In short. When a company adopts a tool that records and transcribes meetings, informing participants is not enough: the organisation has to make a decision. This checklist lines up the ten checks to run before rollout: purpose and legal basis, records of processing, employment law, impact assessment, vendor and DPA, transfers outside the EU, retention, data-subject rights, speaker recognition and the AI Act. This is general information, not legal advice: adapt each point with your DPO or a lawyer.
Participant consent and what to say at the start of a call are covered separately in recording a meeting and the GDPR. Here we look at the company's side.
Why a company checklist
One employee recording a call so as not to miss details looks like a small thing. Multiplied across a team, it becomes an archive of hundreds of hours of voices, client names, figures and opinions. Under the GDPR the controller of that archive is usually the company, and the choices should be made before the tool spreads on its own.
The checklist
1. Written purpose and legal basis
Write down what transcription is for: minutes, handovers, project memory. For each purpose state the legal basis (legitimate interest, contract, consent). With employees consent is fragile, because it is rarely free in an employment relationship: legitimate interest with a documented balancing test is the usual route.
2. Updated records of processing
The records required by Article 30 of the GDPR must include the new processing: data categories (voice, transcripts, possibly client data), recipients, vendors, transfer countries and retention periods.
3. Employment law and works councils
Several EU countries regulate tools that can monitor employees. In Germany, the works council has co-determination rights over the introduction and use of technical devices designed to monitor employees' behaviour or performance (section 87(1)(6) of the Works Constitution Act). In Italy, article 4 of the Workers' Statute requires a union agreement or labour-inspectorate authorisation for tools that also allow remote monitoring of workers' activity.
A system that records and archives internal meetings can fall under these rules, especially if transcripts are available to whoever evaluates staff. Check before rollout, not after.
4. Data protection impact assessment (DPIA)
National DPIA lists often cover this case. The Italian supervisory authority's list (decision no. 467 of 11 October 2018), for example, includes processing in the employment context through technology that allows remote monitoring of employees, and processing with innovative technology such as AI systems and voice scanning when at least one other risk criterion applies. An AI notetaker used systematically with employees will rarely escape both.
5. Vendor and DPA
The tool's vendor is a processor: you need an agreement under Article 28 of the GDPR (the DPA). Check at least:
- the list of sub-processors and how you are told when it changes;
- security measures (encryption at rest and in transit, access control, logs);
- a commitment not to use your content to train models;
- what happens to the data when the contract ends.
6. Transfers outside the EU
Ask which country stores the audio, transcripts and summaries, and where the AI models that process them run. If data goes to the US or elsewhere, check the legal mechanism (adequacy decision, Data Privacy Framework, standard contractual clauses) and include it in your privacy notice. Keeping everything in the EU simplifies records, notices and the DPIA.
7. Retention and deletion
Set different periods for different things: audio helps check the transcript in the first days, minutes may be needed for years. A tool that deletes audio automatically after a set number of days makes the rule enforceable without relying on anyone's memory.
8. Data-subject rights
Anyone who speaks in a meeting can ask for access, correction or erasure. Check that the tool lets you find the meetings a person appears in, export them and delete them if needed. Decide who in the company answers these requests.
9. Speaker recognition
Many tools attribute sentences to speakers. If they do it by building a voiceprint to recognise a person across meetings, those models may be biometric data processed to identify someone, a special category of data under Article 9 of the GDPR. Ask the vendor how it works, where voice profiles are stored and whether you can turn them off.
10. AI Act: no emotion analysis
Since 2 February 2025 the AI Act prohibits AI systems that infer people's emotions in the workplace and in education, except for medical or safety reasons. Some notetakers offer "sentiment" or engagement scores for participants: with employees, check what data they rely on and, when in doubt, switch them off.
The checklist at a glance
| Check | Owner | Document |
|---|---|---|
| Purpose and legal basis | Controller with the DPO | Legitimate-interest assessment |
| Records of processing | DPO or privacy team | Article 30 records |
| Employment law | HR and employment counsel | Works-council or union agreement |
| Impact assessment | DPO | DPIA |
| Vendor | Procurement and legal | Article 28 DPA |
| Transfers | Legal | Privacy notice, clauses or adequacy |
| Retention | IT and DPO | Retention policy |
| Data-subject rights | Privacy team | Response procedure |
| Speaker recognition | IT and DPO | Vendor fact sheet |
| AI Act | IT and legal | List of enabled features |
How the right tool helps
No tool does compliance for you, but it can make every point simpler. Diurna, for example, records from the computer (Mac or Windows) without a bot, can work on the computer alone without sending anything, keeps cloud data on servers in Spain and Germany, deletes audio after the number of days you choose and does not use your meetings to train models. Details are on Diurna privacy; local versus cloud processing is compared in local or cloud transcription.
Frequently asked questions
Do we always need a DPIA to transcribe meetings?
Not always, but often. If the tool is used systematically with employees, relies on AI or recognises people by their voice, you easily meet the criteria in national DPIA lists. Your DPO is the right person to decide.
Is participant consent enough?
For employees consent is rarely the right basis, because in an employment relationship it is not considered fully free. A privacy notice is still required, and so is a check of national employment law.
Are transcripts personal data like audio?
Yes. A transcript contains names, opinions and information about identifiable people. The same rules on retention, access and security apply.
Is an app that transcribes only on the computer outside the GDPR?
No. Processing still happens; the risks change. Without sending data to external servers you have fewer vendors, no transfers and a smaller attack surface, and many checklist items become simpler.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 9, 28, 30 and 35.
- Italian Garante, decision no. 467 of 11 October 2018 and Annex 1, list of processing subject to a DPIA (Italian).
- Works Constitution Act (Germany), section 87, English translation.
- Italian Workers' Statute (Law 300/1970), article 4 (Italian).
- AI Act, Article 5, prohibitions applicable from 2 February 2025.