Recording Customer Calls in New Zealand: Consent Guide

Recording customer calls can be genuinely useful for staff training, quality checks and resolving disputes. The risk is that many businesses turn recording on in their phone system before working out what customers have been told, where the files go, who can listen to them and how long they are kept.

Common mistakes include playing a vague message after the recording has already started, using calls later for marketing or AI analysis without saying so, and treating recorded calls as ordinary admin files rather than personal information. These gaps can create Privacy Act 2020 issues, customer complaints and messy access requests.

A practical call recording setup in New Zealand usually needs clear notice, a lawful purpose, sensible retention rules and a process for handling access or correction requests. Your goal is to decide what to say at the start of a call, what to put in your privacy policy and data retention policy, and how to manage recordings once they exist.

Call Recording Compliance Checklist For NZ Businesses

Customer call recordings are personal information when an identifiable person can be heard, named or linked to the call record. That means the Privacy Act 2020 will usually apply to customer service call recording in New Zealand, even if your business only records for internal quality assurance.

The core question is not only whether recording a phone call is allowed. A business should also ask whether the recording is necessary, whether customers are told enough, whether staff have access controls, and whether the recording is later used in a way the customer would not expect.

For most SMEs, a workable call recording privacy checklist looks like this:

• Define the purpose: training, quality assurance, complaint handling, transaction verification, safety or another specific business reason.
• Tell customers before or at the start of recording: use a short script that explains the recording and gives a practical alternative where possible.
• Limit what you collect: avoid recording payment card details, health information or unnecessary sensitive information unless there is a clear reason and suitable controls.
• Update your privacy policy: explain that calls may be recorded, the purposes, storage practices, disclosures and rights of access and correction.
• Control staff access: limit listening rights to managers, quality reviewers, complaint handlers and authorised support staff.
• Set retention periods: keep recordings only for as long as needed for the purpose, then securely delete or de-identify them.
• Prepare for access requests: have a process for finding, reviewing and providing recordings or transcripts when a customer asks.
• Check suppliers: confirm where your call centre, VoIP, CRM or cloud provider stores recordings and what security protections apply.

The Privacy Act works through information privacy principles. For call recording, the most relevant principles are usually about collecting information for a lawful purpose, collecting information fairly, telling people why information is collected, keeping it secure, allowing access and correction, checking accuracy before use, retaining information only as needed, and limiting use and disclosure.

Those principles apply in ordinary business moments. A gym that records membership cancellation calls, a SaaS company that records onboarding calls, and a retailer that records delivery complaints all need to think about the same privacy lifecycle: notice, collection, storage, use, access and deletion.

Your NZBN, Companies Office details and trading name do not replace a privacy notice. Customers need to understand what happens to their personal information in the specific interaction, not just who owns the business. If the call is routed through a third-party call centre or offshore software platform, that should also be reflected in your privacy policy and supplier arrangements.

When Consent Is Needed For Customer Call Recording

A New Zealand business should usually get informed agreement before recording customer calls, even where the Privacy Act frames the issue as notice and fair collection rather than using the word consent for every situation. In practice, a clear call recording message and the customer's decision to continue the call will often be treated as implied consent.

Consent is strongest when it is informed, voluntary and current. A customer cannot make a real choice if the message is hidden in a privacy policy they never see, played after the call has already captured the sensitive part, or written in language that does not explain what recording is for.

For routine customer service call recording in NZ, many businesses use an automated message such as: This call may be recorded for training, quality assurance and dispute resolution. If you do not want your call recorded, please let us know and we can discuss another way to help.

That script does three useful things. It tells the customer recording may happen, states the main purposes, and offers a path if the customer objects. The alternative does not need to be perfect in every case, but it should be genuine where reasonably available, such as email support, live chat without recording, a callback on an unrecorded line or an in-store option.

Express consent may be a better choice where the call is likely to involve sensitive or unexpected information. For example, an allied health clinic, financial services provider, aged care provider or employment services business may collect details that customers would treat as highly personal. A spoken confirmation, such as Are you comfortable with us recording this call for the reasons I mentioned?, can reduce uncertainty.

Consent should also be refreshed if the purpose changes. A call recorded to resolve a billing dispute should not automatically be reused for marketing analysis, AI training, public testimonials, staff disciplinary action or a product demo. If you want to use call recordings for a new purpose, ask whether the customer was told about that purpose and whether it is closely related to the original reason for collection.

There are also staff privacy and employment considerations. Customer calls often capture the employee's voice, performance, conduct and workplace interactions. Employers should tell staff if their calls are recorded, why recordings are reviewed, who can access them and how recordings may be used in coaching, performance management or investigations. The Employment Relations Act 2000 duty of good faith can be relevant where monitoring affects employees, so a clear staff policy and consultation process can help avoid surprises.

Some businesses ask whether they can rely on a single line in their website privacy policy. That is usually not enough on its own for phone calls, because the customer may not have visited the website before calling. A privacy policy supports compliance, but the call itself still needs a clear notice at the point of collection.

Another common issue is inbound versus outbound calls. Inbound calls are often easier because you can play an automated notice before the customer reaches an agent. For outbound calls, the staff member should say early in the call that it is being recorded and explain why. If the call has already begun recording for technical reasons, the business should avoid discussing personal details until the notice has been given and the customer has had a chance to object.

Consent can also become unclear where the person on the phone is not your direct customer. A receptionist, family member, tenant, employee or delivery driver may be speaking about another person's account. Your process should avoid collecting more information than needed and should include identity checks before discussing account details.

What Your Call Recording Notice Should Say

A good call recording notice tells the customer what is happening, why it is happening and what options they have. The best notices are short enough to be understood at the start of a call, but specific enough to satisfy privacy notice expectations under the Privacy Act.

Under the Privacy Act 2020, when an agency collects personal information from an individual, it will generally need to take reasonable steps to make the person aware of key matters. For call recording, those matters usually include the fact of recording, the purpose of collection, who will hold the information, possible recipients, whether providing information is required or voluntary, consequences if they do not provide it, and their rights to access and correct personal information.

You do not need to recite every privacy policy detail in an IVR message. The phone script can give the essential points, while your privacy policy gives fuller information. The script and privacy policy should match. If the call message says recordings are only for training, but the privacy policy says recordings may be used for analytics, dispute handling and service improvement, customers may be confused about the real purpose.

Here are examples for common business situations:

• General customer service:This call may be recorded for training, quality assurance and to help resolve customer enquiries. If you do not wish to be recorded, please tell us and we can discuss other contact options.
• Complaint or dispute team:We record calls to keep an accurate record of complaints, decisions and follow-up actions. The recording will be handled in line with our privacy policy.
• Outbound sales or onboarding:I am calling from [Business Name]. This call may be recorded for training and to confirm what we discuss today. Are you happy to continue on that basis?
• Sensitive service environment:Before we continue, I want to let you know this call is recorded for service quality and record-keeping. You can ask us to stop recording or use another contact method where available.

Businesses should avoid scripts that are too broad. A phrase like calls may be recorded for business purposes does not give much meaningful information. A phrase like we may use recordings for any purpose we consider appropriate is likely to damage trust and may not align with fair collection expectations.

Staff also need a fallback script for objections. A customer may say, I do not consent to being recorded, or ask whether recording can stop. If your team does not know what to do, they may continue collecting information in a way that creates risk.

A practical objection process might include:

1. Pause discussion of personal or account information.
2. Explain why the business records calls and what the recording is used for.
3. Offer a realistic alternative, such as email, web form, unrecorded callback or written complaint process.
4. If recording is essential for that particular service, explain the consequence clearly and politely.
5. Record the customer's preference in the CRM without adding unnecessary commentary.

Some calls genuinely cannot proceed without a recorded confirmation. For example, a business may require a recorded authorisation for certain account changes, a cancellation instruction or a high-value order. If that is the case, the customer should be told that the recording is required for that transaction and what will happen if they choose not to continue.

The Fair Trading Act 1986 can also be relevant to how you describe recording practices. If your call message, website or terms say recordings are used only for quality assurance, but you use them for sales profiling or AI model training, that inconsistency may create misleading conduct concerns as well as privacy issues.

Keep the script easy for staff to say naturally. A legally dense paragraph can become useless if agents rush through it or skip it when call queues are busy. Test the script with real staff, check that it works for inbound and outbound calls, and include it in training materials for new starters.

Storage, Access Requests And Privacy Policy Updates

Recorded calls should be managed as controlled business records, not as casual audio files. Once your business has captured a customer's voice and personal details, the Privacy Act expects you to protect it, use it for the stated purpose and deal properly with requests from the person concerned.

Security starts with knowing where recordings are stored. Many New Zealand businesses use VoIP systems, cloud contact centre tools, CRM integrations, outsourced reception services or offshore support teams. Recordings may sit in more than one system, and copies may be attached to tickets, downloaded by managers or exported for training.

Your business should be able to answer these questions:

• Which systems create, store or copy call recordings?
• Are recordings stored in New Zealand or overseas?
• Which staff roles can listen to, download, delete or share recordings?
• Are access logs available if a customer complains about misuse?
• Are recordings encrypted or protected by appropriate technical safeguards?
• Can recordings be deleted according to a retention schedule?
• What happens to recordings if you change phone providers?

Information Privacy Principle 5 deals with storage and security of personal information. For a small business, reasonable safeguards may include role-based access, multi-factor authentication, staff confidentiality obligations, audit logs, download restrictions and clear internal rules, such as an acceptable use policy, about when recordings can be shared.

Retention is just as important as security. Information Privacy Principle 9 says personal information should not be kept for longer than required for the purposes for which it may lawfully be used. A business that keeps every customer call forever because storage is cheap may struggle to justify that approach.

Retention periods should match your business needs. Training snippets may only be needed for a short coaching cycle. Complaint recordings may need to be kept until the complaint is resolved and any reasonable follow-up period has passed. Transaction confirmations may need to be kept for longer if they support account management, warranty issues or contractual records.

Access requests are another area where businesses get caught out. Under the Privacy Act, individuals can request access to personal information about themselves. A call recording that captures their voice, account details or complaint will often fall within that right.

Your process should explain who receives access requests, how the business verifies identity, how recordings are located, and how third-party information will be handled. A recording may include the voices or personal information of employees, other customers or family members. You may need to review the recording, provide a transcript, redact parts, or consider whether any withholding grounds apply.

Customers can also ask for correction of personal information. In the call recording context, that may not mean editing the audio file. It might mean adding a note to the account that the customer disputes a statement, correcting a CRM summary, or updating inaccurate contact details captured during the call.

Your privacy policy should be updated before or when call recording begins. It should use plain English and cover:

• that your business may record inbound and outbound customer calls;
• the purposes, such as training, quality assurance, record-keeping, complaint handling and transaction verification;
• the types of information that may be captured during calls;
• who may access recordings within the business;
• service providers who may store or process recordings, including offshore providers where relevant;
• how long recordings are usually kept, or the criteria used to decide retention;
• how customers can request access or correction; and
• how customers can contact your privacy officer or privacy contact.

Every New Zealand agency must have a privacy officer. For a small business, this may be an owner, operations manager or senior administrator. The person does not need a special title, but they should know how to respond to privacy queries, access requests and suspected privacy breaches.

Privacy breaches involving call recordings can happen in ordinary ways. An agent emails a recording to the wrong customer. A manager downloads calls to a personal device. A recording containing payment details is saved in an unsecured folder. A former employee keeps access to the phone system after leaving.

If a privacy breach is likely to cause serious harm, the Privacy Act has mandatory notification requirements. That can mean notifying the Privacy Commissioner and affected individuals. Strong access controls and deletion practices reduce the chance that a simple mistake becomes a serious incident.

Payment information needs special care. If customers read card details over the phone, avoid storing those details in recordings where possible. Many businesses pause recording during payment, use a secure payment link or route customers to a payment system that does not expose card data to staff. This is both a privacy issue and a commercial security issue.

AI tools add another layer. Some call platforms now transcribe calls, score sentiment, summarise complaints or use recordings to train models. If you use these features, your privacy notices, AI governance policy and supplier contracts should reflect what the technology does, where data goes, whether humans review it, and whether recordings are used to improve the provider's systems.

FAQs

Do New Zealand Businesses Need Consent To Record Customer Calls?

In most customer-facing situations, businesses should tell customers before recording and get their agreement to continue. That agreement may be implied if the customer hears a clear notice and stays on the call, but express consent is safer for sensitive calls or unexpected uses.

Is A Call Recording Personal Information Under The Privacy Act 2020?

Yes, if the recording identifies a person or can reasonably be linked to them. A customer's voice, name, account details, complaint history and contact information can all be personal information.

Can We Record Calls For Training And Later Use Them For Marketing?

Not automatically. If customers were told recordings were for training or quality assurance, using them for marketing, testimonials, profiling or AI training may require a new notice and consent, depending on the circumstances.

How Long Should Customer Call Recordings Be Kept?

There is no single retention period for every business. Keep recordings only as long as needed for the purpose, such as training, complaint management, transaction evidence or account administration, then securely delete or de-identify them.

What If A Customer Asks For A Copy Of A Recorded Call?

Treat it as a Privacy Act access request. Verify the customer's identity, locate the recording, review whether other people's information is included, and decide whether to provide the audio, a transcript or relevant extracts.

Key Takeaways

• Call recordings are usually personal information, so the Privacy Act 2020 affects how NZ businesses collect, use, store and delete them.
• A clear notice at the start of the call is the safest baseline, and express consent is worth using for sensitive or unexpected recording practices.
• Your call recording script should match your privacy policy and explain the main purposes, such as training, quality assurance, complaint handling and record-keeping.
• Storage controls matter. Limit access, check cloud and call centre providers, set retention rules and prepare for privacy breach scenarios.
• Customers can request access to recordings and correction of related personal information, so your team needs a practical response process.
• Employee privacy should not be overlooked, as recorded calls can also capture staff performance and workplace information.

If your business is setting up customer service call recording in New Zealand, Sprintlaw can help with your privacy policy, call recording scripts, staff monitoring policy and supplier contract privacy clauses. Contact our legal team on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.