team can play a recording back, what happens when the period is up. If you cannot answer those three questions about your current phone system, that is worth knowing on its own.
**The agent identifies itself.** We would advise being straightforward that the caller is speaking to a virtual assistant. Callers care far more about whether they got what they rang for than about who answered, and a business caught being coy about it has spent trust it did not need to spend.
What to actually ask a lawyer
Take these, not "is call recording legal":
Given where our callers are, which states' rules do we need to work to?
Is our proposed greeting sufficient disclosure, and does it need to change for calls we make outbound rather than receive?
Are we within the federal privacy regime, and if we are currently outside it because of our size, what happens if that changes?
Voice recordings are personal information. Does anything we do with them, particularly anything that identifies a caller by their voice, push them into a stricter category?
How long may we keep recordings and transcripts, and what does defensible deletion look like?
Does our privacy policy actually describe what the phone system does, or was it written before we had one?
That last question catches almost everyone. Privacy policies tend to be written once and then quietly outlived by the systems they describe.
What we will not do
We will not tell you that you are compliant. We will not draft your privacy policy. We will not answer "is this allowed" with "everyone does it", which is the answer you should be most suspicious of.
What we will do is describe exactly what the system captures, keeps and deletes, in enough detail that someone qualified can give you a real answer. Then we will build it however that answer says to.
If you are weighing up an AI phone receptionist and want the technical side written down clearly enough to hand to your lawyer, book a free strategy call and we will put it together with you.
Common questions
Do I have to tell callers an AI is answering?
We are not qualified to tell you what your obligations are. What we can say is that businesses who think about it tend to disclose anyway, in the first sentence, in plain words. A caller who works it out mid-conversation reacts far worse than one who was told, and a paragraph of legalese read at speed is not really telling anyone anything.
Where do call recordings actually end up?
That depends entirely on the vendor, which is why it is worth pinning down before you sign anything. Four questions cover it: which provider processes the audio, which country the servers are in, how long recordings are kept by default, and who inside your business can play one back.
Can a vendor tell me my setup is compliant?
No, and one who does is telling you something they are not in a position to know. Compliance depends on your business, your callers and your jurisdiction. A vendor can tell you what their system does. That is an input to the answer, not the answer.