GDPR and meeting recordings: what counts as personal data in a transcript
Plain-words GDPR transcription guide for people who record meetings: which parts of a transcript are personal data, what to tell attendees, how long to keep it.
Under the GDPR, a meeting recording and its transcript are personal data whenever someone in them can be identified, which in a normal meeting means everyone who speaks or gets mentioned. Names, opinions and anything said about a person all count. Mentions of health, union membership or political views fall into a stricter category. So a GDPR transcription workflow generally needs three things: a reason the regulation recognises, a clear heads-up to the people being recorded, and a delete date. This post goes through the articles in plain words, then the practical side, including where in-browser transcription fits.
A transcript is personal data whenever a person is identifiable
Article 4(1) defines personal data as “any information relating to an identified or identifiable natural person”. Someone is identifiable if they “can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Read that against a meeting transcript. The speaker labels are names. Even with labels stripped, “the person who runs the Berlin office” is usually enough. The EDPB’s guide for small businesses lists “photos, videos and audio recordings containing images or sounds of individuals” among its examples of personal data, so the audio file counts before anyone transcribes it.
Two things trip people up. First, the definition says “any information relating to” a person, not just facts about them. When a colleague says “I think Sam has been struggling since the reorg”, that sentence is personal data about Sam. Second, it doesn’t have to be accurate or fair to count. A wrong claim about someone is still information relating to them.
Some mentions fall into a stricter category
Article 9(1) singles out data “revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership”, plus genetic data, biometric data used to uniquely identify someone, and “data concerning health or data concerning a natural person’s sex life or sexual orientation”. Processing these is prohibited unless an Article 9(2) exception applies. The first, 9(2)(a), is that the person “has given explicit consent to the processing of those personal data for one or more specified purposes”.
“I’ll be off next week for surgery.” “I’ve raised it with the union.” Each of those, once in a transcript, is special category data about the speaker. You didn’t ask for it, but you’re now storing it.
A note on voice itself. Article 9 counts biometric data as special category only when it’s processed “for the purpose of uniquely identifying a natural person”. Turning speech into text isn’t that, so a plain transcript generally doesn’t fall under Article 9 on its own.
GDPR transcription needs a lawful basis and a heads-up
Article 6(1) says processing is lawful only if at least one listed basis applies. For workplace recordings the two you’ll usually hear about are consent, 6(1)(a), where the person has agreed to the processing for one or more specific purposes, and legitimate interests, 6(1)(f), where the processing is necessary for a legitimate interest of yours or a third party’s, unless the person’s own interests and rights override it.
Which fits depends on who’s in the room and why. Pick one and write it down: Article 5(2) makes the controller “responsible for, and be able to demonstrate compliance with” the principles, so “we just always record” isn’t a basis.
Then there’s telling people. Article 13(1) says that when you collect data from the person, you tell them at that moment what the processing is for, its legal basis, and who will receive the data. Article 13(2)(a) adds how long you will keep it. In practice, one line in the invite and one sentence at the start: we’re recording this to produce notes, the notes go to attendees, the audio is deleted once the notes are done.
Keep it only as long as you need it
Article 5(1)(e) says personal data must be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”. If the purpose was “produce the notes”, the audio has done its job when the notes exist. The transcript and the notes live longer, but each needs an end date.
Two neighbouring principles help. Article 5(1)(c) limits data to what is “adequate, relevant and limited to what is necessary”, a good argument for not recording the chat before the agenda starts. Article 5(1)(f) requires “appropriate security”, which for a laptop file generally means disk encryption and no shared downloads folder.
People can also ask. Article 17(1)(a) gives them a right to erasure where the data “are no longer necessary in relation to the purposes for which they were collected”. If your only copy sits with a vendor, you need to be able to delete it there too.
The same material as a table:
| What’s in the transcript | Personal data? | What to do |
|---|---|---|
| Names, speaker labels, job titles | Yes (Art. 4(1)) | Have a lawful basis, tell attendees, set a delete date |
| Opinions about a colleague or client | Yes, about the person discussed | Same, and be ready for an erasure request |
| A wrong or unfair statement about someone | Yes, accuracy doesn’t change that | Correct the notes; don’t circulate the raw transcript |
| “I’ll be out for surgery”, “I raised it with the union” | Yes, special category (Art. 9) | Leave it out of the notes; delete the audio promptly |
| Project plans, budgets, product decisions | Usually not on their own | Ordinary confidentiality rules apply |
| Attendees’ voices in the audio file | Yes, identifiable | Keep on your own machine where you can; delete after notes |
Your machine, or a processor, and what changes
Article 4(7) calls whoever “determines the purposes and means of the processing” the controller, which is you or your company when you decide to record. Article 4(8) calls anyone who “processes personal data on behalf of the controller” a processor, which is what a cloud transcription service becomes the moment you upload a recording.
Using a processor is allowed, with conditions. Under Article 28(1) you may “use only processors providing sufficient guarantees” of appropriate security. Under 28(3) there has to be a contract that sets out the subject matter, duration, nature and purpose of the processing, the types of data and the people involved. The contract has to bind the processor to act only on your instructions, secure the data, follow rules on sub-processors, help with data subject requests, and delete or return the data when the service ends. Read the vendor’s version; its retention and sub-processor terms feed into what you tell attendees under Article 13.
Keeping the recording on your own machine removes that layer. No processor, no contract to review, no third-party retention period to disclose. Every other obligation still applies: basis, notice, minimisation, security, deletion.
Where in-browser transcription fits, and its limits
One way to keep the audio local is to transcribe it locally. FreeTranscribe runs OpenAI’s open-source Whisper model inside the browser tab on your graphics card through WebGPU. The file is read from your disk and never uploaded. There’s no account, so no vendor holds a copy and there’s no processor relationship to paper. For the cost side of that comparison, see Otter vs Rev vs Descript vs local transcription.
The limits matter for a compliance decision, so here they are plainly:
- Desktop Chrome or Edge only, with a working WebGPU adapter. No Firefox, Safari or phones yet.
- English only for now.
- The base Whisper model, about 200 MB downloaded once. Names, technical terms, heavy accents and noisy rooms are the weak spots. Read it through before relying on it.
- About 1.5x real time on a desktop with a graphics card in our test; a thin laptop takes roughly as long as the recording.
- Exports are TXT, SRT and VTT files on your disk. Where they go next is still on you.
Local processing shrinks the set of parties who touch the data, not what the data is. A transcript on your laptop is exactly as much personal data as one on a server.
Frequently asked questions
Do I need consent from everyone before I record a meeting? Consent is one lawful basis under Article 6(1), not the only one. Which fits depends on the people and the purpose; your own country may also add rules on recording conversations.
Is the transcript personal data if I remove the names? Often still yes. Article 4(1) covers indirect identification, and roles, projects and context usually point at a specific person without a name.
Does using a local tool mean GDPR doesn’t apply? No. Local transcription removes the upload and the Article 28 work. The transcript is still personal data and Articles 5, 6, 13 and 17 apply as before.
This post is general information about what the regulation says, not legal advice for your situation.
Sources, checked 14 September 2026
- https://gdpr-info.eu/art-4-gdpr/ : Article 4, definitions of personal data, processing, controller and processor
- https://gdpr-info.eu/art-5-gdpr/ : Article 5, principles including storage limitation, minimisation, security and accountability
- https://gdpr-info.eu/art-6-gdpr/ : Article 6, lawfulness of processing
- https://gdpr-info.eu/art-9-gdpr/ : Article 9, special categories of personal data
- https://gdpr-info.eu/art-13-gdpr/ : Article 13, information to be provided when data is collected from the person
- https://gdpr-info.eu/art-17-gdpr/ : Article 17, right to erasure
- https://gdpr-info.eu/art-28-gdpr/ : Article 28, processor obligations and contract terms
- https://www.edpb.europa.eu/sme-data-protection-guide/data-protection-basics_en : EDPB guide for small businesses, examples of personal data and processing