GDPR and recorded meetings: lawful basis, notice and how long to keep them
A recording of an identifiable person is personal data. Three GDPR provisions decide most of what you need to do: a lawful basis, information for the people on the call, and a retention limit.
On this page
Key takeaways
- Recordings and transcripts of identifiable people are personal data under the GDPR.
- Choose and document a lawful basis (Article 6) before recording; legitimate interests and consent are the usual candidates.
- Give attendees the Article 13 information at the time of recording: purpose, basis, recipients, retention.
- Set a retention schedule: keep the summary, delete raw audio once it has served its purpose.
Pick a lawful basis before you record
Article 6 of the GDPR lists six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. For internal meeting recordings, organizations usually rely on legitimate interests or, less often, consent. Decide which one applies before you turn recording on, because it shapes everything else, including whether people can refuse.
| Basis | When it tends to fit | What it means for attendees |
|---|---|---|
| Consent | Optional recordings, external guests, sensitive discussions | Must be freely given and can be withdrawn |
| Legitimate interests | Routine internal meetings where notes serve a clear business purpose | Requires balancing your interest against attendees’ rights; they can object |
| Legal obligation | Recordings a law or regulator requires you to keep | Limited to what the obligation actually requires |
Tell people what happens to the recording
Article 13 requires you to give people information at the time you collect their data: who you are, why you process it, the lawful basis, who receives it and how long you keep it. A short line in the invite plus an announcement at the start of the call covers the moment of collection; a linked privacy notice covers the detail.
Keep it only as long as you need it
The storage limitation principle in Article 5(1)(e) means recordings should not be kept longer than the purpose requires. For most teams that means keeping the summary and deleting the audio and full transcript on a schedule.
Frequently asked questions
Do we always need consent to record a meeting?
No. Consent is one of six lawful bases. Many organizations rely on legitimate interests for routine internal meetings, but they must document the balancing test and respect objections.
Is an announcement at the start of the call enough?
It covers the moment of collection, but Article 13 also expects details such as recipients and retention. Link to a privacy notice that has them.
