Recording and transcribing meetings under the GDPR: a complete guide

Recording meetings is no longer unusual. People record to avoid taking notes, to help those who couldn’t attend catch up, to have reliable minutes or so that a tool can pull out the actions. If the recording is also transcribed, the content is no longer locked inside an audio file: it can be searched, summarised, shared and quoted. All of that is useful, and all of it is processing of personal data. In Spain, the General Data Protection Regulation (GDPR) applies together with Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which supplements it. If you’d like a short version focused on Teams, see Recording Teams meetings and the GDPR. Here we go into more depth.

This guide is general information, not legal advice. Every organisation, every type of meeting and every sector has its own nuances. Before deciding how to record, check with your data protection officer (DPO) or your lawyer.

What data you process when you record a meeting

A video recording contains each participant’s face and voice; an audio recording, at least their voice. The transcript adds the text of what each person says, usually with their name and the time. And if you use an AI tool, derived data appears: summaries, actions with an owner, attributed decisions or analysis of how much each person speaks. On top of that come the metadata: who was invited, their email addresses, the date and the length. It’s worth keeping all of it in mind when you write up your record of processing activities, because each of these elements can have a different use and retention period. Keeping a transcript to write the minutes isn’t the same as using conversation analytics to assess a person.

Who’s who: controller, processor and sub-processor

• Controller: the organisation that decides to record, why and how. If your company records its meetings, it’s the controller, even if an external tool does the recording. It answers to the people recorded and to the Spanish Data Protection Agency (AEPD).
• Processor: the supplier that records, transcribes or stores the data on the controller’s behalf and following its instructions. It can’t use the data for its own purposes. The relationship is governed by a data processing agreement (Article 28 GDPR).
• Sub-processor: another company the processor relies on to provide the service, such as a data centre, an email provider or a payment service. The processor needs the controller’s authorisation, which can be general with notice of changes, and has to pass on the same obligations.

There’s an important nuance: if a supplier uses your recordings to train its AI models or for any other purpose of its own, it stops acting purely on your behalf for that part and starts making its own decisions. That complicates your position, because you’d have to tell people about that disclosure and justify it. That’s why the training question is one of the first to ask when choosing a tool.

The legal basis by type of meeting

Article 6 GDPR lists the bases that allow data to be processed: consent, performance of a contract or of pre-contractual steps, legal obligation, vital interests, a task in the public interest or the exercise of official authority, and legitimate interests. There’s no single basis for “recording meetings”: it depends on who takes part and why you record. These are the most common cases and how they’re usually approached:

• Internal team meetings: the usual approach is to assess the company’s legitimate interest in documenting agreements and organising work, with a written balancing test. Consent fits poorly, for the reasons in the next section.
• Meetings with clients or suppliers: legitimate interests may work or, if the recording is necessary to provide the contracted service, performance of the contract. Always say so at the start and offer not to record if the other side prefers; many companies also include it in their terms.
• Job interviews: the candidate is in a sensitive position and the process may end in a decision that affects them. If you record, define the purpose clearly (for example, so another team member can assess the interview), limit who sees it, delete recordings of people who don’t go forward promptly and don’t use automated analysis to decide. Offering an interview without recording is good practice.
• Public bodies: a public authority can’t rely on legitimate interests for what it does in performing its tasks. Its basis is usually a task in the public interest or a legal obligation, depending on the rules governing that body or activity. Public sessions of collegiate bodies also have their own rules on publicity and minutes.
• Training, webinars and events: if the recording will be published or distributed, the analysis changes because faces and voices reach third parties. Here the speakers’ consent is the clearest route, and the audience should know whether they appear in the recording.

Consent or legitimate interests at work

Consent is only valid if it’s freely given, specific, informed and unambiguous, and the person must be able to withdraw it without detriment. In an employment relationship that’s hard: someone who works for a company isn’t on an equal footing to say no, and data protection authorities point this out regularly. What’s more, if someone withdraws consent halfway through a series of meetings, you’d have to stop recording them or processing what was recorded, which is hard to manage in practice.

That’s why many companies choose legitimate interests for internal meetings. It isn’t automatic: it requires a documented balancing test. Write down what the interest is (reliable minutes, not relying on memory, helping absent colleagues catch up), why recording is necessary and something less intrusive wouldn’t do, what the people recorded can reasonably expect and which measures reduce the impact: advance notice, limited access, a short retention period, automatic deletion. Bear in mind too that the LOPDGDD has specific rules when sound recording is used as a means of monitoring employees. Recording to write the minutes isn’t monitoring, but if the recording ends up being used to assess or discipline people, the analysis is different.

The duty to inform

Article 13 GDPR requires you to inform people at the time the data is collected, which means before the recording starts. The LOPDGDD allows a layered approach: brief basic information first, and a link or address where people can read the rest. In a meeting, the practical approach is to put it in the invitation, repeat it at the start and have the full policy to hand. The information must cover, at least:

• Who the controller is and how to contact their data protection officer, if there is one.
• Why the meeting is recorded and transcribed, and on what legal basis. If you rely on legitimate interests, which ones.
• Who receives the data, including the suppliers that record or transcribe.
• Whether the data leaves the European Economic Area and with what safeguards.
• How long the recording, transcript and summaries are kept, or the criteria for deleting them.
• What rights each person has and that they can complain to the AEPD.

An example of a first layer for an invitation, which you’ll need to adapt: “This meeting will be recorded and transcribed to write the minutes and help follow up on actions. Controller: [company], on the basis of its legitimate interest in documenting agreements. Access will be limited to the people invited and to [supplier], which processes the data on our behalf in the European Union. The recording will be deleted after [period]. You can exercise your rights and find more information at [link or email]. If you’d rather your contribution wasn’t recorded, let us know before we start.”

Voices, health and other special categories

Article 9 GDPR prohibits, in principle, processing special categories of data, except in the cases it lists. They include health data, data revealing political opinions, trade union membership, beliefs or sexual orientation, and biometric data used to uniquely identify a person. In a meeting they can come up without anyone looking for them: sick leave being discussed, a disciplinary process, a meeting with the works council. If you know in advance that a meeting will cover these topics, think about whether it really needs recording, keep it with restricted access and review the case with your DPO.

Voices deserve a section of their own. Separating speakers (“Speaker 1”, “Speaker 2”) groups audio segments that sound alike, without knowing who anyone is. Recognising someone by their voice is something else: it requires storing a voiceprint and comparing it with those from other recordings to put their name in automatically. That voiceprint is biometric data used for identification, and it falls under Article 9. If a tool offers this feature, check that it’s off by default, that you can turn it off and that the voiceprint never leaves the system. And if you decide to turn it on, you’ll need one of the Article 9 exceptions, usually each person’s explicit consent.

Choosing a supplier: the data processing agreement

Article 28 GDPR says you may only use processors that provide sufficient guarantees and that the relationship must be set out in a contract or other legal act. Many suppliers publish their data processing agreement and you accept it when you sign up. Before you do, go through this list:

• Subject matter and duration: what data is processed, for what and for how long.
• Only on your instructions: the supplier mustn’t use the data for its own purposes or to train AI models.
• Confidentiality of the supplier’s staff who access the data.
• Specific security measures: encryption, access control, backups and an activity log.
• Sub-processors: a public list, and advance notice of changes so you can object.
• Location of the servers and the AI services, and safeguards if anything leaves the EEA.
• Help with rights requests and with security breaches, with a notification deadline.
• End of the service: you can export your data and it’s deleted when you leave, including backups.

International transfers

Many transcription and AI tools process data outside the European Economic Area, mostly in the United States, or send the text to a language model provider based there. That’s an international transfer, and Chapter V of the GDPR requires a basis for it: an adequacy decision from the European Commission, standard contractual clauses with any supplementary safeguards needed, or other mechanisms in the regulation. A contract saying “servers in Europe” isn’t enough: ask where the AI runs, where backups are kept and where technical support can access data from. The fewer hops there are, the easier it is to explain in the information you give people and in your records.

How long to keep it

The storage limitation principle says data is kept only as long as necessary for the purpose. Think about each piece separately. The audio or video is usually needed for a short time: until the minutes are approved or the action is done. The transcript and summary may have a somewhat longer period if they serve as a reference. What makes no sense is keeping everything forever “just in case”. Set periods by type of meeting, include them in the information and, above all, make deletion automatic: it’s the only way it actually happens. Remember that backups and bins count too, and your supplier should tell you how long it takes for data to disappear from them.

People’s rights

Anyone recorded can ask for access to their data, rectification, erasure, restriction of processing or object to it, and in some cases portability. You must reply within a month, extendable by two more if the request is complex, letting them know about the delay. In practice, access is the most common and the most laborious: you need to be able to find the meetings someone appears in and give them what concerns them without revealing other people’s data. A tool that can search by person and by word helps a lot. For objections in internal meetings, have your answer ready: what you do if someone doesn’t want their voice recorded (not recording that meeting, pausing during their turn, or summarising without recording). And erasure must also reach the summaries, actions and clips that came from the recording.

Step by step

1. Define why you record each type of meeting and note it in your record of processing activities.
2. Choose the legal basis for each type of meeting and, if it’s legitimate interests, write up the balancing test.
3. Check whether any meeting could involve special category data and, if so, consult your DPO.
4. Assess whether a data protection impact assessment is needed, especially if you’ll use automated analysis of people or voice recognition.
5. Choose a supplier using the data processing agreement checklist and review its sub-processors and where the AI runs.
6. Write the information in two layers and add it to your invitations.
7. Remind people at the start of each meeting and offer an alternative to anyone who doesn’t want to be recorded.
8. Limit access: folders or workspaces per team, and take care with public links.
9. Set up automatic deletion with the period you’ve decided on.
10. Prepare how you’ll respond to rights requests and review everything once a year.

Where Echo fits in

The decisions above are yours: no tool makes you compliant on its own. What it can do is avoid making things harder. Echo is made by Edor Team Soft, S.L., a Spanish company, and for businesses it acts as processor for what’s in the recordings. This is how it handles the points in this guide:

• Own servers in the EU: transcription and AI run on Edorteam’s own servers in the European Union. Meetings aren’t sent to third-party AI providers.
• No training: the AI isn’t trained on your meetings or anyone else’s.
• A published data processing agreement at Encargo del tratamiento (in Spanish), and the list of sub-processors on the Security page.
• Automatic deletion after 7, 30, 90, 180, 365 or 730 days, for personal files or a whole team workspace. Anything deleted by hand goes to the bin and is removed completely after 30 days.
• Hiding personal data: Spanish ID numbers, phone numbers, bank accounts, cards and email addresses are replaced in the text and summary with placeholders such as [DNI], automatically if you turn it on.
• Restricted folders for sensitive material: only people on the list get in, and their content doesn’t appear in searches or answers for anyone without access.
• Activity log of uploads, deletions, downloads, links, invitations and role changes, without storing meeting content.
• Single sign-on (SSO) with your organisation’s identity provider, and policies to limit links, downloads or the use of AI in a workspace.
• The assistant announces that it’s recording: it joins Teams under its name, writes in the chat that the meeting is being recorded and shows “This meeting is being recorded” on its camera. You can change the name and the message, but not remove the notice.
• Voice recognition off by default: Echo separates speakers without storing their voiceprint. It only stores one if you turn the option on in Settings, and you can turn it off whenever you like.

Two things worth knowing. If you record with the Chrome extension or Live, or upload a file, Echo isn’t in the meeting to announce it: the notice is up to you. And Echo doesn’t yet have certifications such as ISO 27001 or ENS. Each person can download all their data or delete their account from Settings, Your data. The technical detail is on the Security page, team features are under Teams and, if your DPO needs to review something before you start, get in touch through contact.