Recording Teams meetings and the GDPR: what you should know

Recording work meetings is increasingly common. It saves taking notes, helps people who missed the meeting catch up and gives you reliable minutes. But a recording captures personal data about everyone taking part, and that comes with rules. In Spain, the General Data Protection Regulation (GDPR) applies alongside the Spanish data protection act (LOPDGDD), which supplements it. Most of what follows applies anywhere in the EU.

This article is general information, not legal advice. Every company and every type of meeting is different: before deciding how to record, check with your data protection officer or your lawyer.

Can you record a work meeting?

Generally, yes, as long as there’s a clear reason, a legal basis and people know beforehand. Recording isn’t a problem in itself; problems start when you record without warning, keep recordings forever or let people see them who shouldn’t. The questions in the sections below help you work through those decisions.

Tell people before you start

Article 13 of the GDPR requires you to inform people when you collect their data. In a meeting, that means telling them before recording, not halfway through or at the end. The practical approach is to put it in the invitation and repeat it as you start. At the very least, the information should answer these questions:

• Who is responsible for the recording and how to contact their data protection officer, if there is one.
• Why it’s being recorded and on what legal basis.
• Who will have access to the recording and the transcript, including suppliers.
• How long it will be kept, or the criteria for deleting it.
• What rights each person has (access, erasure, objection…) and that they can complain to the data protection authority, which in Spain is the AEPD.

The legal basis

Article 6 of the GDPR lists the grounds that allow personal data to be processed. For recording meetings, the ones usually considered are the company’s legitimate interests, performance of a contract and consent. In an employment relationship, consent is rarely seen as freely given, because employees aren’t on an equal footing with their employer; that’s why another basis is often used. If you rely on legitimate interests, it’s sensible to document why the recording is necessary and why it doesn’t override the rights of the people recorded.

A specific purpose and a time limit

“Just in case” isn’t a purpose. Decide what the recording is for: writing the minutes, training the team or documenting an agreement with a client. That purpose shapes everything else. If the recording is only for writing the minutes, keeping the transcript for a few weeks and deleting the audio may be enough. Set a retention period and, better still, make deletion automatic so it doesn’t depend on someone remembering.

Who can see it

A recording of a board meeting shouldn’t sit in the same folder as the team’s weekly catch-up. Limit access to the people who need it, review links shared outside the company and keep a log of who downloads or shares. If someone asks to exercise their rights, you’ll need to be able to find what you hold about them.

Your supplier and the data processing agreement

If you use an external tool to record or transcribe, that company processes the data on your behalf. Article 28 of the GDPR requires a data processing agreement setting out what it can do with it. Also check where the data is stored and processed, whether it’s used to train AI models and which other companies (sub-processors) are involved. If data leaves the European Union, additional safeguards are needed.

Particularly sensitive data

Some meetings involve special category data: a medical consultation, a conversation about an employee’s health or a disciplinary process. That data has stronger protection, and it’s worth reviewing the case with your data protection officer before recording. The same goes for voices when they’re used to identify someone: a voiceprint is biometric data. A tool recognising who’s speaking from their voice isn’t the same as separating the speakers, and the former calls for more care.

A quick checklist before recording

1. Define the purpose and legal basis, and write them down.
2. Mention it in the invitation and again as the meeting starts.
3. Decide who will have access and where it will be stored.
4. Set a retention period and automate deletion.
5. Sign a data processing agreement with the supplier and check where the data lives.
6. If health or other especially sensitive data is involved, check with your data protection officer first.

How Echo helps

No tool makes you compliant on its own: the decisions above are yours. What a tool can do is make them easier. This is how Echo approaches it:

• The assistant says it’s recording. It joins the Teams meeting under its own name, posts in the chat that the meeting is being recorded and, with its camera on, shows “This meeting is being recorded”. You can change its name and message, but the message must still say the meeting is being recorded.
• Data and AI in the European Union. Transcription and AI run on Edorteam’s own servers in the EU. Your meetings aren’t sent to third-party AI providers or used to train models.
• Automatic deletion after 7, 30, 90, 180, 365 or 730 days, for your personal files or a whole team workspace.
• Hiding personal data: ID numbers, phone numbers, bank accounts, cards and email addresses are replaced in the text and summary with placeholders such as [phone].
• Restricted folders for sensitive material, visible only to the people on the list. They don’t show up in search or answers for anyone without access either.
• An activity log of uploads, downloads, links, invitations and role changes, without the content of the meetings.
• A published data processing agreement at Encargo del tratamiento (in Spanish), and the list of sub-processors on the Security page.
• Voice recognition is off unless you turn it on. Echo separates speakers without storing their voiceprints.

Each person can also download all their data or delete their account from Settings, Your data. The technical detail is on the Security page and, if your company needs to review something specific before starting, get in touch through contact. One thing worth knowing: Echo doesn’t yet have certifications such as ISO 27001 or ENS.