GDPR and Meeting Room Recordings: What You Are Actually Allowed to Keep
Meeting room recordings and UK GDPR: what the ICO expects on lawful basis, telling people, retention and access requests, and how to set a sensible policy.
Chris Gore Updated 2026
Meeting room recordings have become routine. A video call is recorded to share with colleagues who could not attend, an AI tool produces a transcript and a summary, and a copy of both quietly sits on a server for years. This article is not legal advice, but it sets out what the Information Commissioner's Office expects so you can ask better questions of your own legal and data protection team. If AI note taking is part of your setup, our comparison of AI meeting notetakers is a useful companion.
What Counts as Meeting Room Recordings?
Three things tend to get lumped together. The first is a recording of a call or meeting, with audio and often video. The second is a transcript or AI summary generated from it, which is also personal data. The third is whatever the room itself captures, such as cameras, microphones and sensors. Each can contain personal information about staff, clients and visitors, and each needs a clear reason for existing.
What the ICO Expects From Meeting Room Recordings
Be Lawful, Fair and Transparent
ICO guidance on monitoring workers says that data protection law does not prohibit monitoring, but you must balance your business interests against the rights of the people involved. You should be clear about your purpose and choose the least intrusive way to achieve it. Except in very exceptional cases, you must tell workers about any monitoring, and your privacy information should explain what is recorded, why, who can see it and how long it is kept.
Have a Lawful Basis
You need a lawful basis for recording, and you should document it from the start. The ICO says consent is usually inappropriate in an employment setting because of the imbalance of power, so many employers rely on legitimate interests instead. That requires a documented assessment covering your purpose, why recording is necessary and how you have balanced it against the rights of individuals. Recordings that capture special category information, such as health details, need an additional condition.
Consider a Data Protection Impact Assessment
A data protection impact assessment is required before high risk processing, and the ICO recommends doing one even where it is not clearly required, and recording the reason if you decide against. If you routinely record meetings, use AI transcription or run always on room sensors, it is sensible to complete one.
How Long Can You Keep Meeting Room Recordings?
Only as long as you need them for the purpose you stated. The ICO is direct on this point. You should not keep information just in case you find a use for it in the future. Set a retention schedule, review it regularly and delete recordings in line with it. In practice that means short retention for routine meetings, longer retention only where there is a clear reason, and a named person responsible for deleting.
Who Should Have Access?
Limit access to people with a legitimate need, and store recordings securely. A recording of a performance conversation or a client call should not be visible to everyone on the platform by default. Remember that staff can ask for recordings that include them, so keep records you can find and be ready to redact third party information. The network the equipment sits on matters too, as we explain in our article on whether your meeting room network is a cybersecurity risk.
Cameras, Sensors and Room Analytics
Recording is not the only issue. Cameras with automatic framing, occupancy sensors and usage analytics all collect information about people in the room. Where the data is anonymous counts of people, the privacy impact is lower, but you should still be clear about what is collected. Our article on occupancy sensor technology and meeting room AV explains how that kind of data is used, and our guide to managing remote employees without surveillance covers the cultural side.
A Practical Policy for Meeting Room Recordings
Keep it simple. Decide which meetings may be recorded and why. Tell people before recording starts, using the platform's recording notice and your written policy. Set a default retention period and switch off automatic AI transcription unless it is needed. Name who owns the recordings, who can access them and who deletes them. Review the policy at least once a year and whenever you adopt a new tool.
Get the Work Isn't Working Newsletter
Practical thinking on hybrid working, AI and the technology behind how people meet.
Frequently Asked Questions
Can I record meetings in a meeting room under UK GDPR?
Yes, if you have a lawful basis, tell people and keep the recordings secure and for no longer than needed. The ICO expects you to be transparent and to use the least intrusive method.
Do I need consent to record meetings with staff?
Consent is usually inappropriate in employment because of the imbalance of power. Many employers rely on legitimate interests and document that assessment.
How long can I keep meeting room recordings?
Only as long as you need them for the stated purpose. Set a retention schedule and delete in line with it rather than keeping recordings just in case.
Are AI transcripts and summaries covered by data protection law?
Yes. A transcript or summary of a meeting contains personal data, so it needs a lawful basis, clear information for participants and a retention period.
Can staff ask to see recordings of themselves?
Yes. Staff can make subject access requests, so keep recordings organised and be ready to redact information about other people.
Related Posts
Comments