Blog

24 Oct 2026

Data Retention Policy for Calls: What Australian Businesses Need

A data retention policy for calls states how long you keep recordings, transcripts and caller details, why you keep them, and how you destroy or de-identify them when that period ends. In Australia there is no single number of days that applies to every business. The Privacy Act expects you to keep personal information only while you still need it for a legitimate purpose, and some other laws (tax, health, employment) set their own minimums. This guide shows you how to set the periods, write them down and make them real in your phone system.

WattleManage Call Data with CareWattle lets you configure call recording and transcription, then manage recordings, transcripts, and caller details alongside customer interactions.Explore Wattle

TL;DR

Call recordings and transcripts are personal information. Under APP 11 you must take reasonable steps to destroy or de-identify them once you no longer need them, unless a law requires you to keep them.
Pick a retention period for each type of call data (audio, transcript, metadata, booking record) and tie each one to a purpose, not to convenience.
Tell callers about recording at the start of the call. Recording without notice can breach state and territory listening devices laws, whatever your policy says.
The two-year metadata rule applies to telecommunications service providers, not to ordinary businesses that use a phone system.
A policy only counts if it runs: automate deletion where you can, log destruction events and review the schedule at least once a year.

Why calls need their own retention rules
What Australian law actually requires
The four kinds of call data to schedule
How to write the policy
Making the policy run in practice
Special cases worth planning for
Our perspective
Where Wattle fits
A 30-day rollout plan
FAQ
Sources

Why calls need their own retention rules

Most businesses already have a records policy for invoices and contracts. Calls get missed because they feel temporary. They are not. A recorded call can contain a name, an address, a health detail, a card conversation or a complaint. A transcript makes that content searchable, copyable and easy to leak.

The call also produces data you may not think of as a record. The caller’s number, the time, the duration and the outcome are all stored somewhere. Once that number sits next to a CRM entry, an invoice or an appointment log, it is personal information in practice, even if no one said their name. Treat call metadata with the same care as the audio.

The risk runs both ways. Keep too little and you cannot resolve a dispute or prove what a customer agreed to. Keep too much and every data breach becomes larger, and every access request takes longer to answer.

What Australian law actually requires

The Privacy Act and APP 11

Australian Privacy Principle 11 is the rule that matters most. According to the OAIC’s APP 11 guidelines, an entity must take reasonable steps to destroy personal information or ensure it is de-identified once it is no longer needed for any purpose the APPs allow. The exceptions are information held in a Commonwealth record, and information you are required by law or a court order to keep.

Three practical points follow from that wording.

There is no fixed period. You decide, and you must be able to justify the decision by pointing to a purpose.
It covers every copy. Archives, exports, backups and files sitting in a staff member’s downloads folder all count.
“Reasonable steps” scales. The more calls you store and the more sensitive they are, the more the OAIC expects from you. Saying automated deletion is inconvenient or costly is not a defence.

The Privacy Act applies to most businesses with annual turnover above A$3 million, and to some smaller ones, such as health service providers. If you are unsure whether it covers you, check the OAIC’s guidance or ask a privacy lawyer before you treat the rules as optional.

Recording notices and state laws

Retention starts with collection. If you recorded a call unlawfully, there is no lawful period for which to keep it. Recording rules sit in state and territory listening devices and surveillance laws, and they differ. Some jurisdictions allow a party to a call to record it, while others generally need everyone’s consent. A Sprintlaw guide to recording calls explains that for calls crossing state lines the safer course is to follow the stricter rule, which in practice means telling callers at the start and giving them a way to continue without being recorded.

The Privacy Act adds a notice requirement of its own. The OAIC’s guidance on collecting personal information points to telling people who you are, why you are collecting the information and how they can complain. Put a short version in your greeting and link the full version in your privacy policy.

Recording notices and state laws — overview diagram

Laws that require you to keep records

Some retention periods are set elsewhere. The “keep it for seven years” figure many people quote comes from tax and corporate record rules, and it applies to financial records, not to a call recording as such. A call becomes a financial record only if you rely on it as the evidence of a transaction. Where that is the case, keep the record that supports the transaction (the quote, the signed booking, the invoice) rather than the audio, and delete the audio on its own schedule.

Health providers, financial services licensees and employers have further obligations that vary by state and by sector. If you work in one of those fields, confirm the minimums with your regulator or professional body before you set a short deletion period.

The two-year metadata rule is not yours

The data retention scheme people often find first in search results is Part 5-1A of the Telecommunications (Interception and Access) Act 1979. It obliges telecommunications service providers to keep specified information about communications, such as source and destination identifiers, date, time and duration, and the type of service. It does not cover the content of the communication. The OAIC’s note on the scheme explains the Privacy Act duties that sit alongside it.

If you are a plumber, accountant or real estate agency using a cloud phone system, that obligation sits with your carrier. Your own call data falls under APP 11 and whatever sector rules apply to you.

The four kinds of call data to schedule

A single period for “calls” is too blunt. Split the data by what it is and what it is for.

Data type Typical purpose Sensitivity Retention approach Audio recording Quality review, dispute resolution, training High Shortest period; delete or de-identify once the purpose is met Transcript Searching, summarising, updating the CRM High Often the same as audio, or shorter once a summary is stored Call metadata (caller number, time, duration, outcome) Reporting, call logging, follow-up Medium, but personal once linked to a customer Tied to the customer record it supports Outcome record (booking, quote, job note, payment) Delivering the service, tax and legal records Varies Follows the legal minimum for that record type

The useful habit is to keep the outcome and let the conversation go. If the booking, the confirmation and the customer’s instructions are captured in structured fields, you rarely need the audio for long.

Example periods, and how to read them

The periods below are an illustration of how a small service business might think, not legal advice and not a standard. Your purposes and sector rules decide the real numbers.

Routine booking calls: keep audio and transcript for a short review window, for example 30 to 90 days, long enough to catch errors and handle complaints, then delete.
Calls flagged as complaints or disputes: hold them until the matter is resolved, plus any limitation period your adviser identifies. Mark them so they are excluded from automatic deletion.
Calls linked to a regulated record: follow the sector rule for that record, and document why.
Metadata and summaries: keep with the customer record while the customer relationship is active, then review.

Write down the reason beside each number. When a regulator, a customer or your own auditor asks why you keep something, the reason is the answer.

How to write the policy

A good call retention policy fits on two pages. Here is a structure that works.

Scope. Which channels it covers: phone, web chat, WhatsApp, SMS, voicemail, and any AI or human agent that handles them.
Purposes. The specific reasons you hold call data, in plain words.
Schedule. A table like the one above, with a period, a trigger (for example, “90 days after the call”) and an owner for each data type.
Legal holds. Who can pause deletion, for what, and how that is recorded.
Destruction method. Deleted from the live system, from exports and from backups, and how you confirm it.
Access and correction. How customers ask for their data and how long you take to respond.
Review. A named person and a date, at least annually.

The OAIC’s view is that a compliant policy rests on active consideration. Do not default to keeping everything. Review what you hold, ask whether the original purpose still exists, and delete when it does not.

Making the policy run in practice

Policies fail in the gap between the document and the system. Close that gap with these steps.

Find where call data lives

List every place a call leaves a trace: the phone platform, the CRM, the shared inbox, email notifications with transcripts attached, spreadsheets, a team chat channel, backups. Most businesses find two or three copies they had forgotten.

Set deletion at the source, then chase the copies

Use the retention settings in your phone or communications platform where they exist. Then deal with exports and downstream copies, which the system will not touch by itself. If your CRM receives transcripts, it needs a matching rule. Our guide to server-side CRM call logging covers how call records reach the CRM, which is where many stray copies start.

Limit who can listen and download

Fewer people with access means fewer copies. Give recording access to the roles that need it, and log who plays or exports a call. Our piece on call recording and transcription setup walks through access and storage choices for teams.

Document destruction and train your staff

Technical deletion is only half of “reasonable steps”. Staff need to know what to do with a recording they have saved locally, and you need a record that deletion happened. Keep a simple log: date, data type, batch or system, method, person responsible. Good audit log practices help here, because a log that records who did what and when is the evidence that your schedule is more than words.

Handle hardware and backups

Backups must age out on a schedule, not live forever. When devices that held recordings are retired, wipe them properly. The OAIC expects more rigorous measures, including full media sanitisation, as the volume and sensitivity of what you hold increase.

Special cases worth planning for

Health and professional services. If callers describe symptoms, finances or legal matters, the call is likely to hold sensitive information, which carries stricter handling expectations. Clinics, accountants and legal practices should set shorter audio retention and rely on structured notes. Our accounting answering service guide shows how firms capture the detail they need without keeping every conversation.

After-hours and voicemail. Voicemail audio and its transcript are call data too, and they are easy to forget because they pile up in an inbox. Include them in the schedule. See our notes on voicemail transcription for exporting text and then clearing the audio.

Messaging channels. WhatsApp and SMS threads need their own period, and contact rules apply on top. Our guide to WhatsApp customer support in Australia covers the opt-in side.

Customer requests. People can ask what you hold about them. A tidy schedule makes that answerable, because you know where each type of data sits and what should still exist.

Our perspective

We build an AI front desk that answers calls and chats, books work and records conversations, so retention is something we think about every week. Here is where we land.

First, the best retention decision is made before the call, by deciding what you need to capture. If the agent collects the name, the job type, the address and the preferred time into structured fields, the booking is the record, and the audio becomes a short-lived quality tool rather than a permanent archive.

Second, one inbox beats five. When phone, web chat, WhatsApp and SMS land in a single workspace, you have one place to apply a schedule, one place to search when a customer asks for their data and one place to check that deletion happened. Scattered tools mean scattered copies, and scattered copies are what turn “reasonable steps” into an argument.

Our perspective — overview diagram

Third, humans should hold the sensitive moments. Our agents escalate complex or sensitive conversations to staff, and your policy should say how those calls are treated differently, for instance flagged and held until resolved.

Finally, write the policy for the person who has to run it on a Tuesday afternoon, not for an auditor. If it takes a lawyer to read it, it will not be followed.

— Christopher

Where Wattle fits

If you are choosing a phone or call-handling platform, check three things before you sign: can you control how long recordings and transcripts are kept, can you export or delete a specific customer’s data, and does every channel land in one place. Wattle brings calls, web chat, WhatsApp and SMS into one inbox, with call recordings and transcripts, calendar integration and human handover. Plans are Starter at A$99 per month, Pro at A$499 per month and Max at A$999 per month, and you can compare them on the Wattle pricing page. To see what the agents can do, browse the AI receptionist features.

A 30-day rollout plan

Week 1: map every place call data lives and who can access it.
Week 2: set purposes and draft the schedule, with legal minimums confirmed by your adviser or regulator where they apply.
Week 3: configure deletion in your systems, update your recording notice and privacy policy, and brief staff.
Week 4: run a test. Pick a call older than your period and confirm it is gone from the platform, the CRM and exports. Log the result and diarise the annual review.

FAQ

How long can a business keep call recordings in Australia?

There is no single legal limit. Under APP 11 you can keep a recording while you still need it for a purpose the Privacy Act allows, and you must then take reasonable steps to destroy or de-identify it, unless a law requires you to keep it. Set the period by purpose and write down the reason.

Do I have to tell callers I am recording?

Yes, as a safe practice and in many cases as a legal requirement. State and territory listening devices laws differ, and the Privacy Act expects you to tell people why you are collecting their information. Give notice at the start of the call and say how they can find your privacy policy.

Does the two-year data retention law apply to my business?

Not if you only use a phone service. The two-year scheme in the Telecommunications (Interception and Access) Act applies to telecommunications service providers and covers metadata, not call content. Your own call data is governed by the Privacy Act and any sector rules.

Should I delete transcripts as well as audio?

Yes. A transcript is personal information in the same way as the audio, and it is easier to search and share. Give it its own period, and keep the structured outcome (the booking, the job note) rather than the full text where you can.

Is caller ID personal information?

It can be. When a caller’s number can be matched to a customer record, invoice or appointment, it becomes personal information. Protect and schedule metadata alongside the recordings.

Sources

Give every caller a good first answer.

Request access