Skip to content
Skip to content

Practical reception guide · By Yes AI

Privacy Act duties for AI receptionist call data

Published 5 min read

Every call an AI receptionist handles creates personal information: a phone number, a name, the reason for calling and often a recording and transcript. Whether the Privacy Act applies depends on your business, and several Australian Privacy Principles then shape what you can do with that data. This is administrative guidance only; for advice on your situation, use the OAIC's resources or a privacy lawyer.

Review where your call data would goCall (03) 9003 0111Book a free demo call

Quick answer

The Privacy Act applies to businesses with annual turnover above $3 million and, regardless of turnover, to health service providers and some other categories. For covered businesses, AI receptionist recordings, transcripts and messages are personal information handled under the Australian Privacy Principles, including notification (APP 5), cross-border disclosure (APP 8) and security (APP 11). From 10 December 2026, privacy policies must also describe certain automated decisions.

Small business owner reviewing privacy settings on a laptop at a kitchen table in a Hobart home office

Does the Privacy Act apply to my business?

The Privacy Act covers organisations with annual turnover above $3 million. Smaller businesses are generally exempt, with exceptions. The OAIC lists private sector health service providers as covered regardless of turnover, including medical practitioners, pharmacists, allied health professionals, complementary therapists, gyms and child care centres. Businesses that buy or sell personal information, credit reporting bodies and businesses that opt in are also covered. If you are unsure, check the OAIC's list before relying on the exemption. An exempt business should still handle call data carefully, because callers expect it and larger clients may require it in their contracts.

Is call data personal information?

Usually, yes. The OAIC gives the example of a business that records calls to its enquiries line: a recording containing a caller's voice may be their personal information where they are reasonably identifiable. Transcripts, summaries, message emails and booking records that include names, phone numbers and reasons for calling are personal information too. Calls to clinics often include health details. The OAIC's guidance on AI products recommends particular care with sensitive information, and advises against entering personal or sensitive information into publicly available generative AI tools.

What must callers be told?

APP 5 deals with notification when personal information is collected, and APP 1 requires a clearly expressed, current privacy policy. The OAIC's guidance on commercially available AI products says businesses should update their privacy policies and notifications with clear information about their use of AI, and that public-facing AI tools should be clearly identified to the people using them. For an AI receptionist, that means a short spoken notice in the greeting and a privacy policy that names call recording, transcription and the use of an AI service.

  • That calls may be answered by an automated receptionist
  • That calls are recorded or transcribed, and why
  • Which provider processes call data, and in which countries
  • How long recordings and transcripts are kept
  • How a caller can ask for access or make a complaint

What if the provider stores data overseas?

APP 8 governs cross-border disclosure of personal information. An AI receptionist can involve several companies: the receptionist provider, a telephony carrier, a speech or language model provider and a cloud host, each possibly in a different country. Ask the provider to list where recordings, transcripts and model processing happen, which other companies receive call content, and whether any of them can use it to train models. The OAIC's AI guidance lists training data, security risks and developer access to your data among the due diligence questions to ask before choosing a product.

How should call data be secured and deleted?

APP 11 deals with the security of personal information. In practice, give staff individual logins to the call dashboard, limit recordings to the roles that need them and switch on multi-factor authentication if the platform offers it. Set a retention period inside the platform, check that deletion covers copies the provider keeps, and remove access when staff leave. Messages forwarded to email and SMS are copies too, so keep their content to what staff need to act on the call.

What changes on 10 December 2026?

From 10 December 2026, an APP entity's privacy policy must include information where it has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information. The policy must describe the kinds of personal information used and the kinds of decisions involved. In our view, taking a message is unlikely to qualify, but triage rules that refuse service, decide eligibility or set priority for urgent help may. Read the OAIC's guidance and get advice on how your rules fit.

Questions to put to an AI receptionist provider

QuestionWhy it mattersRelated APP
Where are recordings, transcripts and summaries stored and processed?Overseas storage or processing raises cross-border disclosure questionsAPP 8
Which other companies receive call content, and can any of them train models on it?The OAIC lists training data and developer access as due diligence questionsAPP 6 and APP 8
Who at the provider can access our call data, and is that access logged?Security of personal informationAPP 11
How long is data kept, and does deletion include backups?Data kept longer than needed is exposed for longerAPP 11
Can we find and export one caller's records on request?Individuals can ask for access to information held about themAPP 12
What does the greeting tell callers about recording and AI?Notification at the time of collectionAPP 5

Practical checklist

  • You have confirmed whether the Privacy Act covers your business, including the health service provider rule.
  • Your privacy policy names call recording, transcription and the use of an AI receptionist.
  • You know which countries call data is stored or processed in.
  • The provider has said in writing whether call content is used to train models.
  • Access to recordings is limited to named staff roles with individual logins.
  • A retention period and deletion method are set in the platform and tested.
  • Any triage or eligibility rules have been checked against the 10 December 2026 automated-decision requirement.

Common questions

Our turnover is under $3 million. Can we ignore the Privacy Act?

Only if no exception applies. Health service providers are covered regardless of turnover, and so are businesses that trade in personal information or have opted in. Check the OAIC's list. Even where the exemption applies, following the same practices protects you if you later grow past the threshold, become part of a covered group or sign a contract that requires them.

Does an Australian provider mean our data stays in Australia?

Not necessarily. An Australian company can use overseas carriers, model providers or cloud regions. Ask for a written list of where call content is stored and processed, including any speech or language model the service sends audio or text to, and ask to be told before that list changes.

Can a caller ask for their recording or transcript?

APP 12 deals with individuals' access to the personal information an APP entity holds about them. Plan how you would find one caller's calls by phone number and date, export them and check them for other people's information before releasing anything. Test that process once before you need it.

Are message emails and texts covered too?

Yes. A summary sent to a staff inbox or mobile is another copy of the caller's personal information. Keep summaries to what staff need, avoid forwarding them to personal accounts, and include those inboxes in your retention and staff offboarding steps.

Does the December 2026 rule apply to small businesses?

It applies to APP entities, meaning organisations the Privacy Act covers. A small business that falls under the exemption is not covered, unless it is in a covered category such as health service providers. If your business is covered, review any rule where the receptionist decides something on its own that could significantly affect a caller.

Where can we get advice?

The OAIC publishes guidance for businesses, including on the use of commercially available AI products and on the new automated decision-making requirement. For advice on your circumstances, speak to a privacy lawyer. This guide is administrative information and does not cover every exception in the Act.

Sources and further reading

Continue planning

Turn the guide into your call flow

Bring your current call-handling process and the exceptions your team encounters. We can discuss what to automate, what needs staff approval and what to test before changing your live phone service.

Review where your call data would goCall (03) 9003 0111Book a free demo call