Core Compliance Principles (Australia-Wide)
Before diving into industry specifics, all AI communication solutions must adhere to foundational Australian laws. These principles apply across all sectors and form the baseline for your compliance strategy. Your use of Australian-hosted cloud and service providers is a critical first step.
Privacy Act 1988
Governs the handling of personal information. Key obligations include securing data, being transparent about data use (via a privacy policy), and adhering to the Australian Privacy Principles (APPs). Handling 'sensitive information' (like health data) has even stricter requirements.
Spam Act 2003
Regulates unsolicited electronic messages. All commercial SMS and emails require express or inferred consent from the recipient, must accurately identify the sender, and include a functional unsubscribe mechanism. Penalties for non-compliance are severe.
Telecommunications/Calling Rules
Includes rules around call recording and telemarketing. The Do Not Call Register must be checked before making unsolicited calls. Recording calls generally requires the consent of all parties, often fulfilled by an upfront notification message.
Industry-Specific Deep Dive
Select an industry to explore its unique compliance landscape. The requirements listed below are in addition to the core principles mentioned above. Note how data sensitivity dramatically increases obligations.
Compliance Risk Overview
This chart provides a comparative overview of the regulatory strictness for key features across industries. Higher bars indicate more complex and stringent compliance obligations, requiring greater care in implementation. Use the filters above to highlight specific industries.
Foundational Privacy and Data Governance
- APP 3 (Collection): Collect only data reasonably necessary for functions. Sensitive information requires express consent and necessity.
- APP 5 (Notification): Notify at or before collection: identity, purposes, consequences, disclosures, access/correction, complaints, overseas disclosure.
- APP 6 (Use/Disclosure): Use only for the primary purpose or a related (directly related for sensitive data) expected purpose unless consented.
- APP 10 (Quality): Ensure accuracy, currency, completeness. STT accuracy and LLM output validation are legal obligations.
- APP 11 (Security): Reasonable steps: encryption in transit/at rest, RBAC/MFA, governance controls, vendor due diligence.
- APP 13 (Correction): Provide a correction mechanism.
Personal vs. Sensitive Information
- Personal information: Voice/audio and transcripts linked to identifiers.
- Sensitive information: Health info, beliefs, sexual orientation, criminal record. Requires express consent.
- AI inferences: New personal information collection (e.g., "distressed", "high-value lead"). Must meet APP 3/5/10.
Cross-Border Disclosure (APP 8)
Prefer Australian data residency. If any overseas access is possible (including support/sub-processors), bind recipients via enforceable contractual controls. Australian entities remain accountable for overseas recipients.
Security of Personal Information (APP 11)
- Technical: TLS 1.2+, AES-256, segmentation, IDS/IPS, secrets management, immutable audit logs.
- Access: RBAC/ABAC, least privilege, MFA, tenant isolation, zero-access options for provider staff.
- Governance: Policies, risk assessments, vuln scanning, pentests, NDB-aligned incident response.
- Vendors: Assess STT/TTS/LLM/cloud providers proportionate to sensitivity and risk.
Outbound Communications
Do Not Call Register Act 2006
- Wash lists against DNCR before campaigns; list validity is 30 days.
- Track wash dates; automatically block expired/unwashed lists.
- Capture evidence of consent (express or inferred) per contact; express is preferred.
- Liability applies to both caller and party who caused the call → embed controls and warranties in contracts.
Spam Act 2003
- Consent required; do not send messages just to request consent.
- Clear identification of the authorising entity with valid 30-day contact.
- Functional, low-cost unsubscribe (e.g., "Reply STOP"); honor within 5 business days; maintain suppression lists.
Call Recording and Transcription
TIA Act (federal): Participant recording outside the telecom network is generally not "interception"; state/territory laws govern recordings by participants.
| State/Territory | Governing Law | Default Rule | Key Nuances |
|---|---|---|---|
| NSW | Surveillance Devices Act 2007 | All-party consent | Narrow lawful-interests exception |
| VIC | Surveillance Devices Act 1999 | One-party consent | Publication/communication constraints |
| QLD | Invasion of Privacy Act 1971 | One-party consent | Restrictions on later use/communication |
| WA | Surveillance Devices Act 1998 | All-party consent | Narrow exceptions |
| SA | Listening & Surveillance Devices Act 1972 | All-party consent | Narrow exceptions |
| TAS | Listening Devices Act 1991 | All-party (default) | Lawful-interests exception |
| ACT | Listening Devices Act 1992 | All-party (default) | Protect lawful interests; not for disclosure |
| NT | Surveillance Devices Act 2007 | One-party consent | Restrictions on communication/publication |
Transcription is legally akin to recording; identical consent rules apply.
Industry-Specific Mandates
Healthcare
- Sensitive health information → express consent at call outset.
- Recordings/transcripts become clinical records: retention 7+ years (adults) / to age 25 (minors).
- Align to My Health Records Act expectations: granular access controls, strong audit, breach notification.
Financial Services
- ASIC recordkeeping: maintain advice records (recordings/transcripts) for at least 7 years.
- APRA CPS 234: demonstrate security capability; due diligence, audits, contractual assurances.
Legal
- Protect legal professional privilege; avoid third-party access that could waive privilege.
- Offer zero-access/client-managed encryption; strong tenancy isolation; detailed audit logs.
Technical & Operational Controls
- Data residency in Australia; contractual restrictions on overseas access.
- Consent orchestration: mandatory pre-call notice, capture consent artifacts, default all-party consent nationally.
- DNCR/Spam automation: washing, list expiry, consent metadata, identification injection, unsubscribe automation.
- Security engineering: encryption in transit/at rest, vault-based key management, WAF/IDS, rate limiting, structured audit logs.
- Access controls: RBAC/ABAC, MFA, SSO, customer-managed keys for high-sensitivity tenants, break-glass with approvals.
- Data lifecycle: purpose tags, sector-based retention, automatic deletion/de-identification.
- Accuracy & corrections: STT quality monitoring, human-in-the-loop, APP 13 workflows.
- Incident response: NDB-compatible playbooks, contact matrices, tabletop exercises, notification SLAs.
