Recording a Work Meeting: What Are the GDPR Rules?
- Rules to follow before recording, and what changes when an AI drafts the minutes.
Do you want to record a meeting to automatically get a transcription or minutes? It's possible, but you must follow several rules: inform participants, choose a legal basis, limit retention, and control file access.
If an AI transcribes or drafts the minutes, you must also inform those involved about this processing.
Can you record a professional meeting?
Yes, but not without regulating the processing.
A meeting recording contains voices, names, roles, and statements. It is therefore personal data processing under GDPR.
You must notably:
- inform participants before recording;
- determine your legal basis;
- define the purpose of the recording;
- limit retention period;
- restrict access;
- enable participants to exercise their rights.
Recording without consent is also punishable under the Penal Code, which penalizes "deliberately infringing on another's privacy by capturing, recording, or transmitting private or confidential words without consent" (Article 226-1).
Is a meeting recording personal data?
Yes.
GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).
A voice, name, role, or statements during a meeting can identify a participant.
Transcriptions and minutes are also concerned.
Why does GDPR apply to recorded meetings?
Because you perform successive processing steps:
record → transcribe → store → share → possibly delete.
The medium used does not change the principle.
Whether recorded via phone, dictaphone, computer, or an assistant joining a video call, you process personal data. Practical constraints differ: see in-room recording, phone call recording, and site visit case.
What data is recorded?
Depending on the tool, you may keep:
- audio;
- transcription;
- participant names;
- meeting date;
- duration;
- minutes;
- decisions made;
- actions assigned.
Some conversations may reveal sensitive data unexpectedly.
For example, a participant might mention health, family status, or political views.
Must participants be informed before recording?
Yes.
Information must be given before or at data collection. The text requires it "at the time the data are obtained" (GDPR, Article 13, paragraph 1).
Simply saying "the meeting is recorded" may not cover all required information.
When to inform participants?
Before starting the recording.
Practically, inform them in the invitation, then remind at the meeting start.
This second step is crucial if someone joins late.
What to tell them?
The CNIL states employees and contacts (e.g., clients) must be informed about the system, the data controller’s identity, and purposes.
You should clearly explain:
who records → why → what is recorded → how data will be used.
Must you specify that an AI drafts the minutes?
Yes.
Audio recording and AI processing are distinct operations.
The EU AI regulation requires providers to ensure systems interacting with people inform them they interact with AI (Article 50, paragraph 1). This applies since August 2, 2026, targeting providers; your obligation comes from GDPR and CNIL guidance.
If an assistant transcribes and automatically generates minutes, inform participants.
You can say:
"The meeting is recorded and an AI assistant automatically drafts the minutes."
If someone joins late, provide the same info before they speak.
What if someone arrives mid-meeting?
Inform them before they speak.
In video calls, the assistant may appear in participant list; in physical meetings, they may not notice.
You can say:
"I inform you before you speak: the meeting is recorded and an AI assistant drafts the minutes. If you object, please say so and I will stop recording."
What legal basis to use for recording?
Depends on the recorded person and meeting context.
Two main bases: legitimate interest and consent. The chosen basis varies by meeting: see details for sales meeting, recruitment interview, executive committee, or steering committee.
Can legitimate interest be used?
Yes, especially for some internal meetings.
Article 6 allows processing "necessary for legitimate interests of the controller or a third party unless overridden by fundamental rights" (paragraph 1, point f).
You must perform a balancing test and inform participants.
Can consent be used?
Yes, when consent is appropriate.
Consent is "a free, specific, informed, and unambiguous indication of the data subject's wishes" (Article 4, point 11).
The controller must "be able to demonstrate consent" (Article 7, paragraph 1).
Timestamped consent helps prove this.
Can you record colleagues without consent?
Yes, possibly based on legitimate interest, after prior information and balancing.
Employee-employer context differs from client or prospect.
Can you record a client or prospect?
Yes, but you must get their consent if that is the basis.
Ask for agreement before recording.
If refused, do not record.
How long to keep meeting recordings?
Only as long as necessary for the purpose.
GDPR requires data be kept no longer than needed (Article 5, paragraph 1, point e).
A library of years of meetings without deletion rules poses data governance issues.
How long keep audio?
For work calls, CNIL allows up to six months.
Ask:
When is the audio no longer useful?
Once minutes are verified, original recording may lose utility.
How long keep transcription?
CNIL allows analysis documents up to one year.
Duration depends on purpose and processing.
What about old recordings?
Plan their deletion.
Don’t rely on users’ memory.
An effective policy covers:
creation → retention → expiry → deletion.
Who can access recorded meetings?
Only those needing it for work.
Recordings contain more info than finalized minutes.
Different access levels are needed.
Who can access audio, transcription, minutes?
These files serve different needs.
You might:
- share minutes with participants;
- restrict transcription access;
- keep audio only if justified.
Access must be proportional to purpose.
Should data be encrypted?
Security must match risk.
GDPR requires "appropriate technical and organizational measures including pseudonymization and encryption" (Article 32, paragraph 1).
The Leexi compliance dossier details hosting, subcontractors, and certifications.
Check storage and transfer security when choosing a provider.
What rights do participants have?
Recorded persons have GDPR rights.
Can they request access?
Yes.
They have the right to know if their personal data is processed (Article 15).
This includes audio, transcription, and minutes.
Can they request correction?
Yes.
They can ask for inaccurate data to be corrected promptly (Article 16).
Important with automatic transcription, which may mishear:
- proper names;
- amounts;
- dates;
- decisions;
- speaker identity.
Can they request deletion?
Yes, under GDPR conditions.
They can ask for erasure (Article 17), but requests must be balanced against purpose and retention obligations.
Can they object to recording?
Yes, if based on legitimate interest, per GDPR conditions.
They can object anytime for reasons related to their situation (Article 21).
Objection rights relate directly to this legal basis.
How quickly must you respond?
Generally within one month.
Controller must respond "without undue delay and at latest within one month" (Article 12).
Organized meeting records help fulfill rights.
What obligations when AI takes notes?
AI adds processing beyond recording.
Process:
audio → transcription → analysis → minutes → storage.
Each step must fit your data protection framework.
What does AI do?
It can:
- transcribe exchanges;
- identify speakers;
- extract decisions;
- identify actions;
- produce minutes;
- organize deadlines.
Minutes are not just copies; they result from extra processing.
Where is data stored?
Ask your provider.
Leexi stores recordings, transcriptions, and minutes in Paris region on AWS; Scaleway hosting is optional for large licenses.
Who processes data?
The provider acts as processor under GDPR.
For Leexi, OpenAI provides language model; Leexi runs it via Azure France in a closed circuit.
Is a DPA needed?
Yes, when provider acts as processor.
Article 28 requires a contract defining processing scope, duration, nature, data types, and obligations.
Your legal team will request this as a DPA.
Does AI use your conversations to train models?
Depends on provider.
Check before choosing.
Leexi does not use conversations for training on any accounts.
How to inform participants that AI records the meeting?
Use simple, clear wording.
Before a meeting
"Before we start: I record the meeting and an AI assistant drafts the minutes with decisions and actions. Minutes will be shared. Recording kept [duration] then deleted. Any objections?"
For internal meetings
"As usual, the meeting is recorded and minutes are auto-generated. They appear in the shared library with decisions and tasks. If you want me to pause for a point, say so."
For clients or prospects
"Before we begin: do you agree to record our exchange? An AI assistant drafts the minutes, so I don’t have to take notes while we talk."
Common mistakes to avoid
1. Recording without informing
A common error.
You start recording on your phone but forget to tell attendees.
2. Not defining purpose
"We keep meetings just in case" is not a retention policy.
Know why you record and how long data stays useful.
3. Keeping all recordings indefinitely
Years of meetings without deletion rules create hard-to-control personal data stock.
4. Giving access to entire company
Executive committee minutes are not meant for everyone by default.
5. Letting everyone use own tool
Leads to multiple providers, processes, storage locations, and contracts to manage.
6. Recording all meetings automatically
CNIL states employers cannot have permanent or systematic recording.
Automation does not remove need for rules.
How to record a meeting with Leexi?
Once GDPR framework is set, use the tool in a few steps.
1. Join the meeting
Leexi can join Teams, Meet, and Zoom from your calendar.
For physical meetings, start recording from mobile app.
2. Transcribe exchanges
After meeting, get transcription alongside minutes.
3. Generate minutes
Minutes include decisions, actions, deadlines.
You can adapt format by meeting type.
4. Manage access
Define who can view minutes.
5. Control data
Leexi provides Paris region hosting, Scaleway option, model execution via Azure France closed circuit, encryption in transit and at rest, and no training on your conversations.
What real difficulties do users face?
Legal issues are not the only practical challenges.
Among 1,141 support tickets from Jan to June 2026, common problems include mobile app recording, connecting to sales meetings, phone transcriptions, and access rights.
This shows the issue is not just "am I allowed to record?"
You also need to know:
where recordings go → who can see them → how long they stay → how they are deleted.
Recording a professional meeting: key takeaways
Before recording, check these six points:
- Information: do participants know they’re recorded?
- Purpose: why keep the recording?
- Legal basis: what legal ground do you use?
- Retention: when will audio and transcription be deleted?
- Access: who can view data?
- Processors: do you know who processes and stores your data?
If AI is involved, add a seventh:
do participants know AI processes the recording to produce minutes?
FAQs
Is it legal to record a professional meeting?
Yes, if you respect applicable rules: inform participants, legal basis, purpose, retention.
Must participants be informed?
Yes, before or at data collection.
Can you record without consent?
In some cases, especially among colleagues, legitimate interest may apply after information and balancing.
Can you record a client or prospect?
Yes, but get their consent if that is your basis.
Can you record meetings with your phone?
Yes, the medium doesn’t change data obligations.
Can AI be used for note-taking?
Yes, but participants must be informed.
How long keep recordings?
Depends on purpose. CNIL allows six months max for work calls, up to a year for analysis docs.
Can participants request deletion?
Yes, under GDPR erasure rights.
Summary
Recording meetings is possible.
But the right approach is not just:
"Am I allowed to record?"
You must oversee the whole chain:
inform → record → transcribe → analyze → share → retain → delete.
This full chain must be governed by your data protection policy.
Want meeting minutes without writing them? Book a demo
Sources
Primary sources checked August 22, 2026.
- GDPR Articles 4, 5, 6, 7, 12, 13, 15, 16, 17, 21, 28, 32
- Penal Code Article 226-1
- CNIL, Listening and recording calls at work
- EU AI Regulation Article 50
This page outlines the applicable framework. It is not legal advice.
Ready to boost your productivity with Leexi?
Leexi AI Notetaker takes notes for you