GDPR and AI meeting transcription: who is actually responsible

The short answer, and who carries the obligation

A vendor can help you comply. A vendor cannot be compliant on your behalf. GDPR hands out duties by role, not by product.

The organisation that decides why a meeting is recorded and how the recording is used is the controller (Article 4(7)). The company whose software turns that audio into text on your instructions is the processor (Article 4(8)). You are the controller when you record a client call, a stand-up, an interview or a lecture. Almost every enforceable duty on this page sits with you, not with the app.

So when a tool's homepage says "GDPR compliant", read it as shorthand for "we built features that let a controller comply". Article 42 does allow official certification schemes, but very few exist, and nobody can claim one they have not been granted.

Plain disclaimer, up front. This is general information for people choosing a tool for work. It is not legal advice. The law changes and national rules differ. If the recordings matter, ask a lawyer or your data protection officer.

One line worth knowing early: under Article 28(10), a processor that starts deciding purposes and means of its own becomes a controller for that processing. That is the line a vendor crosses when it trains its own models on your recordings.

Choosing a lawful basis for recording a meeting

Every recording needs one of the six lawful bases in Article 6(1). For meetings only two are realistic: consent under Article 6(1)(a), or legitimate interests under Article 6(1)(f). Pick one, write down which, and be able to explain it later.

Consent is stricter than people expect. Article 4(11) says it must be freely given, specific, informed and unambiguous, and Article 7(3) says a person can withdraw it at any time, as easily as they gave it. Most teams never answer the obvious follow-up: if one of eight people withdraws two days later, what happens to the file, the transcript, and the summary already emailed round?

Consent is weakest exactly where companies lean on it hardest, which is with their own staff. The Article 29 Working Party's Opinion 2/2017 on data processing at work concluded that consent cannot be a valid basis for most workplace processing, because the imbalance of power between employer and employee means it is rarely freely given.

Legitimate interests is not the easy option either. The EDPB's guidance on Article 6(1)(f) sets a three-step test: name the interest, show the processing is necessary for it, then balance it against the rights and reasonable expectations of the people recorded. Necessity is where most recordings fail. If written notes would do the job, recording everyone in the room is hard to call necessary.

Transparency: what you tell people, and when

Article 13 applies when you collect personal data from the person it belongs to. Recording someone's voice is collecting from them directly, so the information is due at the time of collection. In plain terms: before you press record, not in a follow-up email.

Article 12(1) adds that it must be concise, transparent, intelligible, easily accessible and in clear, plain language. A link to a 4,000-word policy nobody opens does not really meet that.

Two channels work together. Put a short line in the calendar invite so people know before they join, then say it out loud at the start. The spoken version is useful evidence because it sits inside the file itself, timestamped, with everyone present. The wording and the awkward cases are in do you have to tell people you're recording a meeting.

• Who you are. Controller identity and contact details, plus a DPO if you have one.
• Why you are recording. The purpose, in one plain sentence.
• Your lawful basis. Consent or legitimate interests, and what that interest is.
• How long you keep it, and who else sees it, including the vendor and its cloud provider.
• Whether it leaves the EEA, and which transfer safeguard covers that.
• Their rights. Access, rectification, erasure, objection, withdrawal, and complaining to a supervisory authority.

Record less, keep it less

Article 5(1)(c) says personal data must be adequate, relevant and limited to what is necessary. Article 5(1)(e) says you keep it no longer than you need it. Both are easy to break with a tool that makes recording quick enough to become a reflex.

In practice: skip the small talk before the meeting starts, stop recording for the HR item someone raises, and do not record every one-to-one just in case. A recording you never needed is a risk you took for nothing.

Retention is the failure most teams only notice during an audit, because recordings pile up in a shared drive for years and nobody set a date. Decide a period per type of meeting, write it down, and check the tool can enforce it, including in backups and at the sub-processor. Sensible ranges are in how long you should keep meeting recordings.

Article 5(2) is what catches people out. Doing the right thing is not enough, you have to show you did it: a written basis, a written notice, a written retention rule, and a record of processing under Article 30. The Article 30(5) exemption for organisations under 250 employees helps less than it looks, because it falls away when processing is not occasional, and weekly meeting recording is not occasional.

Special category data, biometrics, and DPIAs

Article 9(1) treats some data as special category: health, beliefs, trade union membership, political opinions, racial or ethnic origin, sex life, plus biometric data used to identify someone. It needs a condition under Article 9(2) on top of your Article 6 basis, usually explicit consent.

You cannot control which of those turns up in a meeting. A supplier call becomes special category data the second a customer explains a health reason for a missed deadline. A human note taker writes "delay agreed" and moves on. A recorder keeps the sentence in full, in the audio and in a searchable transcript.

The biometric question comes up constantly, so here is the precise answer. Voice recordings are biometric in nature, but Article 9 only bites when biometric data is processed for the purpose of uniquely identifying a natural person. Speaker labels that split one file into Speaker 1 and Speaker 2 separate voices inside that recording, they do not match anyone against a stored voiceprint. Voice authentication, or a saved voice profile reused across recordings, crosses that line. Ask your vendor which it does.

On DPIAs: Article 35(1) requires one where processing is likely to result in a high risk to people's rights and freedoms, especially with new technology. Article 35(3) names three cases where one is always required, including large-scale processing of special category data. Regulators also publish their own lists under Article 35(4), so check yours.

Requests from the people in the recording

Anyone who spoke in a meeting you recorded is a data subject, and they exercise their rights against you, not the app.

Access, Article 15. They can ask for a copy of their personal data, and what they said is their personal data. The Article 12(3) deadline is one month from receipt, extendable by two further months for complex requests if you tell them within the first month and explain why.

The awkward part. A recording contains several people. Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others, so handing over raw audio of a six-person meeting because one person asked is usually wrong. Supply the relevant transcript sections instead, redacting others where you can.

Erasure, Article 17. If your basis was consent and it is withdrawn, Article 17(1)(b) applies. If it was legitimate interests and they object under Article 21(1) with nothing overriding on your side, Article 17(1)(c) applies. Either way you must find one person's data, which is impossible if you do not know which recordings exist.

Rectification, Article 16. An automatic transcript is not automatically accurate. If it puts a sentence in the wrong person's mouth or mangles a name, that is inaccurate personal data and the person can ask you to fix it. Pick a tool where the transcript can be edited and the summary regenerated, so the correction carries through.

Where the audio is processed: international transfers

Almost every AI transcription tool sends audio to a server rather than running the model on your phone. So Chapter V of GDPR, Articles 44 to 49, is in play the moment that server sits outside the EEA.

You have three routes. An adequacy decision under Article 45. Standard contractual clauses under Article 46(2)(c), plus a transfer impact assessment. Or a derogation under Article 49, which is written for occasional situations, not for a pipeline that runs every working day.

For the United States the relevant instrument is the EU-U.S. Data Privacy Framework adequacy decision, covering transfers to US organisations that have self-certified to it. Its status is settled for now, not permanently: the EU General Court rejected the action to annul it in Latombe v Commission on 3 September 2025, and, as of September 2026, an appeal against that judgment is still pending at the Court of Justice as Case C-703/25 P. Check the docket before you lean on this, because the day the Court rules the answer can move. Anyone selling you certainty about US transfers is overselling.

Check the vendor and its sub-processors yourself on the official Data Privacy Framework list rather than trusting a logo on a pricing page, and ask for a written sub-processor list with notice before it changes.

Do not confuse two questions. "Encrypted at rest" is a security measure under Article 32. "Stored in the EU" is a transfer question under Chapter V. A vendor can say yes to the first and still send your audio across an ocean. See where are my meeting recordings stored.

National rules that sit on top of GDPR

GDPR is not the only law that governs recording a conversation. The extra rules are sometimes stricter, and sometimes criminal.

Germany is the clearest example. Section 201 of the German Criminal Code, violation of the confidentiality of the spoken word, makes it a criminal offence to record the non-public spoken word of another person without authorisation, punishable by up to three years in prison or a fine. Passing that recording to a third party can be a separate offence. This is criminal law. It applies however tidy your GDPR paperwork is, and it means every participant has to agree before recording starts.

Germany adds a second layer for employers. Where a works council exists, Section 87(1)(6) of the Works Constitution Act gives it co-determination over technical equipment designed to monitor employee behaviour or performance, and German courts read that broadly. No agreement, no rollout.

Article 88 is why this varies so much: each member state can write its own rules for the employment context, so a French, German, Dutch and Polish workforce do not get the same answer.

The UK kept UK GDPR, then amended it with the Data (Use and Access) Act 2025. Its data protection provisions came into force on 5 February 2026, and from 19 June 2026 controllers need a complaints process, acknowledging complaints within 30 days.

France shows the same idea in a softer form. There is no Section 201 equivalent, but Article L2312-38 of the Labour Code makes the employer inform and consult the works council before bringing in any technique that allows employee activity to be monitored. A tool rolled out quietly is already defective on that point before anyone opens the GDPR question, which is exactly what Article 88 is there to allow.

Outside Europe the test stops being GDPR and becomes local consent law, decided state by state in the US. That is a different question with different answers, and it is set out country by country in meeting recording laws by country.

The GDPR contract questions to put to a vendor

The wider security review — encryption, who inside the vendor can play a recording, backups, share links, certifications — is a separate job, and it is laid out in the AI note taker security checklist. The questions below are the narrower set: the ones that come straight out of the Article 28 contract and Chapter V, and that a processor has to answer in writing rather than in a sales call.

Send them before you buy, not after, and ask for the answers in the data processing agreement rather than in an email. Article 28(9) says the contract has to be in writing anyway, so anything a salesperson promises that is not in the DPA is not a processor obligation you can enforce.

Where Noter AI stands, plainly

This site sells an AI meeting recorder, so here is where most pages would add a GDPR badge. We are not going to. Here is what is documented and what is not, so you can hold it against the checklist above.

Documented. Transcription happens in the cloud, not on your device, so the audio does leave your phone. Data is encrypted in transit and at rest. The privacy notice names the third-party services it relies on, Google Vertex AI for transcription and Google Firestore for storage, and says data may be processed in other countries. Treat that as the notice's own list rather than as a full sub-processor register with advance notice of changes, which is the Article 28(2) artefact a procurement team will ask for. You can delete a note at any time, and deleting your account deletes your data. On free accounts, recordings and transcriptions are removed automatically after 90 days.

Not documented. No SOC 2 report, no ISO 27001 certificate, no HIPAA compliance and no BAA. No published EU-only data residency, and no standard data processing agreement offered today. If your organisation needs any of those on paper before a tool is approved, Noter AI is not the right pick, and it is better to hear that now than three weeks into a procurement review.

Where it helps. Retention and deletion sit in your hands. The transcript is editable and the summary can be re-run after a fix, which is what Article 16 rectification asks for. For in-person meetings, recording runs from your own phone, so no bot with a company name joins the room. On Zoom, Meet, Teams and Webex a bot does join the call, and its visible presence is a useful prompt to give the notice, not a substitute for giving it. Either way the Article 13 duty is yours and not the app's, which is where GDPR puts it.

On accuracy, which is a duty and not just a quality question. Article 5(1)(d) says personal data must be accurate and, where necessary, kept up to date, and a transcript that puts a sentence in the wrong person's mouth is inaccurate personal data about a named individual. Transcription here covers 60+ languages with automatic detection, and language is tagged word by word, so a meeting that runs half in German and half in English comes back readable in both instead of the second language being transliterated phonetically. That matters less as a feature and more as the difference between a record you can stand behind and one you end up correcting under Article 16.

On price, $9.99 a month or $49.99 a year, flat rather than per seat. That has a compliance edge as well as a budget one. Seat licences push small teams toward sharing one login, and a shared login wrecks your accountability record under Article 5(2), because you can no longer say who made a recording, who agreed the lawful basis for it, or whose erasure request it belongs to. One subscription per person keeps that chain intact. There is a free trial. It is on the App Store and Google Play.

Whichever tool you pick: write down your lawful basis, put the notice in the invite and say it out loud, set a retention period the tool can enforce, then send the eight contract questions above to your vendor and keep the answers in writing.