Recording In-Person Meetings: What Are the GDPR Rules?

Are you recording an in-room meeting from your phone to get the minutes? It's possible, but in-person meetings pose a challenge that video calls don't: no assistant appears on screen, so no one sees the recording running.

Information is given orally and repeated to each person entering the room.

Can you record an in-person meeting?

Yes, but not without regulating the processing.

A recording made in a room contains voices, names, roles, and statements. It thus constitutes personal data processing under GDPR, just like a video conference.

You must notably:

• inform orally before starting the recording;
• determine your legal basis;
• define the purpose of the recording;
• limit retention period;
• handle the copy remaining on the phone;
• enable participants to exercise their rights.

Recording without consent violates the Penal Code, punishable by "one year imprisonment and €45,000 fine for knowingly infringing on another's privacy by capturing, recording, or transmitting private or confidential speech without consent" (Article 226-1).

Is a recording made in a room personal data?

Yes.

GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).

Around a table, voices, mentioned names, and statements can identify participants.

Transcriptions and minutes are also concerned.

Why does GDPR apply to phone recordings?

Because you perform successive processing:

record → upload → transcribe → store → share → possibly delete.

The medium does not change the principle.

A smartphone on the table is treated like an assistant joining a video call. The general framework is detailed on the record a professional meeting page.

What data is recorded in a room?

Depending on the tool, you may keep:

• room audio;
• transcription;
• speaker names;
• meeting date;
• duration;
• minutes;
• decisions made;
• actions assigned.

A room captures more than a video call: pre-meeting conversations, side talks, people passing through.

Participants may mention health, family, or political opinions during the meeting.

---

Must participants be informed before recording in a room?

Yes.

Information must be given before or when data is collected. The text requires it "at the time the data are obtained" (GDPR, Article 13, paragraph 1).

In-room, this announcement is the only cue for participants.

When to inform participants?

Before starting the recording.

Practically, you can notify in the invitation and remind at meeting start.

This second step is crucial in-person, where no visual recording indicator exists.

What to say?

CNIL states that concerned persons "must be informed of the existence of the system, the data controller's identity, and the purposes pursued."

You should simply explain:

who records → why → what is recorded → what will be done with data.

Should you specify that AI writes the minutes?

Yes.

Audio recording and AI processing are distinct operations.

The EU AI regulation requires providers to ensure AI systems interacting directly with people inform them they interact with AI (Article 50, paragraph 1). These obligations apply since August 2, 2026, targeting providers; your obligation to inform comes from GDPR and CNIL guidance.

In video calls, the assistant's name in participants list makes it visible. In-room, no visual cue exists, so oral announcement carries all info.

Example announcement:

"The meeting is recorded from my phone and an AI assistant automatically drafts the minutes."

What if someone enters mid-meeting?

Inform them before they speak.

This is common in rooms: latecomers haven't heard the opening info.

You can say:

"Before you speak: the meeting is recorded and an AI assistant drafts the minutes. If you object, please say so and I'll stop recording."

---

What legal basis to use for in-person recording?

Depends notably on who is present.

Two main bases: legitimate interest and consent.

Can legitimate interest be used?

Yes, especially for internal meetings.

GDPR Article 6 allows processing "necessary for legitimate interests pursued by controller or third party unless overridden by fundamental rights" (paragraph 1, point f).

You must conduct a balancing test and inform participants.

Can consent be used?

Yes, when consent is appropriate basis.

Consent is "a freely given, specific, informed and unambiguous indication of the data subject's wishes" (GDPR, Article 4, point 11). Controller must "be able to demonstrate consent" (Article 7, paragraph 1).

In-room proof is harder than video calls with digital trace. Timestamped consent at recording start helps.

Can you record an internal meeting without consent?

Yes, possibly based on legitimate interest, after prior info and balancing test.

Can you record a client meeting?

Yes, but you must obtain their agreement if consent is the basis.

This applies when outsiders are present: clients, candidates, external speakers. See details for commercial meeting, recruitment interview, or site visit.

If they refuse, do not record.

---

How long to keep recordings made in a room?

Only as long as necessary for the purpose.

GDPR requires data "kept in identifiable form no longer than necessary" (Article 5, paragraph 1, point e).

In-person adds difficulty: recording exists in two places.

How long keep audio?

For work call recordings, CNIL states "recordings may be kept up to six months max."

Ask:

When is audio no longer useful?

How long keep transcription?

CNIL says "analysis documents may be kept up to one year."

Duration depends on purpose and processing.

What about the file on the phone?

Treat it as the original.

Recording started on mobile exists on device and online account.

If retention policy covers only online copy, it covers only part of processing:

phone → upload → online account → delete both copies.

---

Who can access in-room recordings?

Only those who need it for work.

Room recordings contain more info than finalized minutes, including peripheral remarks before/after meeting.

Who can access audio, transcription, minutes?

These files serve different needs.

You may:

• share minutes with participants;
• restrict transcription access;
• keep audio only if justified.

Audio deserves the strictest access.

Should data be encrypted?

Security must match risk.

GDPR requires "appropriate technical and organizational measures to ensure security, including pseudonymization and encryption" (Article 32, paragraph 1).

The Leexi compliance dossier details hosting, subcontractors, certifications.

When choosing a provider, verify storage and transfer security.

---

What rights do participants have?

Recorded persons have GDPR rights.

Can they request access?

Yes.

They "have right to obtain confirmation from controller whether personal data concerning them are processed" (Article 15, paragraph 1). Applies to audio, transcription, minutes.

Can they request correction?

Yes.

They "have right to obtain rectification of inaccurate personal data" (Article 16).

Important in rooms where multiple speak, sometimes simultaneously.

AI may mis-transcribe:

• proper names;
• amounts;
• dates;
• decisions;
• speaker identity.

Can they request deletion?

Yes, under GDPR conditions.

They "have right to obtain erasure of personal data" (Article 17, paragraph 1).

Requests considered per purpose and retention obligations.

Can they object to recording?

Yes, if processing based on legitimate interest, under GDPR conditions.

They "have right to object at any time for reasons related to their situation to processing based on Article 6(1)(e) or (f)" (Article 21, paragraph 1).

How quickly must you respond?

Generally within one month. Controller replies "without undue delay and at latest within one month of request" (Article 12, paragraph 3).

You must locate the meeting, so recordings must be properly uploaded.

---

What obligations when AI takes notes in-room?

AI adds processing beyond recording.

Process summary:

audio → upload → transcription → analysis → minutes → storage.

Upload is specific to in-person and often fails.

What does AI do?

It can:

• transcribe exchanges;
• identify speakers;
• extract decisions;
• identify actions;
• produce minutes;
• organize deadlines.

Where is data stored?

Ask your provider.

Leexi stores recordings, transcriptions, minutes in Paris region on AWS. Above certain license volume, Scaleway hosting is possible.

Who processes data?

Tool provider acts as processor under GDPR.

Leexi uses OpenAI language model executed via Azure France in closed circuit.

Is a DPA needed?

Yes, if provider acts as processor.

GDPR Article 28 requires contract defining processing scope, duration, nature, purpose, data types, categories, and obligations.

Does AI use your conversations to train models?

Depends on provider.

Leexi does not train models on conversations on any accounts.

---

How to inform participants in a room?

Use simple, clear wording.

At meeting start

"Before we start: I record the meeting from my phone and an AI assistant drafts the minutes with decisions and actions. Minutes will be shared with attendees. Recording kept [duration] then deleted. Any objections?"

For internal in-room meetings

"As with our video calls, I record and minutes are generated automatically. They go to the shared library. If you want me to stop for a point, say so."

For client meetings

"Before we begin: do you agree to me recording our exchange? An AI assistant drafts the minutes, so I don't have to take notes while we talk."

---

Common mistakes to avoid

1. Recording without warning

No visual cue in rooms makes forgetting easier than in video calls.

2. Informing only at meeting start

Latecomers hear nothing and will speak.

3. Leaving files on phone

Uploaded recordings often remain on device. If retention policy excludes this copy, it excludes part of processing.

4. Leaving app before upload finishes

Main cause of recordings never reaching library.

5. Using shared account for room

Multiple users under one identity degrade attribution and access control.

6. Recording all meetings automatically

CNIL states "employer cannot implement permanent or systematic listening or recording."

---

How to record an in-room meeting with Leexi?

Once GDPR framework set, use is simple.

1. Start recording

Launch from mobile app, no room hardware needed.

2. Upload recording

After meeting, recording sent to online account. Processing starts.

3. Transcribe and generate minutes

Get transcription alongside minutes with decisions, actions, deadlines.

4. Manage access

Define collaborators authorized to view minutes.

5. Control data

Leexi details hosting in Paris region, Scaleway option, Azure France closed execution, encryption in transit and rest, no training on conversations.

---

What real difficulties do users face?

Legal questions aren't the only practical issues.

Of 1,141 support tickets from Jan-Jun 2026, 27 concern in-room or mobile app recording. Common issues: upload failures, missing recordings, partial captures, speaker attribution.

None ask if recording is allowed.

This shows another perspective:

The issue isn't just "can I record?"

You must also know:

where recording goes → who can see it → how long it stays → how it's deleted.

---

In summary

Before recording in-room, check these six points:

• Information: do attendees know they're recorded, including late arrivals?
• Purpose: why keep the recording?
• Legal basis: legitimate interest internally, consent for outsiders?
• Retention: when will audio and transcription be deleted, on account and phone?
• Access: who can view data?
• Processors: do you know who processes and stores your data?

If AI is involved, add a seventh:

Do participants know AI processes the recording to produce minutes?

FAQs

Is recording an in-person meeting legal?

Yes, if you respect applicable rules: inform attendees, legal basis, purpose, retention.

Need special mic or equipment?

No. A smartphone with the app suffices, no room hardware needed.

How to inform when no assistant visible?

Orally, before recording starts, and again to each late arrival.

Can you record in-person from a computer?

Users ask often. Mobile app remains the intended method.

Do in-room meeting minutes sync to CRM?

Yes, like video calls: transcription, minutes, then sync.

How long keep recording?

Depends on purpose. CNIL sets max six months for work call recordings, up to one year for analysis docs. Remember phone copy.

Can participant request deletion?

Yes, under GDPR erasure rights.

---

Summary

Recording in-room meetings is possible.

But the right approach is not just:

"Can I record?"

Rather, verify the whole chain, considering the copy on the phone:

inform → record → upload → transcribe → share → retain → delete both copies.

This full chain must be governed by your data protection policy.

Holding meetings in-room? Try Leexi at your next in-person meeting

Sources

Primary sources checked August 22, 2026.

• GDPR Articles 4,5,6,7,12,13,15,16,17,21,28,32
• Penal Code Article 226-1
• CNIL, Listening and recording calls at work
• EU AI Regulation Article 50

This page describes the applicable framework. It is not legal advice.