Recording Sales Meetings: What Are the GDPR Rules?

Do you record your client meetings to get the minutes and fill in your CRM without retyping anything? It's possible, but the sales meeting is the only meeting where the person you are talking to does not belong to your organisation.

That changes the legal basis, and it changes what you have to say before you start recording.

Can you record a sales meeting?

Yes, but not without a framework for the processing.

A recording of a meeting contains your contact's name, their role, their objections and their commitments. It therefore constitutes processing of personal data within the meaning of the GDPR.

In particular, you must:

• ask for your contact's agreement before recording;
• determine your legal basis;
• define the purpose of the recording;
• limit the retention period;
• also deal with the copy sent to the CRM;
• allow your contact to exercise their rights.

Recording without the knowledge of the people present also falls under the French Criminal Code, which punishes "with one year's imprisonment and a fine of €45,000 the act of wilfully violating the privacy of another person by any means whatsoever: 1° by capturing, recording or transmitting, without the consent of their author, words spoken in private or confidentially" (Article 226-1).

Is a meeting recording personal data?

Yes.

The GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).

Sales minutes name your contact, their role, and sometimes details about their situation.

The transcript and the fields filled in the CRM are also covered.

Why does the GDPR apply even more here?

Because the person recorded is not your employee, and because you carry out several successive processing operations:

record → transcribe → write up → send to the CRM → retain → delete.

No employment relationship binds you to your contact, and they have no reason to accept the recording by default. The framework common to all meetings is detailed on the page recording a professional meeting.

What data is recorded?

Depending on the tool used, you may keep:

• the audio of the conversation;
• the transcript;
• the names of the speakers;
• the date of the meeting;
• the minutes;
• the needs expressed;
• the objections;
• the next steps.

These elements then go into your CRM, which creates a second copy in another system.

---

Do you have to inform the client before recording?

Yes.

The information must be given before or at the time the data is collected. The text requires it to be provided "at the time when personal data are obtained" (GDPR, Article 13, paragraph 1).

In a sales meeting, information alone is not enough: you also ask for their agreement.

When should you inform them?

Before starting the recording.

In practice, you can mention it in the invitation, then ask the question out loud at the start.

The invitation informs. Only the spoken exchange allows your contact to refuse.

What should you tell them?

The CNIL states that "employees as well as the other parties (clients, for example) must in particular be informed: of the existence of the system; of the identity of the data controller; of the purposes pursued".

You must therefore be able to explain simply:

who is recording → why → what is recorded → what will be done with the data.

The CNIL adds that "the other parties must be informed of their right to object before the end of the telephone conversation".

Is a notification sent before the meeting enough?

No: it informs, but it does not collect agreement.

Check its content too. It tells your client which company is organising the meeting, which can be a problem when you belong to a subsidiary and do not want to disclose the name of the parent company.

Do you have to say that an AI writes the minutes?

Yes.

The audio recording and the processing then carried out by the AI are two operations that are worth distinguishing.

The European AI Regulation provides that "providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system" (Article 50, paragraph 1). These obligations have applied since 2 August 2026, and they target the provider of the system; your obligation to inform comes from the GDPR and the CNIL's guidance.

You can, for example, announce:

"I'm recording our conversation and an AI assistant automatically writes the minutes."

What if someone joins the meeting part-way through?

You inform them before they speak.

In a meeting with several people on the client side, this is common.

---

Which legal basis should you use to record a meeting?

Consent is the most suitable basis for the sales case.

Your contact does not belong to your organisation, and legitimate interest is the basis for internal processing rather than this one.

Why consent rather than legitimate interest?

Because your client can refuse without any consequence for them.

Consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement" (GDPR, Article 4, point 11). In a sales meeting, the condition that consent be freely given raises no particular difficulty.

How do you prove that consent?

The controller must "be able to demonstrate that the data subject has consented" (GDPR, Article 7, paragraph 1).

Agreement given out loud at the start of the conversation appears in the recording itself. Consent timestamped by the tool makes it possible to keep a separate record of it.

Can the client withdraw their agreement?

Yes.

The GDPR provides that "it shall be as easy to withdraw as to give consent" (Article 7, paragraph 3). Deletion of the recording then follows the request.

Can you record a prospect who does not know you yet?

Yes, under the same conditions.

The request is made at the start, before getting into the subject.

---

How long should you keep the recording of a meeting?

For as long as necessary for the purpose pursued, and no longer.

The GDPR requires data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (Article 5, paragraph 1, point e).

The sales case adds a difficulty: the minutes also live in your CRM.

How long should you keep the audio?

For listening to and recording calls at work, the CNIL states that "recordings may be kept for a maximum of six months".

So you can ask yourself:

At what point is the audio no longer useful to me?

How long should you keep the minutes?

The CNIL states that "analysis documents may be kept for up to one year".

The applicable period nevertheless depends on your customer relationship management policy.

What about the copy in the CRM?

You must treat it like the original.

Deleting the recording without dealing with the client record leaves the data in place:

recording → minutes → CRM record → deletion of both copies.

What about meetings that did not lead anywhere?

A prospect who did not become a client keeps their rights, and nothing justifies keeping them in your recordings longer than necessary.

---

Who can access the recording of a meeting?

Only the people who need it for their work.

The salesperson who led the conversation, their manager, and the people who take over the account.

Where do the minutes land?

It is a compliance question as much as an organisational one.

Minutes filed in a salesperson's personal space escape the organisation's access policy.

You can, for example:

• define a shared space as the default destination;
• limit access to the people involved in the account;
• check where the minutes land after a change of settings.

Should the data be encrypted?

Security must be appropriate to the risk.

The GDPR requires "appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data" (Article 32, paragraph 1).

---

What are your contact's rights?

The people recorded have the rights provided for by the GDPR.

Can they request access to their data?

Yes.

The data subject has "the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed" (GDPR, Article 15, paragraph 1). This may concern the audio, the transcript and the minutes.

Many salespeople send the minutes to the client anyway, which deals with the question before it arises.

Can they request rectification?

Yes.

The data subject has "the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her" (GDPR, Article 16).

This is particularly important with an automatic transcript.

An AI can mistranscribe:

• a proper name;
• an amount;
• a deadline;
• an objection;
• the identity of the person who spoke.

Can they request erasure?

Yes, under the conditions laid down by the GDPR.

The data subject has "the right to obtain from the controller the erasure of personal data concerning him or her without undue delay" (GDPR, Article 17, paragraph 1).

The request must be examined in light of the purpose of the processing and any retention obligations.

Can they object to the recording?

Yes, and in a sales meeting this takes the form of a refusal, before or during the conversation.

The data subject has "the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1)" (GDPR, Article 21, paragraph 1).

You then stop the recording and take notes.

How quickly must you respond?

In principle, within one month. The controller responds "without undue delay and in any event within one month of receipt of the request" (GDPR, Article 12, paragraph 3).

---

What obligations apply when the AI takes the notes?

The AI adds a processing operation on top of the simple recording.

The way it works can be summarised as follows:

audio → transcript → analysis → minutes → CRM record.

What does the AI actually do?

It can:

• transcribe the conversation;
• identify the speakers;
• extract the needs expressed;
• pick out the objections;
• produce minutes;
• fill in the fields of the client record.

Where is the data stored?

This is one of the first questions to ask your provider.

At Leexi, recordings, transcripts and minutes stay in the Paris region, on AWS. Above a certain volume of licences, hosting at Scaleway can be chosen.

Who processes the data?

The provider of the tool acts as a processor within the framework provided for by the GDPR.

Your CRM is a second processor, and the minutes that arrive there follow the same reasoning. Leexi's compliance file details its own processing chain.

In Leexi's case, OpenAI provides the language model and Leexi runs it via Azure France, in a closed circuit.

Do you need a DPA with the provider?

Yes, when the provider acts as a processor.

Article 28 of the GDPR provides that "processing by a processor shall be governed by a contract or other legal act […] that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller" (paragraph 3).

Does the AI use your conversations to train its models?

That depends on the provider.

At Leexi, conversations do not train any model, on all accounts.

---

How do you ask a client for their agreement before recording?

You can use simple, precise wording.

At the start of a meeting

"Before we get into the subject: are you happy for me to record our conversation? An AI assistant writes the minutes for me, so I don't have to take notes while we talk. I'll send them to you if you'd like."

For a meeting at the client's premises

"Just so you know: I'm recording from my phone and the minutes are written automatically. They stay internal to my team. Is that OK with you?"

For a meeting with several people on the client side

"To be clear for everyone: the meeting is being recorded and an AI assistant writes the minutes. If any of you would rather I stopped, say so now."

---

What mistakes should you avoid?

1. Asking for agreement after starting the recording

The order matters. The information is due before or at the time of collection.

2. Treating the invitation as agreement

A notification sent before the meeting informs; it does not collect consent.

3. Leaving the minutes in personal spaces

They then fall outside the organisation's access policy, and nobody knows who can read them anymore.

4. Forgetting the copy in the CRM

Deleting the recording without dealing with the client record leaves the data in place.

5. Reusing a minutes template designed for another purpose

A badly chosen template produces off-topic sections and attributes statements to the wrong people.

6. Assuming the behaviour is identical on every platform

The assistant may join on its own on one video-conferencing platform and require a manual invitation on another.

---

How do you record a meeting with Leexi?

Once the GDPR framework is defined, using the tool comes down to a few steps.

1. Join the meeting

Leexi can join your Teams, Meet and Zoom meetings from your calendar. For a meeting at the client's premises, the recording can be started from the mobile app, and the rules specific to recording in a meeting room apply.

2. Inform the participants

A notification can be sent to the participants before the meeting. Its content and activation are set in the settings.

3. Generate the minutes

The minutes cover in particular the needs expressed, the objections, the decisions and the next steps.

4. Fill in the CRM

The minutes and tasks can be synchronised with HubSpot, Salesforce, Pipedrive or Microsoft Dynamics, and attached to the right contact. The full workflow is described on the page AI note-taking for sales teams, and phone calls follow the same path.

5. Control the data

Leexi states in particular hosting in the Paris region, a Scaleway option, model execution via Azure France in a closed circuit, encryption of data in transit and at rest, and no training on your conversations.

---

What difficulties do users actually encounter?

Legal questions are not the only difficulties encountered in practice.

Out of 1,141 support tickets received between January and June 2026, 9 concern recording a meeting. The most frequent reasons include the assistant not joining the meeting, the minutes not arriving or not arriving in the right place, and the minutes template not matching the type of meeting.

This gives another reading of the problem:

the question is not only "am I allowed to record?"

You also need to know:

where the minutes go → who can see them → which record they land in → how they are deleted.

---

Recording a sales meeting: what to remember

Before recording a meeting, check these six points:

• Agreement: did your contact say yes, out loud, before the recording?
• Purpose: why are you keeping the recording?
• Legal basis: is consent indeed the basis you rely on?
• Retention: when will the audio, the minutes and the CRM record be dealt with?
• Access: do the minutes land in a shared space or a personal one?
• Processors: do you know who processes your data, including your CRM?

If an AI is involved, add a seventh point:

does your client know that an AI system processes the recording to produce the minutes?

Frequently asked questions

Do you need the client's agreement to record a meeting?

Yes, when consent is the basis relied on. It is requested before starting the recording.

Is a mention in the invitation enough?

No. It informs; it does not collect agreement. The question is asked out loud at the start.

Can the client ask for a copy of the minutes?

Yes, under the right of access provided for by the GDPR.

What happens if the client refuses the recording?

You stop the recording and take notes. The refusal applies immediately.

Do the minutes go into the CRM without review?

No. They remain editable and can be validated before synchronisation.

How long should you keep the recording of a meeting?

The period depends on the purpose. For recordings of calls at work, the CNIL retains a maximum of six months in the context concerned, and up to one year for analysis documents. Remember the copy in the CRM.

Can a prospect who did not become a client request deletion?

Yes, under the conditions laid down by the GDPR's right to erasure.

---

In summary

Recording a sales meeting is possible.

But the right reflex is not only to ask:

"Am I allowed to record?"

You should instead check the whole chain, all the way to the client record:

ask for agreement → record → transcribe → write up → send to the CRM → retain → delete.

It is this complete chain that must be governed by your data protection policy.

Want the minutes of your meetings without writing them? Try Leexi on your next client meeting

Sources

Texts taken from primary sources on 22 August 2026.

• GDPR, Articles 4, 5, 6, 7, 12, 13, 15, 16, 17, 21, 28 and 32
• French Criminal Code, Article 226-1
• CNIL, Listening to and recording calls in the workplace
• European Artificial Intelligence Regulation, Article 50

This page describes the applicable framework. It does not constitute legal advice.