Quick answer: An AI note taker can be used under GDPR, but no tool makes you compliant on its own. Your organisation is the controller, so you need a lawful basis for recording, a clear notice to every participant, a data processing agreement with the vendor, a lawful route for any transfer outside the EU or UK, sensible retention, and a DPIA for higher-risk meetings.
AI note takers are now common in sales calls, interviews, one-to-ones and board meetings. For teams in the EU and UK, the question is rarely "is this tool allowed?" and more often "what do we have to do before we switch it on?" This checklist walks through the points a data protection lead will ask about, in the order you will usually meet them.
This article is general information, not legal advice. Data protection rules depend on your sector, your country and the meetings you record, so check your setup with your DPO or a lawyer.
Are AI note takers GDPR compliant?
A tool on its own is not "compliant" or "non-compliant". GDPR places most duties on the controller, the organisation that decides why and how personal data is processed. When your team records and transcribes a meeting, that is usually you. The vendor is normally a processor acting on your instructions.
So the useful question is: can you use this tool in a way that meets your obligations? That depends on three things:
- Your choices: which meetings you record, what you tell people, how long you keep transcripts and who can see them.
- The vendor's terms: whether it signs a data processing agreement, which sub-processors it uses, and whether it uses your data for its own purposes such as model training.
- The context: an internal stand-up is very different from a disciplinary hearing or a patient consultation.
Be wary of any vendor that says its product makes you "GDPR compliant". Ask for the documents instead: the DPA, the sub-processor list and the security information.
What lawful basis do you need to record meetings under GDPR?
Every processing activity needs one of the lawful bases in Article 6 of the GDPR. For meeting recording and transcription, two are usually discussed: consent and legitimate interests.
Consent
Consent must be freely given, specific, informed and as easy to withdraw as to give. That is hard to achieve inside an organisation. An employee asked by their manager whether a one-to-one can be recorded may not feel free to say no, and if someone withdraws consent halfway through, you need a way to stop. Consent works best for external participants who genuinely can decline, such as a prospect on a sales call or a candidate in an interview, as long as declining has no consequences for them.
Legitimate interests
Many organisations rely on legitimate interests for routine internal recording: accurate notes, fewer missed action items, a record of decisions. This needs a three-part test, often written up as a legitimate interests assessment: is there a real purpose, is recording necessary for it, and do the participants' interests override yours? The UK regulator's ICO guidance on legitimate interests says this basis fits best where people would reasonably expect the use and the privacy impact is minimal.
Whichever basis you choose, recording someone also needs consent where the law requires it. Some countries and some sectors have separate rules on recording conversations, on top of GDPR. Our guide to whether it is legal to record meetings with AI and what to tell participants covers this in more detail.
How do you inform meeting participants?
Article 13 of the GDPR says that when you collect personal data from people, you must tell them at that time who you are, why you are processing the data, your lawful basis (including the legitimate interest, if you rely on one), who receives it, any transfers outside the EU, how long you keep it and what rights they have.
In practice, a layered approach works well:
- A short line in the calendar invite so people know before they join.
- A spoken reminder at the start of the meeting, especially when guests join late.
- A link to your privacy notice with the full Article 13 details.
- A clear way to object, such as replying to the organiser or asking for recording to be switched off.
This applies equally to bot-free recording. A visible bot in the participant list at least signals that something is happening. When you record through a desktop app or browser extension, nobody sees a bot join, so the notice has to do all the work. Bot-free recording is a convenience, not a way around the duty to tell people.
A ready-to-use notice for meeting invites
Paste this into invites and adapt the brackets. Have your DPO check it against your privacy notice before you roll it out.
This meeting will be recorded and transcribed by an AI note-taking tool so we can keep accurate notes, action items and decisions. [Organisation] is responsible for this data. Recordings and notes are kept for [period] and shared only with [who]. If you would prefer not to be recorded, reply to this invite or tell the organiser at the start, and we will [switch recording off / take manual notes]. More about how we use personal data and your rights: [link to privacy notice].
Keep the invite text short. People read the first two lines; the privacy notice carries the detail.
Do you need a data processing agreement with the vendor?
Yes. Under Article 28, when a processor handles personal data on your behalf, there must be a contract that sets out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people involved. The processor must act only on your documented instructions, keep staff bound by confidentiality, and get your authorisation before using sub-processors.
When you review an AI note taker's DPA, check:
- Sub-processors: who they are, what they do (for example transcription or AI model providers) and how you are told about changes.
- Use of your data: whether recordings and transcripts are used to train the vendor's models or a third party's models.
- Deletion: what happens to recordings, transcripts and backups when you delete them or leave.
- Assistance: how the vendor helps you answer access and erasure requests and handle breaches.
For Acta, you can read about our approach on the Acta security page and request a DPA or ask specific questions through our contact page. Acta does not use customer data to train AI models; we explain why in why we don't use customer data to train our AI models.
What about transfers outside the EU and UK?
If recordings or transcripts are processed outside the EEA, directly or by a sub-processor, the transfer needs a legal route. The common ones are:
- Adequacy decisions, where the European Commission has decided a country offers adequate protection.
- The EU-US Data Privacy Framework (DPF), an adequacy decision adopted on 10 July 2023. It covers transfers to US organisations that have self-certified under the framework. The EU General Court rejected a challenge to it in September 2025, though it remains open to further legal scrutiny. The EDPB's FAQ on the Data Privacy Framework explains how individuals can complain.
- Standard Contractual Clauses (SCCs), usually with a transfer impact assessment, where no adequacy decision applies.
Ask the vendor where data is processed, which sub-processors are in which countries, and which mechanism covers each transfer. Then make sure your privacy notice mentions the transfer, as Article 13 requires.
When do you need a DPIA for an AI note taker?
Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to people's rights and freedoms, particularly when new technologies are involved. The ICO's guidance on DPIAs lists examples such as large-scale processing of special category data and systematic, extensive processing with significant effects on people.
For meeting recording, a DPIA is a sensible step, and often a required one, when:
- You plan to record many meetings across the organisation by default.
- Recordings will include health, HR or other sensitive discussions.
- Transcripts may feed into decisions about people, such as performance reviews or hiring.
- AI features analyse what people said across many meetings.
Even when it is not strictly required, a short DPIA is a good way to record your decisions on lawful basis, notice, retention and access. Start it before the rollout, not after.
How should you handle data minimisation and retention?
GDPR requires that you process only the data you need and keep it no longer than necessary. For meeting recordings, that means:
- Record on purpose, not by default everywhere. Decide which meeting types benefit and leave the rest unrecorded.
- Set a retention period for audio, transcripts and summaries separately. Many teams keep summaries and action items longer than raw recordings.
- Limit access. In Acta, people only see meetings they have access to, which helps keep a private one-to-one private. Check the sharing settings in whatever tool you use.
- Watch exports and copies. Notes exported to documents, CRMs or ticketing tools need their own retention rules.
Transcripts and summaries can spread quickly once they leave the meeting tool. Our article on AI data leakage and protecting personal information covers the risks of copying meeting content into other systems.
How do you handle access and erasure requests for recordings?
Everyone who speaks in a recorded meeting is a data subject, not just your colleagues. Customers, candidates and guests can ask for access to their data (Article 15) or ask you to erase it (Article 17), and can object to processing based on legitimate interests (Article 21).
Prepare for this before the first request arrives:
- Make sure you can search recordings and transcripts by participant name or email.
- Decide how you will handle other people's data in the same recording, for example by redacting or extracting only the requester's contributions.
- Know how deletion works in your tool, including any derived notes, summaries and exported copies.
- Note the one-month response deadline in your request process.
What about HR, health and other sensitive meetings?
Article 9 GDPR gives extra protection to special category data, including health, racial or ethnic origin, religious beliefs, trade union membership, sexual orientation, and biometric data used to identify someone. Meetings about sickness absence, occupational health, grievances or patient care can easily contain it.
Processing special category data needs an Article 6 lawful basis and a separate condition under Article 9. For these meetings, consider:
- Not recording at all, and taking manual notes instead.
- Recording only with explicit, documented agreement, where that is genuinely free.
- Tighter access and shorter retention than for ordinary meetings.
- Covering these meeting types explicitly in your DPIA.
Does the EU AI Act affect AI note takers?
For most note-taking use, the GDPR remains the main framework. The AI Act matters at the edges. Since February 2025 it has banned AI systems that infer emotions in the workplace and in education, with narrow medical and safety exceptions. If a meeting tool offers features that read emotions or "sentiment" from people's voices or faces in internal meetings, check carefully whether you can use them at all. Using transcripts to make decisions about workers, such as in hiring or performance management, can also bring in the AI Act's stricter rules, so involve your legal team before you build those workflows.
What is different in the UK?
The UK has its own version of the GDPR (the UK GDPR), alongside the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO). The checklist above applies in much the same way, with a few local points:
- Legitimate interests: the ICO updated its guidance in 2026 to reflect the Data (Use and Access) Act 2025, which also added a separate "recognised legitimate interest" basis for a short list of public-interest purposes. Routine meeting recording still sits under ordinary legitimate interests with a balancing test.
- Transfers to the US: the UK Extension to the Data Privacy Framework (the "UK-US data bridge") has applied since 12 October 2023 for US organisations that have certified and opted in to cover UK data. Otherwise, the UK uses its International Data Transfer Agreement or the UK Addendum to the EU SCCs.
- DPIAs: the ICO publishes its own list of processing that needs a DPIA and screening checklists to help you decide.
Where does Acta fit in?
Acta records Zoom, Google Meet and Microsoft Teams through a meeting bot, or without a bot through the desktop app, Chrome extension and mobile apps. If you use the bot-free AI note taker, the advice above still applies: tell participants every time. Acta does not use customer data to train AI models, and people only see meetings they have access to. For a DPA or questions about how Acta handles data, see the security page or contact the team.
Frequently asked questions
Can I record a meeting under GDPR without consent?
Often yes, if another lawful basis such as legitimate interests applies and you have done the balancing test. You still need to inform everyone, respect objections, and follow any separate national rules that require consent to record.
Is the AI note-taking vendor a controller or a processor?
Usually a processor, acting on your instructions under an Article 28 agreement. If the vendor uses your recordings for its own purposes, such as training its models, it may become a controller for that use, which is one reason to check its terms.
Do external guests need to be told about the recording?
Yes. Customers, candidates and other guests are data subjects too. Put a short notice in the invite, repeat it at the start, and link to your privacy notice.
Does bot-free recording change my GDPR obligations?
No. Recording through a desktop app or browser extension creates the same personal data as a bot does. Because nobody sees a bot join, a clear notice matters even more.
How long should we keep meeting recordings?
GDPR sets no fixed period. Keep them only as long as your stated purpose needs, write that period down, and consider keeping raw audio for less time than summaries and action items.
If you want to see how Acta handles access and sharing in practice, you can try Acta free for 15 days.
