GDPR and AI Meeting Notes: What Teams Need to Know

Quick Answer

Using AI to transcribe and analyze meetings is subject to GDPR when participants are EU residents. The key obligations are: establish a clear lawful basis before recording, inform participants in advance, sign a Data Processing Agreement with your AI tool vendor, restrict data residency to the EU or an adequacy country, set a retention period, and honor data subject access requests. Most off-the-shelf meeting tools leave these obligations entirely to you. KenzNote addresses them at the product level with a no-training-on-your-data guarantee, DPA availability, and EU data handling.

Key Takeaways

• GDPR applies whenever you record or transcribe meetings involving EU residents, regardless of where your company is based
• Legitimate interest is rarely a safe lawful basis for recording meetings; explicit consent or a contractual necessity argument is far more defensible
• Every participant must be informed before recording starts, not just at the start of the call
• AI transcription vendors are data processors under Article 28, and you need a signed DPA before sending any audio or transcript to them
• Data subject rights apply to transcripts: participants can request access, correction, or deletion of their meeting data
• Retention periods must be defined and enforced, not just documented in a policy nobody reads
• KenzNote's privacy-first model (no AI training on your data, opt-in recording with no calendar access, DPA available on request) reduces your compliance burden significantly

Table of Contents

1. Why GDPR Applies to AI Meeting Transcription
2. Lawful Basis: Consent vs. Legitimate Interest vs. Contract
3. Informing Participants Before Recording
4. Your AI Tool Is a Data Processor Under Article 28
5. Data Subject Rights Over Meeting Transcripts
6. Data Residency and Cross-Border Transfers
7. Retention Periods for Meeting Recordings
8. What a GDPR-Compliant Meeting Workflow Looks Like
9. How KenzNote Follows GDPR
10. Frequently Asked Questions
11. Related Resources

Why GDPR Applies to AI Meeting Transcription

Meeting recordings and transcripts contain personal data: names, voices, opinions, and sometimes sensitive information about health, finances, or HR matters. Under the GDPR, any processing of personal data relating to EU residents triggers compliance obligations, even if your company is based outside the EU.

"Processing" under Article 4 is deliberately broad. Recording a meeting, generating a transcript, running AI analysis on that transcript, storing the output, and sharing it with colleagues all count as separate processing activities. Each needs a lawful basis.

The AI layer adds complexity. When you upload audio to a transcription service or let an AI bot join your call, you are transferring personal data to a third party. That third party becomes a data processor under Article 28, and you become the data controller responsible for their compliance.

Every step from recording to AI analysis involves personal data processing that requires a lawful basis under GDPR.

This is not a theoretical risk. Supervisory authorities across Europe have issued fines for unlawful employee monitoring and recording. The core question is not whether GDPR applies, it is whether your current workflow satisfies it.

Lawful Basis: Consent vs. Legitimate Interest vs. Contract

Article 6 of the GDPR lists six lawful bases for processing personal data. For meeting recordings, three are relevant:

Whether legitimate interest or consent applies often comes down to who else is on the call.

Consent (Article 6(1)(a))

Consent must be freely given, specific, informed, and unambiguous. In a meeting context, this means each participant must actively agree to being recorded before recording starts. A "by joining this call you consent to recording" banner in a calendar invite does not meet the standard because it is not specific and there is an implicit power imbalance (particularly for employees and clients who feel they cannot refuse).

Consent is the most defensible basis when it is genuine, but it is also the most demanding to collect and document correctly. You must keep a record of when consent was given and be able to honor withdrawal.

Legitimate Interest (Article 6(1)(f))

Many teams default to legitimate interest because it requires no active participant action. The problem: legitimate interest requires a three-part test (purpose, necessity, balancing), and the European Data Protection Board has been clear that it cannot override participant expectations or rights. Recording a meeting to train an AI model, for example, would almost certainly fail the balancing test.

For internal team meetings where all participants are employees and recording is a documented business practice communicated in advance, legitimate interest can work. For external meetings with clients, prospects, or candidates, it is far harder to sustain.

Contract (Article 6(1)(b))

If recording is necessary to fulfill a contractual obligation, such as providing a client with agreed meeting minutes, it can provide a lawful basis. This is narrow and must be genuinely necessary, not merely useful.

Practical recommendation: For external meetings, obtain explicit verbal or in-app consent and log it. For internal meetings, establish a documented legitimate interest assessment and include a standing recording notice in employment agreements or meeting policies.

Informing Participants Before Recording

Transparency is a core GDPR principle. Under Articles 13 and 14, participants must be informed about:

• The identity and contact details of the data controller (your organization)
• The purposes and lawful basis for recording
• Whether a third-party AI processor will receive the data
• How long recordings and transcripts will be retained
• Their rights (access, rectification, erasure, objection)
• Whether data will be transferred outside the EU

This information must be provided at the time of collection, which means before the meeting starts, not buried in a privacy policy nobody reads.

A practical approach:

1. Add a short recording notice to calendar invites for all recorded meetings
2. Verbally announce at the start of recorded calls that the session is being transcribed
3. If using an AI tool that joins as a bot, ensure the bot's presence is visible to all participants
4. Maintain a log of which meetings were recorded and when participants were notified

Proactive notification before meetings is a GDPR requirement, not just a courtesy.

For more detail on the legal landscape around meeting recording, see the full guide at Is It Legal to Record Meetings?.

Your AI Tool Is a Data Processor Under Article 28

When you send meeting audio or transcripts to an AI meeting assistant, that vendor processes personal data on your behalf. Under GDPR Article 28, you must have a signed Data Processing Agreement (DPA) in place before any processing occurs.

The DPA must specify:

• The subject matter, duration, and nature of processing
• The type of personal data and categories of data subjects
• The obligations and rights of the controller (you)
• That the processor will only process data on your documented instructions
• Security measures the processor implements
• Subprocessor rules (who else they can share data with)
• Data deletion or return obligations at contract end

This has a direct implication for how you evaluate AI meeting tools. A vendor that does not offer a DPA, that processes data in undisclosed locations, or that reserves the right to use your data for model training is a compliance liability.

The question of AI training on your data is particularly important. Many popular transcription services use customer data to improve their models. Under GDPR, this is a secondary purpose that requires its own lawful basis and disclosure. See Does Your AI Meeting Assistant Train on Your Data? for a detailed breakdown of how major tools handle this.

Data Subject Rights Over Meeting Transcripts

Participants in your meetings have enforceable rights under GDPR. As the data controller, you are responsible for honoring them:

Right of Access (Article 15): A participant can request a copy of their personal data, including meeting transcripts where they appear. You have 30 days to respond.

Right to Rectification (Article 16): If a transcript contains inaccurate personal information about them, they can request correction.

Right to Erasure (Article 17): Also called the "right to be forgotten." Participants can request deletion of transcripts, though this right is not absolute and can be balanced against your legitimate need to retain records.

Right to Object (Article 21): If your lawful basis is legitimate interest, participants can object to processing at any time. You must stop unless you can demonstrate compelling legitimate grounds.

Right to Restriction (Article 18): Participants can request you limit how you use their data while a dispute is resolved.

In practice, this means your meeting notes system must support deletion of individual transcript records. A tool that backs up to an unstructured cloud storage bucket where you cannot locate or delete a specific participant's data creates a compliance gap.

Data Residency and Cross-Border Transfers

GDPR Chapter V restricts transfers of personal data outside the EU/EEA unless the destination country provides adequate protection. If your AI meeting tool processes data on US servers, for example, you need a valid transfer mechanism.

The current options are:

• Adequacy decision: The EU Commission has recognised certain countries as providing adequate protection (UK, Switzerland, Canada, Japan, and others). The US has the EU-US Data Privacy Framework, which replaced the invalidated Privacy Shield.
• Standard Contractual Clauses (SCCs): Contractual safeguards that can be included in your DPA with US-based vendors.
• Binding Corporate Rules: For intra-group transfers within multinationals.

In practice, check whether your AI meeting tool stores and processes data in the EU, or at minimum operates under valid SCCs. Many US-based tools do offer EU data residency as a paid option. If EU data residency is not available and SCCs are not included in the DPA, you have a transfer violation.

Retention Periods for Meeting Recordings

GDPR's storage limitation principle (Article 5(1)(e)) requires you to keep personal data no longer than necessary for the stated purpose. "We keep everything forever" is not a lawful retention policy.

Define and document your retention periods:

The key requirement is that retention is enforced, not just documented. Build automated deletion into your workflow, or use a tool that supports configurable retention periods at the account level.

What a GDPR-Compliant Meeting Workflow Looks Like

Putting it together, a compliant workflow involves these steps:

1. Before the meeting: Determine lawful basis, add recording notice to calendar invite, confirm DPA is signed with your AI vendor
2. At the start of the meeting: Verbal announcement that the session will be transcribed and processed by AI
3. Recording: Use a tool that does not transfer data to undisclosed subprocessors and does not retain audio beyond processing
4. Post-processing: Store transcript in a system where individual records can be located and deleted
5. Retention management: Apply automated deletion rules based on meeting type
6. Subject access requests: Maintain ability to respond within 30 days

The biggest practical gap most teams have is step 4: transcripts end up in a shared drive folder with no metadata and no way to find or remove a specific person's records. Choosing a dedicated meeting notes tool with proper data management features closes that gap.

How KenzNote Follows GDPR

KenzNote is built with privacy as a design constraint, not an afterthought. We follow GDPR, and these are the features that keep KenzNote aligned with it:

No AI training on your data. KenzNote's privacy policy states that it never uses your meeting data to train its own or third-party AI models, and its AI service providers are contractually restricted from doing so. This eliminates the secondary-purpose problem that creates compliance issues with many competitors.

Opt-in recording. KenzNote's assistant, clearly named "Kenz", joins only the meetings you paste or schedule. There is no bot that automatically joins every calendar event, which supports data minimization and makes it easy to skip meetings where you lack a lawful basis. Because the assistant is visible in the participant list, attendees can see that the meeting is being recorded. See Bot-Free AI Meeting Recorder 2026 for options when participants object to any bot.

DPA available. EU customers can request a written Data Processing Agreement from [email protected] to meet the Article 28 requirement.

No mandatory calendar integration. Many meeting tools require calendar access that exposes your full meeting schedule. KenzNote does not require this.

Pay-as-you-go model. At $0.99 per hour, you pay for the specific meetings you choose to record, not a subscription built around recording everything.

For setup guidance, see Getting Started with KenzNote.

With KenzNote, you decide exactly which meetings get recorded, giving you explicit control over what personal data is sent to the AI.

Frequently Asked Questions

Do I need consent to record a meeting under GDPR?

Not necessarily, but you need a lawful basis, and consent is the most defensible option for external meetings. For internal meetings with employees, a documented legitimate interest assessment combined with advance notice in employment agreements can work. For meetings with external parties including clients and candidates, explicit consent collected before recording is the safest approach.

Can I use GDPR legitimate interest for all my meeting recordings?

Legitimate interest is defensible for internal team meetings where recording is a disclosed business practice. It is harder to sustain for external meetings, customer calls, or any recordings used for AI model improvement. You must conduct and document a balancing test showing your interest outweighs participant rights.

Does GDPR apply if my company is based outside the EU?

Yes, if you record or process meetings involving EU residents, GDPR applies to you under Article 3's extraterritorial scope. This includes companies in the US, UK (which has its own UK GDPR), Australia, or anywhere else that handles EU resident data.

What happens if a meeting participant requests deletion of their transcript?

You must assess the request under Article 17. If your lawful basis was consent and they have withdrawn it, you generally must delete. If you have an ongoing legitimate interest or legal obligation, you may be able to retain it but must inform the requester. You have 30 days to respond.

Is a bot that joins my meeting a data processor?

The bot vendor is a data processor under Article 28. You need a signed DPA with them before using the service. You should also verify they are not using your meeting data for their own purposes (such as model training), which would make them a data controller for that secondary use, requiring separate lawful basis.

What is the maximum GDPR fine for unlawful meeting recording?

Fines under GDPR can reach 4% of global annual turnover or 20 million euros, whichever is higher, for serious infringements. Unlawful recording or inadequate security measures fall under this tier. In practice, supervisory authorities tend to issue smaller fines for first offenses with quick remediation, but the risk is real and growing.

Related Resources

• Is It Legal to Record Meetings?
• Does Your AI Meeting Assistant Train on Your Data?
• Bot-Free AI Meeting Recorder 2026
• Getting Started with KenzNote
• Best AI Meeting Note Taker Apps