GDPR Meeting Recording: What UK Teams Need to Know

If your team records meetings to produce AI notes, GDPR meeting recording rules apply the moment audio is captured. A recording of an identifiable person is personal data, and in the UK that falls under the UK GDPR and the Data Protection Act 2018. For most business teams, compliant recording is achievable without explicit consent from everyone in the room.

What it does hinge on is a clear lawful basis, telling people what you are doing, keeping audio no longer than you need, and knowing who touches the data. The tool you choose does not make you compliant; your basis, notice and retention do.

Lawful basis: usually legitimate interests

You need a lawful basis to record and process meeting audio. Two usually apply to business meetings:

• Legitimate interests is the common choice. The ICO's legitimate interests guidance sets out a three-part test, including a balancing test against people's interests, rights and freedoms. Write your assessment down and keep it on file.
• Consent can be a better fit for webinars, coaching sessions or anywhere people would reasonably expect a real choice.

Key PointConsent and notice are different things. You can rely on legitimate interests and still owe everyone clear notice: notice is a transparency duty, consent is a lawful basis.

Transparency: tell people, every time

People have a right to be informed about how their personal data is used. For recorded meetings that means:

• An announcement at the start of the meeting.
• A line in the calendar invite, so people know before they join.
• A reference in your privacy notice covering purpose, lawful basis, retention and their rights.

If an attendee only finds out afterwards that they were recorded, you have a transparency problem whatever your lawful basis.

Data minimisation, retention and special categories

Record only what you need, and keep it only as long as you need it. If the AI note is the deliverable, you rarely need the raw audio once the note is produced and checked, so deleting the recording is often the cleanest approach.

Set a defined retention period for audio and for notes, and enforce it. Meetings can drift into health, HR or other sensitive topics; the ICO's guidance on special category data sets a higher bar, so be cautious about recording those at all.

Watch OutDo not record HR, welfare or health conversations without checking the special category rules first. Data protection law has been updated recently, so check the ICO's current guidance.

Processors and where the audio lives

Any third party that processes meeting audio for you is a processor. The ICO explains when a contract with a processor is needed and what it must include. Two questions decide most of your risk:

• Where is the audio stored and processed? If it leaves the UK, the ICO's rules on international transfers apply.
• How many parties touch it? Every extra processor is another contract, another location and another entry in your records.

Platform-native recording, such as Teams live transcription, a meeting bot or a self-hosted tool can each be run compliantly or badly. Fewer parties make the data map simpler, not lawful by itself. Our guide to AI note takers without a bot covers that trade-off.

Subject access requests: recordings are in scope

A recording or transcript that contains someone's personal data falls within a subject access request. You must be able to find it and to redact other people's data before releasing it.

Pro TipKnow where every recording and note lives, and delete audio promptly under a written policy. You cannot be asked to produce what you have properly deleted.

Do's and don'ts

• Do announce recording at the start and in the invite.
• Do document your legitimate interests assessment.
• Do delete raw audio once the note is produced.
• Do hold a contract with every processor.
• Don't assume "everyone knows": transparency is an active duty.
• Don't treat any tool as compliance in a box.

Frequently asked questions

Do I need consent from everyone?

Usually not for internal business meetings run on legitimate interests, which needs notice but not consent. Consent suits webinars, coaching or sensitive sessions where people should have a genuine choice.

What about external attendees?

They have the same rights. Flag recording in the invite and at the start so they can object or decline, and make sure your privacy notice is easy to find.

None of this is legal advice; for high-risk processing, take proper advice. For running meetings well once they are recorded, see our guides to writing meeting minutes and the best AI note takers in 2026, or start a free Keel trial.