BPO and Call Centre Agreement Lawyers Adelaide: Telemarketing, Call Recording, Customer Data and Staff
BPO and call centre agreements in South Australia
When a provider answers a business’s phones or calls its prospects, the law treats much of what the provider does as the business’s own conduct. Talon Legal advises Adelaide businesses that outsource customer service, sales and back-office processes, and the contact centres that serve them, on agreements that carry that risk properly. Book a same-day free 30-minute consultation or call (08) 7094 2021.
BPO and call centre agreement key facts
| Issue | Position in South Australia |
|---|---|
| Outsourced telemarketing | Making, or causing to be made, a telemarketing call to a number on the Do Not Call Register is prohibited unless an exception applies (Do Not Call Register Act section 11(1)). A business that contracts with a call centre is taken to cause the calls it makes (section 11(9)). |
| The contract clause | A telemarketing contract must expressly require the provider to comply with the Act and to take all reasonable steps so its staff and agents comply (section 12(1)). |
| No defence of ignorance | Contraventions of section 11(1) are of strict liability. A client that did not know of its telemarketer's failures still contravened, although no penalty was imposed (ACMA v V Marketing (No 4) at [64], [80]). |
| Calling hours | Telemarketing calls only between 9 am and 8 pm on weekdays and 9 am and 5 pm on Saturdays, not on Sundays or national public holidays (Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 section 8). |
| Emails and text messages | Sending, or causing to be sent, a commercial electronic message with an Australian link is prohibited unless the recipient consented or another exception applies (Spam Act 2003 section 16). |
| What staff say | Conduct on behalf of a company by an agent acting within actual or apparent authority is taken to be the company's conduct (Competition and Consumer Act section 139B(2)). |
| Phone sales | A consumer can end an unsolicited telephone agreement until the end of the 10th business day after receiving the agreement document (ACL sections 69 and 82). |
| Call recording in SA | Knowingly using a listening device to record a private conversation is an offence unless an exception applies, such as consent of all principal parties, express or implied (Surveillance Devices Act 2016 (SA) section 4). Maximum for a body corporate: $75,000. |
| Interception | Recording a call over a telecommunications system without the knowledge of the person making the communication is interception (Telecommunications (Interception and Access) Act 1979 sections 6(1) and 7(1)). |
| Customer data | A business holds personal information it controls (Privacy Act section 6(1)) and must take reasonable steps to protect it (APP 11.1). Offshore call centres add APP 8.1 and section 16C. |
| Staff | Outsourcing a contact centre, or bringing it back in house, can be a transfer of business that carries the employees' enterprise agreement across (Fair Work Act sections 311 and 313). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a BPO agreement lawyer in Adelaide?
Our BPO agreement lawyers in Adelaide act for businesses that outsource customer service, sales, collections, claims processing and other back-office work, and for the contact centres and business process outsourcing (BPO) providers that deliver it. A BPO agreement differs from infrastructure outsourcing because people deliver the service, talking to the business’s customers and handling their information. That brings in the Do Not Call Register Act 2006 (Cth), the Spam Act 2003 (Cth), the Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth), the Privacy Act 1988 (Cth) and South Australia’s Surveillance Devices Act 2016. This page states the law current to 24 October 2026.
This guide is part of our IT outsourcing, cloud and hosting practice. Related guides cover IT offshoring agreements, IT services and support agreements and data protection and privacy.
If a marketing agency runs your email or telemarketing campaigns, see our guide to agency and PR agreements.
Free Consultation. If the regulator has written about your call centre’s calls, call before you reply. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What should a BPO or call centre agreement cover?
- Is a business liable for its call centre's telemarketing calls?
- What must a telemarketing contract say?
- What about emails and text messages?
- Is the business responsible for what call centre staff say?
- Can a call centre record calls?
- Who is responsible for customer data the provider handles?
- What happens to staff when a contact centre changes hands?
- How should service levels and quality be measured?
- How should exit be planned?
- How similar matters tend to play out
- How we act on BPO agreements
- Case law
- Frequently asked questions
What should a BPO or call centre agreement cover?
The work, the standards, the compliance obligations and the customer relationship. The agreement should describe the processes the provider runs, the hours and channels it covers, the scripts and approvals it must follow, and the measures of performance. It should also say who owns the customer data, the call recordings and the scripts.
Compliance belongs in the body of the agreement, not a schedule nobody reads. A provider making outbound calls or sending messages for the business exposes the business to the Do Not Call Register Act, the Spam Act and the consumer law, and the business needs rights to audit, to stop a campaign and to end the agreement if compliance fails.
A BPO agreement lawyer will also ask where the work is done. A contact centre offshore raises the cross-border privacy rules covered in the IT offshoring agreements guide.
Is a business liable for its call centre’s telemarketing calls?
Yes, alongside the call centre. A person must not make, or cause to be made, a telemarketing call to an Australian number registered on the Do Not Call Register, unless the call is a designated call or the account holder consented (Do Not Call Register Act section 11(1) and (2)). A person who enters into a contract or arrangement with another person, who gives effect to it by making a telemarketing call, is taken to have caused the call to be made (section 11(9)).
The Federal Court applied those provisions in 2025. In ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287, a small solar installer had agreed with a telemarketing company that it would make telemarketing calls on the installer’s behalf ([25], [30]). Over seven months the telemarketer made 553,630 calls to numbers on the Register ([31]). By force of section 11(9), the installer caused those calls ([32]), and it admitted contravening section 11(1) ([34]).
The contraventions were of strict liability ([64]). What saved the installer from a penalty was its conduct. It had no knowledge of the inadequacy of the telemarketer’s washing procedures, and its responses to the regulator’s compliance warnings were found to be reasonable ([64]). The Court declared the contraventions but imposed no penalty on the installer ([80] and orders). The telemarketer, by then in liquidation, was ordered to pay $750,000 (orders).
Logan J made two warnings that every business using a call centre should note. Although a business may contract out telemarketing, that does not mean it has contracted out its exposure to penalties ([69]). And a business that keeps referring compliance letters to its contractor may reach a point where further referrals are not reasonable, and the only reasonable response is to terminate the contractor’s retainer ([70]).
What must a telemarketing contract say?
It must contain an express compliance provision. A person must not enter into a contract or arrangement under which the other party is reasonably likely to make telemarketing calls, some of them to numbers eligible for the Register, unless the contract contains an express provision that the other party will comply with the Do Not Call Register Act (section 12(1)). Where the other party’s employees or agents will make the calls, it must also agree to take all reasonable steps so that they comply.
The contravention occurs at signing. A business that engages a call centre on a short form or an email exchange without that provision has contravened section 12(1) before a single call is made. Almost every outbound campaign to Australian numbers meets the “reasonable likelihood” test.
The clause is the minimum. Section 11(1) does not apply where the number was on a list submitted to the Register for checking and, within the 30 days ending on the day of the call, the caller was told the number was not registered (section 11(3)). A well drafted agreement therefore requires the provider to wash its call lists within that 30 day window and keep records of the washes. It should also require the provider to honour calling hours and to report complaints and regulator correspondence immediately.
Calling hours are fixed by industry standard. Telemarketing calls must not be made on a weekday before 9 am or after 8 pm, on a Saturday before 9 am or after 5 pm, or on a Sunday, and not on national public holidays (Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 section 8).
What about emails and text messages?
The same pattern applies. A person must not send, or cause to be sent, a commercial electronic message that has an Australian link and is not a designated commercial electronic message (Spam Act section 16(1)). The prohibition does not apply where the relevant account holder consented to the message (section 16(2)). Commercial messages must also include accurate sender information (section 17) and a functional unsubscribe facility (section 18).
A business that engages a provider to run an SMS or email campaign is exposed if the provider’s list is not consent-based. The agreement should require the provider to prove consent for every address and number, to process unsubscribe requests promptly, and to stop on the business’s instruction.
The Privacy Act’s direct marketing rule steps back where these laws apply. An organisation must not use or disclose personal information for direct marketing unless an exception applies (APP 7.1). But APP 7 does not apply to the extent that the Do Not Call Register Act or the Spam Act applies (APP 7.8).
Is the business responsible for what call centre staff say?
Usually, yes. In a proceeding under the Australian Consumer Law, conduct engaged in on behalf of a company by an agent acting within the scope of their actual or apparent authority is taken to have been engaged in also by the company (Competition and Consumer Act section 139B(2)). A call centre agent selling the business’s products is acting on its behalf.
So a misleading statement by a call centre agent can be the business’s own contravention. Engaging in conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive, is prohibited (ACL section 18). Scripts, training, approval of any changes and call monitoring are how a business controls that risk.
Telephone sales to consumers carry extra rules. An agreement made with a consumer by telephone, where the supplier called uninvited and the price exceeds $100 or cannot be worked out when the agreement is made, is an unsolicited consumer agreement (ACL section 69(1)). The consumer can terminate it until the end of the 10th business day after receiving the agreement document (section 82). That period is longer where the supplier breached the rules on permitted calling hours, disclosing its purpose and identity, or stopping when asked (section 82, referring to sections 73 to 75).
Can a call centre record calls?
Yes, if the parties know. Two laws apply. Under South Australia’s Surveillance Devices Act, a person must not knowingly use a listening device to overhear, record or monitor a private conversation to which the person is not a party, or to record a private conversation to which the person is a party (section 4(1)). The maximum penalty for a body corporate is $75,000.
The main exception for call centres is consent. A party to the conversation may record it where all principal parties consent, expressly or impliedly, or where recording is reasonably necessary to protect that party’s lawful interests (section 4(2)(a)). A private conversation is one carried on in circumstances indicating that at least one party wants it heard only by the other parties (section 3). A principal party is a person by or to whom words are spoken (section 3).
Commonwealth law also applies to calls. Listening to or recording a communication passing over a telecommunications system, without the knowledge of the person making the communication, is interception (Telecommunications (Interception and Access) Act 1979 section 6(1)), and interception is prohibited (section 7(1)).
Both regimes turn on knowledge or consent. The usual practice of announcing at the start of each call that it may be recorded or monitored is how call centres deal with them, and outbound agents should say it too. The agreement should require the announcement, say who owns the recordings, and set how long they are kept and how they are secured, because recordings are personal information.
Who is responsible for customer data the provider handles?
The business, as well as the provider. An entity holds personal information if it has possession or control of a record containing it (Privacy Act section 6(1)). A business that can direct and retrieve its customer records still controls them when a contact centre handles them. It must take reasonable steps to protect the information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1).
In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, one reason the company had not taken reasonable steps was its overreliance on third party service providers, without adequate procedures of its own to detect and respond to incidents ([52]). The penalties totalled $5,800,000.
Where the contact centre is overseas, the business must take reasonable steps before disclosing personal information so the overseas recipient does not breach the APPs (APP 8.1). It can be liable for what the recipient does (section 16C). Where a breach is an eligible data breach of both the business and the provider, notification by one relieves the other of the statement and notification obligations (section 26WM).
What happens to staff when a contact centre changes hands?
It depends on who employs them afterwards. There is a transfer of business where an employee’s employment with the old employer ends, the employee is employed by the new employer within three months, the work is the same or substantially the same, and there is a connection between the employers (Fair Work Act section 311(1)). Outsourcing the work to the new employer is one connection (section 311(4)). Bringing outsourced work back in house is another (section 311(5)).
When it happens, an enterprise agreement or other transferable instrument that covered the old employer and the transferring employee covers the new employer and that employee for the transferring work (section 313(1)). A business insourcing a contact centre and hiring the provider’s agents may find itself covered by the provider’s enterprise agreement for those staff.
Where staff are not taken on, redundancy rules apply. A dismissal is not a genuine redundancy if redeployment within the enterprise, or an associated entity, would have been reasonable (section 389(2)). A decision to dismiss 15 or more employees for economic, technological, structural or similar reasons must be notified to Centrelink before any dismissal (section 530).
How should service levels and quality be measured?
By measures the business can verify. Typical measures include answer times, abandonment rates, first contact resolution, quality assurance scores against the script, and complaint rates. The agreement should say how each is measured, how the business can check the data, and what happens when a target is missed.
Service credits are fixed sums triggered by a failure. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]). Credits sized to the value of the service lost rarely raise the issue.
A provider’s standard terms with a small business customer are subject to the unfair contract terms laws. In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, unilateral variation, automatic renewal, liability limitation and termination payment terms in small business contracts were declared unfair by consent ([1] to [3] and orders). In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, a services supplier’s automatic renewal and unilateral price increase clauses created a significant imbalance ([56]). Since 9 November 2023, making a standard form contract that contains an unfair term the provider proposed, or relying on one, is a contravention (ACL section 23(2A) and (2C)).
How should exit be planned?
So the business’s customers do not notice it. The exit clause should require a transition period, return of customer data and call recordings in usable formats, handover of scripts and knowledge bases, transfer of any telephone numbers held in the provider’s name, and deletion once the transfer is confirmed.
Deletion is a legal obligation as well. An APP entity that no longer needs personal information for any permitted purpose, and is not required by law to keep it, must take reasonable steps to destroy or de-identify it (APP 11.2).
Ownership of scripts and materials should be written down. Copyright in a script written by the provider’s employees will generally belong to the provider as their employer (Copyright Act section 35(6)), unless assigned in writing and signed (section 196(3)). The provider also learns the business’s customer lists and processes. In Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21, the Full Court set out the elements of breach of confidence: information identified with specificity, with the necessary quality of confidence, received in circumstances importing an obligation of confidence, and misused, or threatened to be misused, without consent ([39]).
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. An Adelaide gym chain is about to outsource membership renewal calls to a contact centre under a two page agreement with no Do Not Call Register clause. The calls will go to Australian numbers eligible for the Register, so signing it as drafted would contravene section 12(1), even though most calls go to members. Adding the clause, a washing obligation and calling hours before signing avoids that.
Middle range. A home improvement business uses a lead generation call centre. Complaints and regulator warning letters start arriving, and the business forwards each one to the call centre for investigation. V Marketing shows the business is treated as causing the calls whatever it knew (section 11(9)), and that repeated referrals may stop being reasonable ([70]). Suspending the campaign and demanding the wash records is the safer course.
Upper range. A utilities retailer ends its outsourced contact centre contract and brings the work back in house, hiring 40 of the provider’s agents within weeks to do the same work. Insourcing is a transfer connection (section 311(5)), so the provider’s enterprise agreement covering those agents covers the retailer for that work (section 313(1)). Pay, rostering and the cost model need settling before the offers go out.
How we act on BPO agreements
We act for businesses that outsource and for contact centres and BPO providers. For a business, the aim is control over what is said and done in its name, compliance it can verify, ownership of its customer data and an exit its customers will not notice. For a provider, it is terms that allocate compliance clearly and survive the unfair contract terms test.
| Stage | What happens | What we do |
|---|---|---|
| Scoping | The business decides what processes and campaigns to outsource. | Identify telemarketing, spam, recording, privacy and staff issues. |
| Drafting | The BPO or call centre agreement is prepared or negotiated. | Draft compliance, washing, recording, data, service level, IP and exit terms. |
| Launch | Scripts, lists and recordings are set up. | Review scripts, consent records and recording notices. |
| Complaints | Complaints or regulator letters arrive. | Advise on the response, audit rights, suspension of the campaign and termination. |
| Transfer | Staff move to or from the provider. | Advise on transfer of business, enterprise agreements and redundancy. |
| Exit | The contract ends or the work comes back in house. | Enforce data, recording, number and script handover and deletion. |
We cannot promise an outcome, and no lawyer can. We can make sure the business controls what its provider does in its name.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
BPO and call centre case law
V Marketing concerned an outsourced telemarketing arrangement, and Fujifilm and JJ Richards concerned suppliers’ standard terms. The other decisions deal with the data security, penalty and confidentiality points that every BPO agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287 | Federal Court | Client taken to cause its telemarketer's calls; strict liability; no penalty given its reasonable conduct | [30] to [34], [64], [69], [70], [80] |
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on third party providers | [52] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Unfair terms in supplier contracts | [1] to [3] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Automatic renewal and price variation terms unfair | [56] to [58] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 | Full Federal Court | Elements of breach of confidence | [39] |
Case notes
ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287
A solar installer engaged a telemarketer that made 553,630 calls to numbers on the Do Not Call Register on its behalf ([30], [31]). Section 11(9) made the installer the cause of the calls, and it admitted contravening section 11(1) ([32], [34]). The contraventions were of strict liability, but the installer had no knowledge of the telemarketer’s failures and had responded reasonably to the regulator ([64]). Logan J declared the contraventions and imposed no penalty on the installer ([80] and orders), warning that outsourcing telemarketing does not outsource the exposure ([69], [70]). The telemarketer was ordered to pay $750,000 (orders).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers and the lack of adequate procedures of its own to detect and respond to incidents ([52]). Penalties of $5,800,000 were ordered by consent (orders).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The respondents supplied office equipment with associated software and ongoing support services ([1]). After mediation, Stewart J made consent declarations that ten categories of terms in their small business contracts were unfair and void ([3] and orders).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
A services supplier’s automatic renewal and unilateral price variation clauses created a significant imbalance in its small business standard form contracts ([56]). The supplier did not show the terms were reasonably necessary to protect its legitimate interests ([57] to [58]).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the late payment fee was a penalty ([69]).
Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21
The Full Court set out the four elements of breach of confidence in equity: specific identification, the necessary quality of confidence, receipt in circumstances importing an obligation of confidence, and actual or threatened misuse without consent ([39]).
Frequently asked questions
Is a business liable if its call centre calls numbers on the Do Not Call Register?
Yes. A business that contracts with a call centre is taken to have caused the calls it makes (Do Not Call Register Act section 11(9)). In V Marketing, a client that did not know of its telemarketer’s failures admitted contravening section 11(1), although no penalty was imposed ([34], [64], [80]).
What clause must a telemarketing contract contain?
An express provision that the provider will comply with the Do Not Call Register Act and, where its staff or agents make calls, take all reasonable steps so they comply. Entering into the contract without it is itself a contravention (section 12(1)).
What hours can telemarketing calls be made?
Between 9 am and 8 pm on weekdays and 9 am and 5 pm on Saturdays. Not on Sundays or national public holidays (Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 section 8).
Is a business liable for SMS or email campaigns run by a provider?
It can be. A person must not send, or cause to be sent, a commercial electronic message with an Australian link unless the account holder consented or another exception applies (Spam Act section 16).
Is a business responsible for what call centre agents tell customers?
Usually. Conduct on behalf of a company by an agent within actual or apparent authority is taken to be the company’s conduct for the Australian Consumer Law (Competition and Consumer Act section 139B(2)), so a misleading statement can be the company’s contravention of ACL section 18.
Can a consumer cancel a sale made over the phone?
If it is an unsolicited consumer agreement, yes. The consumer can terminate until the end of the 10th business day after receiving the agreement document, and longer if the supplier breached the rules on calling hours, disclosure or stopping on request (ACL sections 69 and 82).
Is it legal for a call centre to record calls in South Australia?
Yes, with consent. The Surveillance Devices Act 2016 (SA) prohibits knowingly recording a private conversation with a listening device unless an exception applies, including consent of all principal parties, express or implied (section 4). A clear recording notice at the start of the call is the usual way to obtain it.
Does Commonwealth law also apply to recording calls?
Yes. Recording a communication passing over a telecommunications system without the knowledge of the person making it is interception, which is prohibited (Telecommunications (Interception and Access) Act 1979 sections 6(1) and 7(1)).
Who is responsible for customer data a call centre handles?
The business, as well as the provider. A business holds personal information it controls (Privacy Act section 6(1)) and must take reasonable steps to protect it (APP 11.1). Overreliance on providers counted against the company in the Australian Clinical Labs case ([52]).
What happens to the agents if a contact centre is brought back in house?
If the business employs them within three months to do the same work, there is a transfer of business (Fair Work Act section 311(5)), and their enterprise agreement can cover the business for that work (section 313(1)).
Who owns the scripts a call centre writes?
Generally the provider, as the employer of the staff who wrote them, unless copyright is assigned in writing and signed (Copyright Act sections 35(6) and 196(3)). The agreement should deal with it.
Do I need a BPO agreement lawyer?
For any outsourced process that talks to customers or handles their data, yes. A BPO agreement lawyer can settle telemarketing compliance, recording, data and exit terms before the campaign starts. A free 30-minute consultation will tell you where you stand.