Recording or transcribing a meeting in the UK: what the law asks

At a glance

What data protection law asks of an organisation

Under UK GDPR, personal data is information about an identifiable person, and processing it includes collecting and recording it, so a recording or a transcript of what people said in a meeting is covered. Personal data must be processed “lawfully, fairly and in a transparent manner”, limited to what is necessary and kept no longer than needed, and the organisation must be able to show that it complied.

It also needs a lawful basis under Article 6. Consent is one; legitimate interests is another, where the processing is necessary for a legitimate interest and that interest is not overridden by the rights and freedoms of the people recorded. The ICO breaks legitimate interests into three tests, purpose, necessity and balance, and says all three must be met before the information is used.

Telling the people in the meeting

Article 13 says people must be told, “at the time when personal data are obtained”, who is collecting it and how to contact them, why and on what lawful basis, who will receive it, how long it will be kept, and their rights, including the right to object and to complain to the regulator. The ICO says this applies to information collected by observation, such as by CCTV, as much as to a form somebody fills in.

For monitoring at work the ICO is plain: “Apart from in very exceptional circumstances where covert monitoring is justified, you must inform workers about any monitoring.” Its guidance on audio and video adds that anybody else caught by it, such as visitors or customers, must be made aware of it too. In a meeting, the simplest way to do both is to say at the start that it is being recorded or transcribed, by what and why, and to put the same in the invitation.

Consent at work, and legitimate interests

The ICO says consent “is not usually appropriate in the employment context, due to the imbalance of power between you and your workers”, and is appropriate only where people have a genuine choice. Legitimate interests may not be the right basis either, it adds, where people would not understand or reasonably expect the monitoring, or would object if it were explained to them.

Expectations are judged objectively. The ICO’s question is “whether a reasonable person ought to expect it in the circumstances”, so saying clearly and in advance that meetings are transcribed, and why, is part of what makes it expected. The ICO says its guidance on monitoring workers is under review after the Data (Use and Access) Act 2025, so check it for changes.

When an organisation needs a DPIA

Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk, particularly with new technologies. The ICO expects one where innovative technology, which it says includes AI, is combined with another risk factor such as systematic monitoring, and its guidance on monitoring workers says an organisation considering audio monitoring must complete one.

Neither the law nor the ICO says that every use of an AI note taker needs a DPIA. The ICO does recommend carrying one out even where no specific high risk is found, as a way of reaching a better decision.

Disciplinary, grievance and investigation meetings

Acas, the government-funded employment advice service, says an organisation can record an investigation meeting if its own policy allows it and the person being interviewed agrees, that “Any decision to record should be agreed by all parties”, and that a covert recording “might be viewed as a misconduct matter or as a breach of trust and confidence”. Disciplinary or grievance meetings held by video “may be recorded with the agreement of everyone involved”, in line with data protection law.

Recording a call you are on, for yourself

UK GDPR does not apply to an individual’s “purely personal or household activity”, but a work meeting is not obviously personal, and an organisation is never within it. The UK’s criminal offence of unlawful interception, in section 3 of the Investigatory Powers Act 2016, is about making the content of a communication available, while it is carried or stored by the system, to somebody who is not its sender or intended recipient.

We found no official guidance on whether a participant who records a call only for themselves is covered, so we do not say either way. An employer’s policy may still forbid it, and Acas warns that a covert recording of an investigation meeting can become a disciplinary matter.

When somebody on the call is abroad

Other countries have their own rules, and some American states require the consent of everybody on a call. The Reporters Committee for Freedom of the Press notes that courts there have applied the law of the place where the recording device is and of the place where the person recorded is, and advises assuming the stricter law applies. The guides to California and Washington State set out theirs.

Using Troopa in the UK

Troopa keeps the transcript and the notes, not the audio, and keeps no voiceprint. It runs on your computer and shows the other people on the call nothing unless you present its window, so telling them is up to you, and in many places the law requires it.

Under UK GDPR an organisation using Troopa is the controller of its meetings and TELLME AI LIMITED is its processor, under a data processing agreement. An organisation that chooses the UK region has its meetings stored in London. We do not use your meetings to train or improve AI models, ours or anybody else’s.

Questions

Sources

1. UK GDPR, Article 2: what it applies to, and purely personal activity
2. UK GDPR, Article 4: what personal data and processing are
3. UK GDPR, Article 5: lawful, fair and transparent processing
4. UK GDPR, Article 6: the lawful bases for processing
5. UK GDPR, Article 13: what people must be told when their data is collected
6. UK GDPR, Article 35: data protection impact assessments
7. ICO, Employment practices and data protection: monitoring workers
8. ICO, monitoring workers: calls, audio and video
9. ICO, What is the legitimate interests basis?
10. ICO, When should we provide privacy information?
11. ICO, When do we need to do a DPIA?
12. Acas, holding investigation meetings: recording meetings
13. Acas, disciplinary and grievance meetings held by video
14. Investigatory Powers Act 2016, section 3: unlawful interception
15. Investigatory Powers Act 2016, section 4: what interception means
16. Reporters Committee for Freedom of the Press, Reporter’s Recording Guide (2021)

Read on 6 October 2026, by the people who make Troopa. Spotted something out of date? Tell us and we will correct it and say when.