From call centres and retail stores to service providers and startups, recording is now part of everyday business operations. You might record calls for training, use CCTV for security, or capture short videos for marketing.
But before you hit “record”, it’s important to understand how recording is regulated in Australia. The rules can be complex, and they vary across states and territories. With the right approach, you can stay compliant, protect your customers and staff, and avoid costly penalties.
In this guide, we’ll walk through the key recording laws in Australia, when you need consent, how workplace surveillance fits in, and practical steps to keep your business on the right side of the law.
Are You Allowed To Record In Australia?
Short answer: sometimes. The legality of recording depends on what you’re recording (audio, video, phone calls), where it happens (public vs private), and whether you have the appropriate consent.
Audio vs Video: Different Rules
Australian states and territories have Surveillance Devices Acts that regulate listening devices (audio), optical surveillance (video), and tracking. Generally speaking, recording a private conversation without consent is restricted. Video recording is more permissible in spaces where people don’t reasonably expect privacy, but there are still important limits (for example, bathrooms or change rooms).
If you’re looking for a big-picture primer, start with this overview of recording laws in Australia.
What Counts As Consent?
Consent can be express (a clear “yes”, ticking a box, signage that people read before entering) or implied in limited circumstances. As a rule of thumb, aim for clear, informed consent that explains what you’re recording, why, and how the recording will be used.
Businesses often capture consent by:
- Playing a pre-call message before a phone call continues.
- Displaying clear signage at entry points where CCTV is used.
- Including consent language in online booking forms or terms.
- Using written release forms for filming and marketing content.
Phone Calls Are Special
Phone recordings attract additional rules. Intercepting communications without being a party is generally prohibited, and recording calls often requires consent. If your business records calls, use a pre-call announcement and give callers a genuine choice to proceed or opt out. For a more detailed discussion on phone-specific rules, see when you can legally record a phone call.
State And Territory Differences: What Changes Where?
Each state and territory regulates recording differently. While the principles are similar, there are important nuances that affect consent, workplace surveillance, and what counts as a “private conversation”.
New South Wales (NSW)
NSW has specific requirements for listening and optical devices, and there are rules about using and sharing recordings. If you’re operating in NSW, it’s worth reading the core rules for NSW recording laws, including how consent should be managed and the limits around covert recording.
Victoria
Victoria has its own Surveillance Devices Act with tight restrictions on recording private activities and communications. Businesses should pay close attention to where cameras are placed and how audio is captured, particularly in workplaces and customer-facing spaces.
Queensland
Queensland’s approach has some unique features (including how “private conversations” are treated and the circumstances where a party to a conversation can lawfully record). If you conduct business in QLD, acquaint yourself with the practical do’s and don’ts in a business context before rolling out any monitoring or recording systems.
Other Jurisdictions (WA, SA, TAS, ACT, NT)
Western Australia, South Australia, Tasmania, the ACT and the Northern Territory each have separate laws and definitions. The safest path is to identify where you operate and apply the strictest set of rules across your business to keep compliance simple-particularly if you operate nationally or online.
Tip: If your staff travel interstate, your workflow should still follow the stricter standards so compliance travels with them.
Recording Customers, Staff And Contractors: What’s Permitted?
In business, recordings typically fall into a few common categories: customer interactions (calls, online chats, in-store CCTV), workplace surveillance (cameras, monitoring of emails or devices), and content creation (photos, videos for marketing). Each area has different rules and expectations.
Customer-Facing Areas And CCTV
Using cameras in retail stores, hospitality venues and office reception areas is common. You should limit recording to areas where people don’t expect privacy, avoid sensitive spaces (like bathrooms or change rooms), and put up clear signage that recording is in operation.
It’s also important to separate security footage from marketing footage. Security recordings should be used for safety and loss prevention; if you want to publicly use a customer’s image, obtain consent first (more on releases below). For foundational guidance, check your obligations under Australia’s security camera laws and broader CCTV laws.
Workplace Surveillance And Staff Monitoring
Workplace surveillance-like security cameras in back-of-house areas, keystroke monitoring, or GPS tracking-can be lawful, but strict notice and consent rules usually apply. Many states require that employees are notified in writing in advance, with details on what’s monitored, when, and why.
Monitoring isn’t just cameras. If you access or monitor employee emails or devices, set this out in a clear workplace policy and ensure staff acknowledge it. Avoid covert surveillance unless the law expressly allows it in your situation.
Contractors And Third Parties
If contractors or service providers work on your premises or use your systems, make sure your agreements explain the surveillance environment and include consent where required. It’s also sensible to restrict their use of recordings they may capture in the course of their work.
Children, Vulnerable People And Sensitive Contexts
Extra care is needed when recording children or vulnerable people. Even if signs are present, you’ll usually want explicit written consent from a parent, guardian or appropriate authority, especially for any external or marketing use.
Special Contexts: Calls, Video, Online Meetings And Public Filming
Not all recordings are equal. Different technologies and contexts raise different legal issues-and practical steps to stay compliant.
Call Recording (Inbound And Outbound)
For customer service, sales, or support lines, make consent front-and-centre. A pre-call message that explains the recording and purpose, plus an option not to continue, is best practice. If callers can reach you through other channels (e.g. web chat or email) without recording, mention that option.
Video Conferencing And Online Meetings
Online meetings can feel casual, but they’re still private conversations. If you plan to record, let all participants know at the start and via the platform’s visible recording indicator. If you’ll use any part of the recording beyond internal review (e.g. training, marketing), get express written consent that covers that use.
Public Filming And Marketing Content
Filming in public spaces can still raise privacy and consent issues, especially if individuals are identifiable and you plan to use the content for promotion. When people are a focus rather than incidental background, it’s wise to secure releases and keep a record of what was agreed. You’ll also want to consider privacy expectations at the location and whether any permits are required.
As part of your content workflow, decide when you’ll rely on crowd signage, when verbal consent is enough, and when you’ll use written releases-then be consistent. For campaigns that feature identifiable individuals (staff, customers, influencers), capture consent in writing and store it with the asset files.
Privacy, Data And Retention: What Happens To The Recording?
Even if a recording is lawful to make, the next legal question is how you store, use and disclose it. Most recordings will contain “personal information” under the Privacy Act 1988 (Cth), which means the Australian Privacy Principles (APPs) apply if your business meets the relevant thresholds (and many businesses follow the APPs as best practice regardless).
Explain What You Collect And Why
Tell people what you record, why you record it, and how long you keep it. This is usually done in your Privacy Policy and, where practical, via short notices at the point of collection (for example, in pre-call scripts or signage). If you plan to use recordings for training, quality assurance, dispute resolution or marketing, say so.
Store Securely And Limit Access
Keep recordings secure with appropriate technical and organisational measures (access controls, encryption at rest and in transit, and audit logs). Only give access to staff who need it for their role, and log access for accountability. Consider your retention schedule: how long you keep recordings and when they are securely deleted.
Retention And Industry-Specific Rules
Some sectors have additional obligations-for example, telecommunications carriers and carriage service providers face specific data retention laws. Regulated industries (financial services, health, education) may also have sector rules about records, disclosures, and security standards.
Re-Use And Disclosure
Re-using recordings for a new purpose (like turning a support call into a testimonial) usually needs fresh, specific consent. If you share recordings with third-party processors (cloud platforms, transcribers, AI tools), ensure you have appropriate contracts, data handling terms, and-where required-overseas transfer safeguards.
Marketing Messages And Spam
If you use information obtained from calls or videos to send marketing, follow Australia’s spam and consent rules. Keep your contact lists clean, include clear opt-outs, and ensure your workflows align with Australia’s email marketing laws.
Practical Steps To Stay Compliant: A Simple Business Checklist
Here’s a practical roadmap you can use to roll out recording in a way that’s compliant and customer-friendly.
- Map your recordings. List every place you capture audio or video (calls, CCTV, interviews, training videos, online meetings). Note the purpose, who’s recorded, and where files are stored.
- Decide on consent methods. For each context, choose the right consent approach: pre-call script, signage, tick-boxes, or written releases. Keep the language plain and specific.
- Update your notices and policies. Align your scripts, signage and website notices with what you actually do. Your Privacy Policy should clearly describe what you collect and why.
- Set clear workplace rules. If you monitor staff or equipment, put it in writing and provide advance notice. A concise workplace policy that covers surveillance, device use and remote-work expectations makes compliance easier.
- Configure your systems correctly. Enable in-product recording indicators, set retention defaults, restrict downloading, and require authentication to access files. Keep admin access to a minimum.
- Use releases for marketing content. When filming identifiable people for campaigns, use written releases and store them with the final media files so you can verify consent later.
- Train your team. Teach staff what to say in consent scripts, how to handle objections, and where to find your policies. Consistency builds trust.
- Plan for requests and complaints. Have a simple process for handling access or deletion requests and complaints about recordings. One contact point (like your privacy inbox) keeps things smooth.
- Review third-party providers. Check your cloud and transcription tools for security, data location, and contractual terms, especially if personal information is stored offshore.
- Set retention and deletion rules. Keep recordings only as long as needed for the stated purpose, then delete securely. Document your default retention periods and stick to them.
Common Pitfalls (And How To Avoid Them)
- Relying on implied consent. Don’t assume silence is consent. Use clear, upfront notices and scripts so people understand their choices.
- Recording in sensitive areas. Avoid spaces where people reasonably expect privacy (bathrooms, change rooms). Configure cameras to exclude these areas.
- Using security footage for marketing without consent. Security and marketing are not the same purpose. If you want to use footage externally, get explicit permission first.
- Inconsistent policies vs practice. Make sure your scripts, signage, and internal policies match what your systems actually do. If you change your process, update the paperwork too.
- Keeping recordings forever. Retention creep creates risk. Define retention periods and schedule secure deletion.
Key Takeaways
- Recording can be lawful in Australia, but consent, context and purpose matter-phone calls, private conversations and workplace surveillance have specific rules.
- States and territories have different surveillance device laws, so apply the strictest standard across your operations if you work nationally.
- Customer areas and CCTV require clear signage and sensible placement; workplace monitoring usually requires written notice and robust policies.
- Tell people what you’re recording and why, store recordings securely, and align your practices with your published Privacy Policy.
- Be careful when repurposing recordings-marketing use often needs fresh, explicit consent; sector-specific rules and data retention laws may also apply.
- Build a simple compliance workflow: clear consent scripts, signage, tight access controls, defined retention, and regular staff training.
- When in doubt, review your setup against Australia’s general recording laws in Australia and seek legal guidance before you roll out new recording tech.
If you’d like a consultation on recording laws for your business, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
