Every founder who has ever asked “is it legal to record calls NZ side of the ditch?” has usually asked it about two minutes before they wanted to switch something on. A new phone system. A call-tracking number. An AI receptionist that answers after hours. The short answer is yes, it is legal, and it is easier than most people assume. The longer answer is that “legal to record” and “legal to keep, use and share” are three different questions, and most businesses only think about the first one.
This post covers all three. What the law actually says, what you have to tell callers, how long you can hold recordings, and what changes when the voice on your end is an AI rather than a person.
Key Takeaways
- It is legal to record calls in NZ if you are a party to the conversation, so recording your own business calls is lawful under the Crimes Act.
- The Privacy Act 2020 is the real constraint, not the Crimes Act: a recording is personal information the moment it captures an identifiable person.
- Best practice is a clear announcement at the start of every call, with an option to continue without recording if the caller objects.
- Recording a call you are not part of is illegal and carries up to two years’ imprisonment under section 216B of the Crimes Act 1961.
- Callers can ask for a copy of their own recording, and you generally have 20 working days to respond under Privacy Act information access rules.
- AI voice agents must disclose they are automated at the start of the call, on top of the standard recording notice.
- Keep recordings only as long as you have a genuine business reason, then delete them; indefinite storage is a Privacy Act breach waiting to happen.
- Marketing calls to numbers on the Do Not Call register or unsolicited SMS carry separate obligations under the Unsolicited Electronic Messages Act.
I am not a lawyer, and this is not legal advice. It is the plain-English version of what I have had to work through building call systems for NZ businesses, checked against the actual legislation and the Privacy Commissioner’s own guidance. If you are running something high-risk, get a lawyer to sign off. For most founders answering their own phones, this is enough to get moving.
Is It Legal to Record Calls in NZ? The Two-Law Answer
There are two pieces of law that matter here, and confusing them is where most of the anxiety comes from.
The Crimes Act: one-party consent
Section 216B of the Crimes Act 1961 makes it an offence to intentionally intercept a private communication using an interception device. The penalty is up to two years’ imprisonment. That sounds alarming until you read the exception: it does not apply to a person who is a party to the communication.
New Zealand is a one-party consent country. If you are on the call, you can record the call. You do not need the other person’s permission under the Crimes Act. This is the same position as Australia’s federal law in most states and different from the two-party consent rules in California and a handful of other US states, which is why American SaaS tools tend to be more paranoid about this than they need to be here.
Where it becomes a crime is recording a call you are not part of. Sticking a recorder on your receptionist’s line to listen in on conversations you have nothing to do with is interception. Bugging a meeting room and walking out is interception. Recording your own sales calls is not.
The Privacy Act: the one that actually bites
The Crimes Act gives you permission. The Privacy Act 2020 gives you obligations. A call recording of an identifiable person is personal information, full stop. That pulls it inside all thirteen information privacy principles.
The ones that matter most for call recording:
Principle 3 (collection from the individual). You must take reasonable steps to make the person aware you are collecting the information, why, who will see it, and that they have a right to access and correct it. This is the legal basis for the “this call may be recorded” announcement.
Principle 5 (storage and security). You must protect recordings against loss, misuse and unauthorised access. A folder of MP3s on a shared drive that everyone can open is a problem.
Principle 9 (retention). You must not keep personal information for longer than you need it for the purpose you collected it. Recordings that sit forever “just in case” fail this.
Principle 6 (access). The caller can ask you for a copy of their own recording. You generally have 20 working days to respond.
So the honest answer to “is it legal to record calls NZ businesses handle” is: yes under the Crimes Act, conditionally under the Privacy Act, and the conditions are the whole job.
What You Actually Have to Tell Callers
The Privacy Commissioner’s position is straightforward: tell people, at the start, before anything sensitive is said. There is no prescribed script, but there is a shape that works.
The announcement itself
Three things have to land in the first few seconds:
That the call is being recorded. Why it is being recorded. What happens if they would rather it wasn’t.
Something like: “Just so you know, this call is recorded for training and record-keeping. If you’d rather it wasn’t, let me know, and I’ll switch it off.” That is one sentence. It takes four seconds. It covers principle 3, and it gives the caller a genuine option, which is the part most businesses skip.
The “or I’ll switch it off” clause matters more than people realise. If your only option is record or hang up, you are effectively conditioning service on consent, and that starts to look coercive. Most callers will not take you up on it. The ones who do are usually the ones you would have had a problem with later.
Outbound calls
Same rule, tighter timing. If you are the one dialling, say it before you start asking questions. Do not bury it after the pitch.
What about the beep?
The periodic beep tone is a hangover from older telephony and is not a legal requirement in New Zealand. A verbal announcement is clearer and better understood. If your system offers both, verbal wins.
Do you need consent in writing?
No. For a phone call, verbal notice at the start is sufficient. Where written consent starts to matter is when you are doing something beyond the obvious: using recordings to train an AI model, sharing them with a third party, or using them for a purpose the caller would not reasonably expect. Then you need a real conversation about it, not a line in a footer.
The bit almost everyone gets wrong
Telling the caller is only half of principle 3. You also have to be honest about the purpose, and then stick to it. If you announce “recorded for quality and training” and then feed those recordings into a marketing tool to build lookalike audiences, you have collected for one purpose and used it for another. That is a principle 10 problem, and it is the sort of thing that turns a complaint into a finding.
Decide the purpose first. Announce that purpose. Use it only for that.
Storing, Sharing and Deleting Call Recordings
This is where I see the most exposure in small businesses, and it is almost never deliberate. It is drift. Someone turns on recording, nobody sets a retention rule, and three years later there are 40,000 audio files nobody has listened to sitting in a cloud folder with a shared password.
How long can you keep them?
The Privacy Act does not give you a number. It gives you a test: keep it as long as you have a lawful purpose, then get rid of it.
In practice, most NZ businesses land somewhere between 30 days and 12 months depending on what the recordings are for. Quality monitoring and coaching justifies a short window, usually 30 to 90 days. Recordings that form part of a contract or a verbal agreement need to last as long as the contract does plus a reasonable dispute window. Complaints and disputes justify keeping the specific recordings involved until the matter closes.
Write the retention period down. Put it in a one-page policy. Then automate the deletion so it actually happens, because a policy nobody enforces is worse than no policy; it proves you knew and did nothing.
Financial services and health providers have sector-specific record-keeping obligations that can override the “delete it early” instinct. If you are in either, check your own regulator before setting a schedule.
Who can listen?
Principle 5 says reasonable security. In a ten-person business, reasonable means: recordings live in one system, access is per-user not per-shared-password, and you can answer the question “who listened to this file and when?” if you are ever asked.
The most common failure I see is call recordings syncing to a general team drive because that was the easiest integration to set up. Once they are in a general drive, everyone has them, and the retention rule you wrote down does not apply because nobody knows the copies exist.
Offshore storage
Principle 12 covers sending personal information overseas. Most call systems store data in Australia, the US, or Europe. That is allowed, but you have to have reasonable grounds to believe the recipient protects the information to a comparable standard, usually satisfied by the provider’s contractual terms and their compliance certifications.
Practically: check where your provider stores recordings, get it in writing, and mention it in your privacy policy. Then move on. This is a five-minute job that people turn into a five-week project.
Access requests
If a caller asks for their recording, you have 20 working days to respond. You can refuse in limited circumstances, for instance where releasing it would breach another person’s privacy, but “it’s inconvenient” is not one of them.
The practical implication: you need to be able to find a specific caller’s recording quickly. If your recordings are named by timestamp and stored in an unsearchable folder, a single access request becomes a day of work. If they are attached to a contact record in your CRM, it is a two-minute job.
What Changes When an AI Is on the Call
Everything above applies to human calls. AI voice agents add a layer, and this is the area where the rules are moving fastest.
Disclosure that it is not a human
There is no NZ statute that specifically requires an AI voice agent to identify itself. But the Privacy Commissioner’s guidance on AI leans heavily on transparency, and the Fair Trading Act prohibits misleading and deceptive conduct in trade. An AI that lets a caller believe they are speaking to a human, when that belief affects how the caller behaves, is a misleading conduct risk regardless of what the Privacy Act says.
The practical standard I use on every voice agent I build: the AI says what it is in the first line. “Hi, you’ve reached the after-hours line for Smith Plumbing. I’m the AI assistant here, and I can take your details or book you in.” Nobody is surprised, nobody is annoyed, and the call proceeds normally.
Honestly, disclosure helps rather than hurts. Callers adjust their speaking style when they know, which produces cleaner data and fewer misunderstandings. The businesses that hide it get worse outcomes and carry the risk for nothing.
Two notices, not one
An AI call needs both: this is an AI, and this call is recorded. They can be one sentence. “I’m the AI assistant for Smith Plumbing, and this call is recorded so nothing gets missed.” That covers both obligations in eleven words.
The recording is doing more work now
With a human call, the recording is usually a record. With an AI call, the recording is often being transcribed, analysed, summarised into a CRM note, and used to trigger follow-up. That is more processing, which means your purpose statement needs to be wider and more honest, and your storage arrangements need to account for the transcript as well as the audio. A transcript is personal information too.
Training on recordings
If you or your provider intend to use recordings to train or fine-tune models, that is a different purpose and it needs to be disclosed specifically. Most decent enterprise voice providers let you switch training off contractually. Check your provider’s terms rather than assuming. This is the single most common gap I find when auditing a business’s existing call setup.
Sensitive information
If your calls routinely collect health information, financial details, or information about children, the bar rises. Health information sits under the Health Information Privacy Code with its own rules. A dental practice running an AI receptionist is in a different position from a plumber, and needs to think harder about what the AI is allowed to ask and record.
We built the voice side of this for a dental client, Dr Claire, whose practice was missing close to half its inbound calls despite two receptionists. The AI receptionist took missed calls to zero, and booked appointments went up 44%. The compliance work took about an hour: purpose statement, disclosure line, retention window, done. It was not the hard part. The hard part was deciding what the AI should say when a patient asks a clinical question, which is a judgment call, not a legal one.
Building a Call Recording Setup That Stays Compliant Without Effort
Compliance fails when it depends on someone remembering. The fix is to make the compliant path the automatic one.
Put the announcement in the system, not in the script
If the recording notice lives in a script your team is supposed to read, it will be skipped on busy days. Put it in the phone system as an automated greeting or in the AI agent’s opening line, and it happens on every single call, whether anyone is paying attention or not.
Attach recordings to the contact, not to a folder
A recording sitting in a dated folder is an access request waiting to become a bad afternoon. A recording attached to the contact record in your CRM is findable in seconds, deletable in seconds, and inherits whatever access controls you have already set up for contacts. Everything I build for clients works this way, because it turns three separate compliance problems into one solved problem.
Automate the deletion
Set the retention window in the system itself. Ninety days, twelve months, whatever you have decided and documented. Then let it run. Manual deletion is a task that will sit on a list until it is a liability.
Write the one-page policy
Not a legal document. One page covering: what gets recorded, why, who can access it, how long it is kept, where it is stored, and how someone requests a copy or a deletion. Put it on your website as part of your privacy policy. It takes an hour, and it is what you point at when someone asks.
Review it once a year
Systems change. The tool you set up in January might sync recordings somewhere new by November because of a feature update nobody read the release notes for. A yearly check of “where do our recordings actually live now” catches the drift.
Every one of those is a small, boring, one-time job. Together they mean the question “are we compliant?” has a written answer instead of a shrug. And the compounding benefit is that a business where every call is recorded, transcribed, attached to a contact, and searchable is a business where the knowledge no longer lives only in the founder’s head. That is worth more than the compliance tick.
The Bigger Point
The legal answer is genuinely simple. You can record calls you are part of. You have to tell people. You have to look after the recordings and get rid of them when you are done. If an AI is on the call, say so.
What I notice is that the legal question, including “is it legal to record calls NZ,” is rarely what is actually stopping people. It is the proxy for a bigger hesitation about putting an AI on the phone at all. The compliance work is an hour. The real question is whether the business is set up so that a recorded, transcribed, automatically-filed call actually makes the operation better, or just adds another pile of files nobody looks at.
That comes down to whether your calls feed into something. When a call recording lands as a summarised note on the right contact, triggers the right follow-up, and is searchable a year later, the phone stops being a leak in the business and starts being an input. That is the difference between a business with an AI tool bolted on and a business with an AI brain and an AI workforce actually running things.
If you are weighing up call recording, an AI receptionist, or after-hours answering, the compliance side is solvable in an afternoon. The part worth thinking about is what happens to the information once you have it.
Talk It Through
If you are thinking about recording calls or putting an AI on your phone line and want to know what it would actually look like in your business, book a 30-minute Discovery Call. No pitch deck. We go through what your phone is doing now, where the calls are going, and what could be handled without you.
Worth reading next: after-hours call answering covers what happens to the calls that come in when nobody is there, and AI appointment booking walks through how a recorded call turns into a booking without anyone touching a calendar. If you are earlier in the process, AI automation for business is the wider picture.
Frequently Asked Questions
Is it legal to record a phone call in NZ without telling the other person?
Under the Crimes Act 1961, it is lawful to record a call you are a party to without the other person’s permission, because New Zealand is a one-party consent country. However, if you are recording in a business context, the Privacy Act 2020 requires you to make people aware you are collecting their personal information. In practice, that means you should tell them, even though the Crimes Act does not force you to.
Can I use a recorded phone call as evidence in New Zealand?
Generally yes, if you were a party to the call and the recording was lawfully made. Courts and tribunals in New Zealand have accepted call recordings as evidence in employment and contract disputes. Recordings made by intercepting a conversation you were not part of are unlawful and are far more likely to be excluded. Admissibility is decided case by case, so get legal advice if a specific dispute is live.
How long can a business keep call recordings in New Zealand?
There is no fixed period in the Privacy Act. Principle 9 says you must not keep personal information for longer than is required for the purpose you collected it. Most businesses land between 30 days and 12 months depending on purpose. Recordings tied to contracts or active disputes justify longer retention. Write your retention period down, then automate deletion so the policy is actually followed.
Do I have to tell callers a recording is being made by an AI?
There is no specific New Zealand statute requiring AI disclosure on calls, but the Fair Trading Act prohibits misleading conduct, and the Privacy Commissioner’s AI guidance emphasises transparency. Letting someone believe they are speaking with a person when they are not is a real risk. Best practice is a single opening line covering both points: that the caller is speaking with an AI assistant, and that the call is recorded.
Can a customer ask for a copy of their call recording?
Yes. Under privacy principle 6, an individual can request the personal information you hold about them, and a call recording of that person qualifies. You generally have 20 working days to respond. You can withhold in limited circumstances, such as where release would breach someone else’s privacy, but inconvenience is not a valid reason. Store recordings so a specific caller’s file can be found quickly.
What are the penalties for illegally recording a call in New Zealand?
Intentionally intercepting a private communication you are not a party to is an offence under section 216B of the Crimes Act 1961, carrying up to two years’ imprisonment. Privacy Act breaches follow a different path: complaints go to the Privacy Commissioner, and serious cases can reach the Human Rights Review Tribunal, which can award damages. Failing to notify a serious privacy breach is itself an offence with a fine.
Do I need a privacy policy if I record business calls?
You are not strictly required to publish a privacy policy, but principle 3 requires you to tell people what you collect, why, who sees it, and how they access it. A published privacy policy is the simplest way to meet that consistently. One page covering what is recorded, the purpose, access, retention period, storage location and how to request a copy or deletion is enough for most small businesses.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.