You can record meetings lawfully, but only after documenting a lawful basis, telling participants and limiting retention. Regulator guidance from the EDPB treats a recording as personal data processing the moment it captures an identifiable voice or image. ICO guidance adds that consent is frequently the wrong tool at work, and standards bodies recommend treating approved minutes, not raw audio, as the record that survives.
TL;DR:
- Recording meetings without a documented lawful basis, clear notice, and justified retention periods can lead to non-compliance under GDPR and UK privacy laws.
- Consent is generally inappropriate as a lawful basis for employee recordings, due to power imbalances; legitimate interest or contractual necessity are often better suited.
- Maintaining a clear policy that explains purpose, lawful basis, access controls, and objections is crucial, with a Data Protection Impact Assessment recommended before systematic recording.
- Raw audio and transcripts should only be retained until approved minutes are finalized, with deletion afterward to reduce data exposure risks and simplify subject access.
- Using on-device transcription and strict technical controls such as encryption, access logs, and role-based restrictions help enforce privacy policies effectively.
Table of Contents
- Core legal principles that apply to meeting recordings
- Consent versus other lawful bases for employers and teams
- Building a compliant meeting-recording policy and process
- Retention, deletion and treating minutes as the record
- Technical and organisational controls that reduce risk
- Cross-jurisdiction considerations and higher-risk scenarios
- How privacy-first transcription supports a compliant workflow
- Priority actions for compliance leads
- Putting a privacy-first recording workflow into practice
- Principal regulator and standards documents to consult
- Sources
- FAQ
Core legal principles that apply to meeting recordings
A meeting recording counts as personal data whenever a voice, face or transcript line can be tied to a specific person. That covers video, audio and the text a transcription tool produces, whether the meeting is internal or includes external parties.
Under GDPR, the EDPB's guidance on lawful processing sets out the tests that apply before you press record:
- Lawful basis: you need a documented reason under Article 6, and consent is only one of several options.
- Purpose limitation: use the recording only for the reason you gave participants, not for unrelated performance reviews or disputes later.
- Data minimisation: capture only what the stated purpose requires, not a running archive of every call.
- Storage limitation: keep the recording only as long as the purpose demands.
- Accountability: be ready to show your reasoning, not just assert it.
Special-category data raises the bar further. A meeting that touches health, union membership or similar topics can trigger Article 9 conditions on top of the Article 6 basis, so screening the agenda before recording matters as much as the recording itself.
Consent versus other lawful bases for employers and teams
Employee consent is often the wrong basis for workplace recording because of the power imbalance between employer and staff. The ICO's guidance on monitoring workers is explicit that genuine consent must be freely given and easily withdrawable, conditions that rarely hold when a manager asks a direct report to agree to being recorded.
Work through the decision in this order:
- Test whether consent can be genuine. If declining would carry any real or perceived career cost, consent is not the right basis, and a separate lawful basis such as legitimate interest or contractual necessity should be documented instead.
- Run a legitimate-interest assessment where relevant. Document the necessity test (is recording the least intrusive way to achieve the purpose) and the balancing test (does the organisation's interest outweigh the individual's privacy expectation), and keep that assessment on file.
- Use contractual or legal-obligation bases where they fit. A recording made to satisfy a regulatory record-keeping duty, for example, does not need consent at all.
- For external participants, give a clear, separate notice. State the purpose plainly and offer a genuine way to opt out, rather than treating attendance as implied agreement.
Documenting which basis applies, and why, is the single step that protects an organisation if a regulator or an individual later asks.
Building a compliant meeting-recording policy and process
A written policy is the backbone of compliance, and it needs to answer the questions a participant or regulator will actually ask. At minimum, it should state the purpose of recording, the lawful basis relied on, the retention period, who has access, a named contact and how someone can object or request erasure.
Before recording becomes routine, screen for a Data Protection Impact Assessment. The ICO's guidance on monitoring workers treats systematic or large-scale monitoring as a DPIA trigger, and any third-party transcription vendor should be checked and bound by contract before recordings ever reach them.
Operationally, a workable checklist looks like this:
- Give pre-meeting notice stating the purpose and lawful basis, not just a generic "this call may be recorded" line.
- Offer a genuine alternative, such as written minutes only, for anyone unwilling to be recorded.
- Automate retention, so raw files delete on a schedule rather than relying on someone remembering.
- Log access, so you can show who viewed or exported a recording and when.
- Prepare a subject-access process, since a recording containing someone's voice is data they can request a copy of.
Pro Tip: Draft your subject-access response process before you start recording routinely, not after the first request lands.
Retention, deletion and treating minutes as the record
Retention has to be justified by a documented reason, not a default setting left untouched since installation. GDPR sets no single universal retention period, so the right length depends on the purpose you recorded for in the first place.
A common best practice pattern from standards guidance on minutes recommends keeping raw audio and transcripts for a limited period after minutes approval, typically a short retention period. Longer retention periods may be justified only in cases like active litigation holds or specific regulatory requirements.
- Minutes as the canonical record: the OASIS best-practice guidance on meeting minutes treats concise, approved minutes, rather than the verbatim recording, as the decision record, with raw material kept only as supporting evidence during review.
Following that pattern, the raw file loses its purpose once the minutes are approved, and deleting it removes most of the ongoing subject-access and retention exposure in one step.
Technical and organisational controls that reduce risk
Policy only works if the technical setup enforces it. Role-based access, audit logs and automated deletion turn a retention policy from a document into something that actually happens.
Encryption in transit and at rest is the baseline expectation for any recording containing identifiable voices, and processing recordings on-device rather than routing them through a third-party server reduces how many parties ever touch the raw file, a point covered in more detail in how on-device processing limits what leaves your device.
Transcripts need their own handling rules:
- Redact sensitive detail before wider circulation, particularly names tied to health or disciplinary matters.
- Label speakers consistently, so access can be restricted by role rather than granted wholesale.
- Route transcripts through an approval step before treating them as final, since a raw transcript is a working document, not a minute.
Pro Tip: Treat the raw transcript as a draft every time, even when the transcription is accurate, because approval is what turns it into an official record.
Cross-jurisdiction considerations and higher-risk scenarios
EU and UK regulators broadly converge on the same expectations: document your lawful basis, give notice and run a DPIA where monitoring is systematic. Outside the EU and UK, interception laws vary, and some jurisdictions impose stricter authorisation requirements before any recording can be made at all, so a global organisation cannot assume one policy covers every office.
Certain contexts push the compliance bar higher regardless of jurisdiction:
- Special-category data, such as health or union-related discussion, which can trigger Article 9 conditions on top of the ordinary lawful basis.
- Home-working recordings, which risk capturing household members who never agreed to anything.
- Anything touching law-enforcement or regulatory investigation, where separate legal frameworks may apply.
Where any of these apply, involve the data-protection officer and take legal advice before recording becomes routine practice.
How privacy-first transcription supports a compliant workflow
A transcription workflow that keeps audio on-device by default addresses several of the steps above directly, rather than adding process on top of them. When processing happens locally, the recording never becomes a routine feed into a third-party processor's servers, which narrows the vendor-governance question considerably. Minuted's on-device transcription approach works this way by default, with cloud processing used only when a user chooses it.
Speaker labelling ties each segment to a person, which supports narrower access control and makes it easier to redact one contributor's remarks without touching the rest. Calendar and task integrations then let a recording convert into an approved action list quickly, shortening the window during which raw material needs to exist at all.
Priority actions for compliance leads
If you run compliance for an organisation that records meetings, the sequence matters more than the tooling. Document your lawful basis and publish a plain-language notice before you record anything routinely, then set a short default retention period rather than leaving it open-ended.
Treat approved minutes as the record and delete raw material once they exist, and run a DPIA the moment recording becomes systematic rather than occasional. For a project-governance angle on keeping decisions traceable once minutes replace transcripts, see this guide to audit-ready decision logs.
— James
Putting a privacy-first recording workflow into practice
Some transcription tools enable a compliance-friendly workflow by using on-device transcription and offline operation so recordings do not need to leave the device unless cloud processing is explicitly chosen.
Calendar integrations with Google and Outlook, plus syncing to Todoist, monday.com and Notion, let a recording become an approved minute and a set of tasks quickly, cutting the time raw audio needs to sit anywhere. The Free plan covers unlimited local mode, and the Pro and Ultimate plans add cloud minutes and integrations for teams that want the extra reach. Vendor privacy commitments matter here too, and reviewing a processor's own privacy policy is worth doing before signing any contract, Minuted's own pricing page sets out exactly what each tier includes.
Principal regulator and standards documents to consult
For the underlying detail, the EDPB's guide to lawful processing and its FAQ on recording calls cover the EU position, while the ICO's guidance on monitoring workers covers UK employment context and DPIA screening. The OASIS best-practice guidance on minutes explains why minutes, not raw recordings, should serve as the record.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- EDPB — Process personal data lawfully (SME Data Protection Guide)
- ICO — Data protection and monitoring workers
- OASIS — Best practices for meeting minutes
FAQ
What are the legal requirements for recording meetings in the UK?
UK organisations need a documented lawful basis under GDPR, clear notice to participants about the purpose and their rights, and a retention period they can justify. The ICO's guidance on monitoring workers also expects a DPIA where monitoring is systematic.
Can my employer refuse to let me record a meeting?
Yes, an employer can set rules on recording meetings, since the recording itself involves processing personal data and the organisation controls how that happens. Where an employee wants to record for their own purposes, such as a grievance meeting, the employer's policy and any relevant employment rules will govern whether that is permitted.
Is it illegal to voice record a meeting without permission?
Recording without informing participants can breach transparency obligations under GDPR, since a voice recording is personal data and the EDPB's guidance on lawful processing requires people to be told about the purpose and their rights. Separate interception rules may also apply depending on the context, so the safer route is always to give notice first.
What are the GDPR rules for recording calls?
Under GDPR, recording a call containing an identifiable voice requires a lawful basis, and the EDPB's FAQ on recording telephone calls confirms that callers must be told the purpose, who will see the recording and how to exercise rights such as access or objection. Consent is one possible basis, but it is not the only one, and organisations often rely on legitimate interest instead once they have documented that assessment.