In short. A person's voice is personal data: if you record a meeting you process personal data and, in a professional setting, the GDPR and other rules come into play. The questions to ask are always four: why am I recording (purpose), on what basis (consent or another legal basis), who has been informed (privacy notice), and where and for how long the recording stays (retention and providers). This article offers general information, not legal advice: for a concrete situation ask a lawyer or your data protection officer.
Why recording is data processing
The GDPR (EU Regulation 2016/679) applies to any operation on personal data, including recording and transcribing voices. A meeting can contain, besides names and voices, information about clients, colleagues, health, finances. That alone is reason for a minimum of method.
The first point is understanding your role. If you record for work, the data controller is usually the organisation, not you personally: the rules must be agreed with whoever handles that in the company. If you record for strictly personal use (for example a private call), the GDPR does not apply in the same way, but other rules on confidentiality and on sharing content stay relevant.
The four elements to clarify
1. Purpose
Write down what the recording is for: "writing the minutes and checking decisions", not "for whatever we need". Data must not be reused for purposes incompatible with the declared one. If today you record for the minutes, tomorrow you cannot use the same audio to, say, evaluate people's performance without a fresh assessment.
2. Legal basis
Processing requires a legal basis among those the GDPR provides. In meetings you mostly meet:
- participants' consent, which must be free, specific, informed and revocable;
- the controller's legitimate interest, to balance against people's rights;
- contract performance or a legal obligation, in particular cases.
Mind the employment relationship: where there is a power imbalance (employer and employee) consent may not count as genuinely free, and there are specific rules on remote monitoring. If you record people who work for you or with you in a structured way, get advice.
3. Privacy notice
Recorded people must know, clearly, who processes the data, why, for how long, who it is shared with, whether it is transferred outside the European Union, and how to exercise their rights (access, erasure, objection and others). In a practical meeting that means two things:
- a notice at the start, spoken and possibly written (in the invite, in chat);
- a full notice available to whoever asks, or sent beforehand.
4. Retention and security
Keep the recording only as long as the purpose needs. If the audio serves to write the minutes, after a few days the minutes alone may suffice. Protect files: limited access, encrypted disk, no random email forwards.
What to say at the start of a meeting
A simple formula, to adapt:
"Before we start: I am recording this meeting to write the minutes. The audio will be kept for [time] and seen only by [who]. Anyone who disagrees can say so now or write to me in chat and I will not record their part. Full information is here: [link]."
Then record that the notice was given and nobody objected. And respect objections: if a person refuses, the correct choice is usually not to record, or to record only what does not concern them.
Checklist before recording
- Do I know why I record, and have I written it down?
- Do I have a legal basis (and if it is consent, can I prove it)?
- Were participants informed beforehand, not only once the meeting started?
- Have I decided how long to keep audio and text?
- Do I know where files end up (computer, shared folder, a provider's server)?
- If you use an external provider, is there a contract governing the processing?
- Do I have a way to handle access or erasure requests?
- Does the meeting concern special data (health, union, opinions)? Then more caution is needed and a professional should be consulted.
Where data ends up: the questions to ask
The often underestimated point is the data's path. Ask yourself:
- Where is it recorded? On your computer, on the call platform's cloud, on a note service's servers.
- Where is it transcribed? On the device or on an external service. In the latter case, in which country?
- Who is the provider and under what contract? If a provider processes data on your behalf, an agreement on processing (the so-called DPA) is generally needed.
- Outside the European Union? Transferring data to third countries requires specific safeguards.
- How long does it keep it? And does the provider use data to train its models? Look for the answer in the documentation, not in promotional material.
- How do you delete it? If you cannot delete, you cannot answer an erasure request.
A comparison of local and cloud processing, with pros and cons, in local or cloud transcription.
Frequent mistakes
- Recording "just in case", without a precise purpose.
- Treating the silence of late joiners as consent.
- Keeping files forever in the Download folder.
- Sending the recording to people who were not there without covering it in the notice.
- Using free services without reading where data ends up.
- Confusing consent to record with permission to publish.
Frequently asked questions
Must I always ask for consent to record a meeting?
Not necessarily: consent may not be the only possible basis, but in practice it is the most used and the easiest to demonstrate. A privacy notice is needed in any case. For your case ask a professional.
Is saying "this meeting is being recorded" enough?
It is a good start, but alone it is often not enough: you also need purposes, retention times, recipients and the rights of those concerned, at least in an accessible notice.
Can I secretly record a conversation I take part in?
The rules on this are delicate and change depending on whether the purpose is personal, professional or legal defence, and on how the content is then used. Not a topic for a general rule: ask a lawyer.
Are people joining from home protected the same way?
Yes: processing concerns the person, not the place. But remember that participants may have other people at home who end up in the audio.
How long can I keep the recording?
As long as the declared purpose needs. Set a deadline and respect it.
Are transcripts personal data like audio?
Yes: a text containing names, opinions and information attributable to people is personal data, even without the audio. The same reasoning on purpose and retention applies.
Sources
- Regulation (EU) 2016/679, text on EUR-Lex.
- Garante per la protezione dei dati personali, for updated notices and decisions.