General information only. This is not legal, clinical, workplace or privacy advice. Recording law differs across Australia and professional duties can be stricter. Use a qualified adviser for the actual organisation and recording.
1. Decide whether to record
Start with purpose. What record is needed, why is audio needed, who will use the transcript and could a non-recording method do the job? A transcription tool should not become the default merely because it is available.
In NSW, section 7 of the Surveillance Devices Act 2007 generally restricts using a listening device to record a private conversation. The Act contains exceptions, including consent and narrow circumstances for a party to the conversation. Other states and territories draw their rules differently, and Commonwealth telecommunications law may also matter.
LocallyAI's conservative business default is express consent from every principal participant before recording starts. Do not treat that default as a complete statement of the law. It is a safer operating rule for ordinary business transcription.
2. Give a useful notice
A person should know:
- who is making the recording and why;
- whether audio, video, screen content or only a transcript is created;
- who can access the recording, transcript, summary and actions;
- which outside services or countries are involved;
- how long each item is kept and how deletion works; and
- what non-recording option is available.
Record the consent event lawfully. Do not secretly start the main recording to capture somebody agreeing to it. For health practitioners, Ahpra's AI guidance recommends informed consent and noting the patient's response in the health record.
3. Map privacy collection and use
First check whether the Privacy Act 1988 and Australian Privacy Principles apply to the organisation and activity. Many private health service providers are covered even below the usual small-business turnover threshold. State health-privacy law and professional rules may also apply.
Where it applies, APP 5 deals with notifying people about collection. APP 6 limits later use or disclosure. Consent to make a transcript is not automatically consent to train a model, assess an employee, publish a recording or use it for a new purpose.
4. Check every overseas recipient
If an APP entity discloses personal information to an overseas recipient, APP 8 generally requires reasonable steps before disclosure. Section 16C can make the Australian entity accountable for some overseas-recipient conduct. Exceptions and technical distinctions apply.
Ask the vendor where audio, transcript, generated notes, logs and backups are processed and stored. Ask which sub-processors can access them, whether content can train or improve models, and what the contract says about deletion. The data-location guide turns that into four written questions.
5. Set security and retention separately
APP 11 requires reasonable protection and, in relevant circumstances, reasonable steps to destroy or de-identify personal information no longer needed for a permitted purpose. Other laws can require records to be kept, so “delete everything” and “keep everything” are both poor defaults.
Choose separate periods for raw audio, transcript, approved note, consent record, access log and backup copies. Record who can change them, how a withdrawal request is handled and when a legal hold or dispute may require retention.
6. Treat the output as a draft
Speech systems can miss names, numbers, negation, accents, specialist terms and speakers. A summary can omit context or add a conclusion that was not said. A transcript is not automatically verbatim, complete or agreed.
Important passages should be checked against the recording where it is lawful and retained, or confirmed with participants. A qualified person remains responsible for material clinical, legal, financial, employment or business use.
Where local transcription helps
In the base offline LocallyAI configuration, recording, transcript and model inference can remain on the customer appliance. That can remove an outside recipient from this particular path.
It does not remove consent, notice, purpose, access, retention, accuracy or professional review. Web research, updates, external integrations, remote support and off-site fine-tuning are separate connection or data-handling exceptions and must be assessed on their own.
Checklist before pressing record
- Authority
- Law, state, sector and workplace setting checked.
- Notice
- Recorder, purpose, outputs, access, location and retention explained.
- Consent
- Clear response from every principal participant under the chosen policy.
- Alternative
- A workable non-recording path offered.
- Data flow
- Providers, countries, training terms and support access recorded.
- Retention
- Separate periods approved for audio, transcript, note, logs and backups.
- Review
- Named person checks important output before filing, sending or relying on it.
LocallyAI can answer technical questions about its recording and data paths. Legal and professional advice stays with the customer's qualified advisers.