GDPR and recording meetings: what you need to know

Recording meetings is common today, whether for the transcript, the minutes or as insurance on what was actually agreed. But to keep a useful tool from turning into a legal problem, you need to know a few basic rules. We have summarized them in plain language, without the legalese.

Note: This article is a general overview, not legal advice. In sensitive situations, always consult a lawyer.

Why GDPR applies to recording at all

A recording of a specific person’s voice is personal data. As soon as you record a meeting, you are processing the personal data of every speaker, and the General Data Protection Regulation (GDPR) applies to you. That does not mean you cannot record. It means you need a clear reason and you have to be transparent.

The basics: inform people and get consent

The safest and cleanest approach has two parts:

• Inform all participants in advance that the meeting is being recorded and why (for example, for the minutes).
• Get consent: it is enough to say at the start of the recording “We are recording this meeting for the minutes, does anyone object?” and nobody speaks up. In more sensitive situations it is better to record consent explicitly.

Never record secretly. Covert recording is not only a GDPR violation but, depending on the circumstances, an invasion of privacy with serious consequences.

The golden rule: only record what you would happily announce out loud to everyone in the room: “I’m recording this.”

Have a legal basis

GDPR requires you to base the processing on one of the legal grounds. For meetings, the most common are:

• Consent: the participant actively agrees to the recording.
• Performance of a contract: the recording is necessary to deliver a service you have agreed on.
• Legitimate interest: for example, an accurate record of conclusions, as long as it does not outweigh the participants’ interest in privacy.

For an ordinary internal meeting, transparent notice and legitimate interest are usually enough. With clients and external parties, rely on consent.

Keep only what you need

GDPR is built on the principle of data minimization. After the meeting, ask yourself whether you really need the whole recording or whether the transcript and summary are enough. If you do not need the raw recording, delete it. For what you keep, set a reasonable retention period and remove the data once it ends.

Respect participants’ rights

People whose voices you recorded have rights, including the right of access to the recording, rectification and erasure. In practice this means being able to find, provide or delete the recording on request. It helps to know where your recordings live and who has access to them.

Choose tools that take data seriously

When you process meetings through an online service, you are passing data to the provider. A good tool should clearly describe where data is stored, how it is secured and that it is not used for other purposes. ZAPSIO stores your recordings securely, lets you delete them anytime, and your transcripts and analyses remain your property.

A quick checklist before recording

• Did I say out loud that we are recording, and why?
• Did the participants have a chance to object?
• Do I have a clear reason for recording?
• Do I know how long I will keep the recording and when I will delete it?
• Am I using a tool I trust with the data?

If you answer yes to all five, you are recording fairly and within the rules.

Back to the blog