Most business owners choose a phone system on price and features. Almost nobody asks whether it keeps them on the right side of the law. Yet the moment your phone system records a call, saves a voicemail, or stores customer details, it starts collecting information that Australian law has rules about. Get those rules wrong and a recorded call becomes a liability instead of an asset.
A compliant Australian business phone system needs three things: consent to record calls (all-party consent in NSW, WA, SA, Tasmania and the ACT), secure and lawful handling of call data under the Privacy Act, and a sensible retention policy for recordings and records. The phone system itself does not make you compliant. How it is configured does. Most breaches come from recording without notice, storing call data insecurely, or keeping it forever.
What makes a business phone system compliant in Australia?
Compliance sits on three pillars, and a VoIP or hosted phone system touches all three.
The first is consent. If you record calls, you need the right consent for your state. The second is privacy. Call recordings, voicemails and contact records are personal information under the Privacy Act, so they have to be collected fairly, used only for their purpose, and stored securely. The third is record-keeping. You should keep call data only as long as you have a reason to, then delete it.
Miss any one of these and the system that was meant to help you becomes a risk.
Do you need consent to record calls on a business phone system?
Usually, yes. And the rule changes depending on where you are, which trips up businesses that take calls across state lines.
Australia has no single national law for recording calls you take part in. Each state and territory has its own surveillance or listening-devices legislation, and they fall into two groups. In New South Wales, Western Australia, South Australia, Tasmania and the ACT, every party to the call must consent. In Queensland and Victoria, a participant can record a call they are part of, but there are strict limits on sharing or using that recording.
For a business that fields calls from all over the country, the safe approach is simple. Treat all-party consent as your default everywhere.
The fix is one your phone system can handle automatically: a short message at the start of the call telling the caller it may be recorded. Set it once, and every call carries the notice.
Does the Privacy Act apply to call recordings and voicemail?
If your business is covered by the Privacy Act, then yes. A call recording that identifies a person is personal information. So is a voicemail, a saved contact, or a note attached to a customer record in your phone system.
Your business is generally covered if it has an annual turnover of $3 million or more, or if it is a health service provider of any size, along with a few other categories. When the Act applies, you have to protect that data with reasonable security, use it only for the purpose you collected it, and let people know you are collecting it.
The practical points that follow from this are worth writing down. Call recordings need secure storage with access controls, not a shared folder anyone can open. You should know who can listen to recordings and why. And you need to be able to delete a customer’s data if the situation calls for it.
How long should you keep call recordings?
Only as long as you have a reason to. The Privacy Act works on a simple principle: do not keep personal information once you no longer need it.
There is no single legal retention period for general business call recordings. Common practice sits between 30 days and a few years, depending on why you record. A sales team confirming orders might keep recordings for a short window. A financial or healthcare business with record-keeping obligations will keep them far longer. The point is to set a policy and stick to it, rather than letting recordings pile up forever.
Indefinite storage is a quiet liability. Every recording you hold is data you have to protect, and data that could be exposed in a breach.
What about AI features and call transcripts?
More phone systems now add AI: automatic transcription, call summaries, sentiment analysis, and AI voice agents that answer calls. These are useful, and they raise the same compliance questions in new forms.
A transcript counts as a recording, so the same consent rules apply. AI-generated notes are personal information, so the Privacy Act covers them. And if you use an AI voice agent to answer calls, best practice is to tell callers they are speaking with an automated system, which also supports your privacy-notice obligations. New transparency rules around automated decision-making are due to expand these duties from December 2026, so the direction is toward more disclosure, not less.
Where phone system compliance usually goes wrong?
In practice, the same handful of gaps come up again and again.
Recording without notice is the most common. A system records every call, but no consent message ever plays, which puts the business offside in all-party states. Insecure storage is the next: recordings sitting in a folder half the office can open, with no record of who listened. Then there is indefinite retention, where nobody ever set a deletion policy. And finally, offshore data, where a cheap overseas VoIP provider stores your call data in another country, raising Privacy Act and data-sovereignty problems.
None of these is hard to fix. But they rarely get fixed on their own, because the person who set up the phones was thinking about call quality, not compliance.
How to make your business phone system compliant?
Here is the practical checklist.
- Turn on a consent message at the start of recorded calls, and treat all-party consent as your default.
- Store recordings securely, with access controls and a record of who can listen.
- Set a retention policy, and delete recordings once you no longer need them.
- Confirm where your call data is stored, and prefer Australian hosting for data sovereignty.
- Treat transcripts and AI notes the same as recordings.
- Disclose AI voice agents to callers.
- Write it down, so you can show your approach if you are ever asked.
Byteway Expert Insight
When we review phone systems for Melbourne businesses, the pattern is almost always the same. The system is capable of doing everything correctly, but nobody switched the compliance parts on. The recording feature is running with no consent message. The recordings are landing in storage that half the team can reach. And no one ever decided when they should be deleted.
The reassuring part is that fixing it is quick. A consent message takes minutes to configure. Access controls and a retention policy take a short conversation. The reason it matters is that a call recording made without consent is not just a compliance problem; it is often useless as evidence anyway, so you carry the risk without getting the benefit. Set it up properly once and your phone system stops being a quiet liability and starts being an asset you can actually rely on.
Is Byteway a good choice for a compliant business phone system?
Yes, for Australian businesses that want their phone system set up to be compliant, not just functional. Byteway configures cloud VoIP and hosted PBX with consent messaging on recorded calls, secure and access-controlled storage, sensible retention, Australian data hosting, and clear handling of AI transcripts and voice agents. Local support means it is set up right and stays that way.
Where Byteway is different:
- Compliance is built into the setup, from consent messages to storage and retention, rather than left for you to figure out.
- Call data can be hosted in Australia, which matters for privacy and data sovereignty.
- One local team runs your phones, internet, cyber security and IT support, so your call data is protected like any other sensitive information.
No provider can promise you will never face a complaint. But a phone system set up correctly, and documented, keeps you on the right side of the line.
Check your phone system before it becomes a problem
Most compliance gaps in a phone system are invisible until something goes wrong. The good news is they are cheap and quick to fix once you know they are there.
Book a free phone system review. We will check your consent settings, storage, retention and data location against Australian rules, and show you exactly what to fix.
👉 Get your free phone system review
Frequently Asked Questions
Do I need consent to record calls on a business phone system?
In most cases yes, and in NSW, WA, SA, Tasmania and the ACT all parties must consent. The safe standard for any business is an automatic message at the start of each call stating it may be recorded. That notice captures consent across every state, so you are covered wherever the caller is.
Are call recordings personal information under the Privacy Act?
Yes, if the recording identifies a person and your business is covered by the Act (generally turnover of $3 million or more, or a health provider of any size). That means you must store recordings securely, limit access, use them only for their purpose, and tell callers you are collecting them.
How long can I keep call recordings?
Only as long as you have a genuine reason to, then delete them. There is no fixed legal period for general business calls, so most businesses set a policy between 30 days and a few years based on why they record. Keeping recordings forever raises your risk and breaks the Privacy Act principle of data minimisation.
Do AI call transcripts and summaries need consent?
Yes. A transcript is treated like a recording, so the same consent rules apply, and AI-generated notes are personal information under the Privacy Act. If an AI voice agent answers your calls, tell callers they are speaking with an automated system, both for transparency and to meet your notice obligations.
Does it matter where my phone system stores call data?
Yes. Some cheap overseas VoIP providers store call data offshore, which can raise Privacy Act and data-sovereignty concerns, especially for health and finance businesses. Prefer a provider that can host your call data in Australia and confirm it in writing.
What is the most common phone system compliance mistake?
Recording calls without a consent message. Many systems record by default with no notice ever playing, which puts the business offside in all-party consent states. The fix is quick: turn on an automatic consent message and treat all-party consent as your default.
Does a cloud VoIP system make my business compliant?
Not on its own. Compliance depends on configuration, not the type of system. A cloud VoIP or hosted PBX can be fully compliant when consent messaging, secure storage, retention and disclosure are set up correctly, or non-compliant when they are not. A phone system review checks the settings that actually matter.