Recording a Steering Committee: What Are the GDPR Rules?

You record your project steering committees to get a shared decision log? That's possible, but a steering committee brings together people from several entities: your team, the client, sometimes contractors.

It's this mix that complicates the framework more than the subject discussed.

Can you record a steering committee?

Yes, but not without regulating the processing.

A steering committee appoints managers, assigns deadlines, and discusses the work of identified individuals. It thus constitutes personal data processing under the GDPR.

You must notably:

• inform all participants before recording;
• distinguish your employees from external participants;
• determine a legal basis for each;
• define the purpose of the recording;
• limit retention duration;
• plan for people joining the project midstream.

Recording without the knowledge of those present also falls under the Penal Code, which punishes "with one year imprisonment and €45,000 fine the act, by any means, of intentionally infringing on another's privacy: 1° By capturing, recording, or transmitting, without consent, words spoken in private or confidential settings" (Article 226-1).

Is a steering committee recording personal data?

Yes.

The GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).

A nominative action log shared among multiple organizations is a full processing operation.

Transcription and minutes are also concerned.

Why does this type of meeting require special attention?

Because participants do not all belong to the same employer.

What applies to your employee does not apply to the client's project manager or the contractor's consultant. The common framework is detailed on the recording a professional meeting page.

You also perform several successive processes:

record → transcribe → draft → send to both teams → retain → delete.

What data is recorded?

Depending on the tool used, you may retain:

• session audio;
• transcription;
• participant names and organizations;
• date and duration;
• minutes;
• blocking points;
• actions and their owners.

---

Must participants be informed before recording?

Yes.

Information must be given before or at the time data is collected. The text requires it "at the time the data are obtained" (GDPR, Article 13, paragraph 1).

For recurring committees, the announcement is made at project start, then reminded at session openings.

What should you tell them?

The CNIL states that concerned persons "must be informed notably of: the existence of the system; the identity of the data controller; the purposes pursued."

You must be able to explain simply:

who records → why → who will receive the minutes → how long it is retained.

Should external participants be treated differently?

Yes.

They are covered neither by their employer's legitimate interest nor yours. Their consent must be explicitly obtained.

Should it be specified that AI drafts the minutes?

Yes.

Audio recording and subsequent AI processing are two operations worth distinguishing.

The European AI regulation states that "providers shall ensure AI systems intended to interact directly with natural persons are designed so that persons are informed they are interacting with an AI system" (Article 50, paragraph 1). These obligations apply since August 2, 2026, targeting the system provider; your obligation to inform comes from the GDPR and CNIL guidance.

You can, for example, announce:

"The session is recorded and an AI assistant automatically drafts the minutes, which circulate between our two teams."

What if the committee composition changes?

Inform each newcomer at their first session.

A steering committee changes composition over the project, and information follows arrivals.

---

Which legal basis to use for recording a steering committee?

Two legal bases may coexist in the same meeting.

No obligation to choose a single basis for all present.

Can legitimate interest be used?

Yes, for your own employees.

Article 6 of the GDPR allows processing "necessary for the legitimate interests pursued by the controller or a third party, unless overridden by the interests or fundamental rights and freedoms of the data subject" (paragraph 1, point f).

You must notably conduct a legitimate interests balancing test and inform participants.

Can consent be used?

Yes, and this applies to external participants.

Consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement" (GDPR, Article 4, point 11). The controller must also "be able to demonstrate that the data subject has consented" (Article 7, paragraph 1). This is the same mechanism as for a sales appointment and a site visit.

Should recording be mentioned in the service contract?

It's the simplest way to handle the issue once and for all.

This is addressed at project start rather than each session.

Can a participant object?

Yes, under GDPR conditions.

The data subject "has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them based on Article 6(1)(e) or (f)" (GDPR, Article 21, paragraph 1).

For those covered by legitimate interest, under the right to object. For others, consent can be withdrawn as easily as given.

---

How long to keep a steering committee recording?

As long as necessary for the purpose, no longer.

The GDPR requires data "kept in a form permitting identification of data subjects for no longer than necessary for the purposes" (Article 5, paragraph 1, point e).

For a project, this duration should be linked to a specific event.

How long to keep audio?

For work call recording and listening, the CNIL states "recordings may be kept up to six months maximum."

Once minutes are validated, audio generally has no further use.

How long to keep minutes?

The CNIL states "analysis documents may be kept up to one year."

A project decision log may be kept aligned with project duration if documented.

What happens to recordings at project end?

This question is often overlooked.

A project ends, but its committees remain in the library. An effective policy should provide:

session → minutes → project closure → deletion.

---

Who can access a steering committee recording?

Only those who need it for follow-up.

Participants and those taking over the file. Not the entire project team unless explicitly decided.

Who can access audio, transcription, and minutes?

The three files do not necessarily serve the same needs.

You might:

• share minutes with both teams;
• restrict transcription access;
• keep audio only for justified needs.

Are minutes sent to the client?

Often, and legitimately.

A copy then leaves your organization and enters another with its own access rules. Your retention period does not bind theirs.

Should data be encrypted?

Security must match the risk.

The GDPR requires "appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization and encryption" (Article 32, paragraph 1).

---

What rights do participants have?

Recorded persons have rights under the GDPR.

Can they request access to their data?

Yes.

The data subject "has the right to obtain from the controller confirmation as to whether personal data concerning them are being processed" (GDPR, Article 15, paragraph 1). This may concern audio, transcription, and minutes.

Can they request rectification?

Yes.

The data subject "has the right to obtain from the controller without undue delay the rectification of inaccurate personal data" (GDPR, Article 16).

In a steering committee, an action wrongly assigned can be corrected.

AI may mis-transcribe:

• a proper name;
• a deadline;
• a blocking point;
• a commitment;
• the identity of the speaker.

Can they request erasure?

Yes, under GDPR conditions.

The data subject "has the right to obtain from the controller the erasure of personal data concerning them" (GDPR, Article 17, paragraph 1).

Who handles requests when multiple organizations are involved?

The one who recorded.

They are the data controller, even if minutes circulated elsewhere.

What is the response time?

Generally, within one month. The controller replies "without undue delay and at the latest within one month of receipt of the request" (GDPR, Article 12, paragraph 3).

---

What obligations when AI takes notes?

AI adds processing beyond simple recording.

The workflow can be summarized:

audio → transcription → analysis → action log → distribution to both teams.

What does AI concretely do?

It can:

• transcribe the session;
• identify speakers;
• extract decisions;
• note blocking points;
• produce minutes;
• assign actions to owners.

Where is data stored?

This is a key question for your provider and your client before accepting recording.

With Leexi, recordings, transcriptions, and minutes remain in the Paris region on AWS. Beyond a certain license volume, hosting on Scaleway can be chosen.

Who processes the data?

The tool provider acts as a processor under GDPR.

For Leexi, OpenAI provides the language model and Leexi runs it via Azure France in a closed circuit.

Is a DPA needed with the provider?

Yes, when the provider acts as a processor.

Article 28 of the GDPR requires that "processing by a processor is governed by a contract or legal act binding the processor to the controller, defining the subject, duration, nature, purpose, data types, categories of data subjects, and controller's rights and obligations" (paragraph 3).

This document is what your client will request to see your processing chain before agreeing to recording. The Leexi compliance dossier gathers these documents.

Does AI use your sessions to train its models?

It depends on the provider.

With Leexi, conversations do not train any model on any account.

---

How to announce recording a steering committee?

Use simple, precise wording.

At project start

"For follow-up, we record committees and minutes are automatically drafted: decisions, blocking points, actions. They are sent after each session. Is that okay with you?"

At session start

"Reminder: the session is recorded and minutes are sent to all participants. If a point should be excluded, please say so and I will stop recording."

For a new participant

"Please note committees are recorded and minutes circulate between our two teams. Let me know if this is an issue on your side."

---

What mistakes to avoid?

1. Applying legitimate interest to all participants

It does not cover people outside your organization.

2. Asking consent only once, at the first committee

Composition changes over the project; information must follow arrivals.

3. Leaving committees of a finished project in the library

Without rules linked to project closure, they remain.

4. Using a minutes template meant for another purpose

A mismatched template produces a report that fits neither the committee nor client expectations.

5. Forgetting that minutes live elsewhere

Once sent to the client, their access rules apply. Your deletion does not remove it on their side.

6. Not verifying the session was properly recorded

A recorded but lost session wastes several people’s time.

---

How to record a steering committee with Leexi?

Once the GDPR framework is set, using the tool involves a few steps.

1. Join the session

Leexi can join the meeting from your calendar. In-room, recording can start from the mobile app, and in-person rules apply.

2. Generate the decision log

Minutes include decisions, blocking points, actions, and their owners.

3. Find a past session

Sessions are kept in a searchable library, allowing retrieval of commitments made months ago.

4. Manage access

You define which employees can view minutes.

5. Control data

Leexi indicates hosting in Paris region, Scaleway option, model execution via Azure France closed circuit, encryption in transit and at rest, and no training on your conversations.

---

What real difficulties do users face?

Legal questions are not the only practical challenges.

Out of 1,141 support tickets received between January and June 2026, 2 concern a steering committee. They involve retrieving a past session and a minutes template applied to the wrong meeting type. A third, related ticket reports a session joined by the assistant with no minutes available afterward.

None ask if recording is allowed.

This offers another perspective:

The issue is not only "Am I allowed to record?"

You also need to know:

who can find the session → under which template minutes are produced → how long it remains accessible.

---

Recording a steering committee: key takeaways

Before recording your committees, check these six points:

• Information: do all participants know sessions are recorded?
• Legal basis: have you distinguished employees from external participants?
• Contract: is recording mentioned in project documents?
• Arrivals: are new participants informed at their first session?
• Closure: is there a deletion rule linked to project end?
• Processors: can you show your processing chain to the client?

If AI is involved, add a seventh point:

do participants know an AI system processes the recording to produce minutes?

Frequently Asked Questions

Is it legal to record a steering committee?

Yes, with participant information. Legitimate interest may suffice for your employees. External participants require consent.

Is client consent needed to record committees?

Yes, when consent is the chosen basis. Mentioning it at project start avoids repeating at each session.

What if committee composition changes?

Each newcomer is informed at their first session.

Can minutes be sent to the client?

Yes, this is common practice. Once sent, client access rules apply.

How long to keep committee recordings?

Duration depends on purpose. For work call recordings, CNIL allows up to six months; analysis documents up to one year.

Can a committee held months ago be retrieved?

Yes, subject to access rights and retention policies.

Can a participant request deletion of a session?

Yes, under GDPR conditions.

---

In summary

Recording a steering committee is possible.

But the right approach is not just asking:

"Am I allowed to record?"

You must verify the entire chain, considering both organizations involved:

inform both teams → record → transcribe → distribute → retain until closure → delete.

This complete chain must be governed by your data protection policy.

Want reliable decision logs for your steering committees? Try Leexi on your next committee

Sources

Texts referenced from primary sources on August 22, 2026.

• GDPR Articles 4, 5, 6, 7, 12, 13, 15, 16, 17, 21, 28, 32
• Penal Code Article 226-1
• CNIL, Listening and recording calls at the workplace
• European AI Regulation Article 50

This page describes the applicable framework. It does not constitute legal advice.