AI meeting notes: GDPR and participants’ consent

After an hour-long call with a client, few people remember who was supposed to do what by Friday. A note-taking assistant in Google Meet, Teams or Zoom will write it down for you: a transcript, a summary and a list of what was agreed. The problem is that along with the note, a recording or transcript is often created, and it contains client data, so you need to know where all of it ends up.

In this guide I show what these tools give a small business, how to set them up in line with GDPR and what to tell participants at the start of a meeting. You will find a ready-made notice to copy here. As of 8 November 2026; providers’ features and plans change often, so check the details in their documentation.

What note-taking assistants give a small business

The biggest benefit is time saved after the meeting and fewer disputes of the “but we agreed on that” kind. An assistant usually does three things:

• a transcript, that is, a word-for-word record of the conversation,
• a summary of the key points,
• a task list with the people responsible and deadlines.

For a service business, this is useful for quotes, work handovers, calls with subcontractors and team meetings. For a medical practice or a law firm, it is a subject that calls for great caution, as described below.

Remember one thing: AI makes mistakes. It garbles names, amounts and dates, and sometimes adds an agreement that was never made. Always read the note before you send it to a client.

What tools you can choose from

There are two types of solutions: those built into the video call app and separate apps that “join” the meeting as an extra participant.

Check plans and feature names with the provider, because they change quickly. Built-in tools usually have one advantage: the data stays with a provider you already have a contract with. Separate apps can be more convenient, but they add another entity that processes your clients’ voices.

Where the recording and transcript end up

Before you turn on an assistant, answer five questions for yourself:

1. Where is the file stored (the organizer’s account, a shared drive, the provider’s server)?
2. Who has access to it: only the organizer, the whole team, anyone with the link?
3. How long does the file stay there, and can it be deleted automatically?
4. Does the provider use meeting content to train models? You will find the answer in the account settings and the terms of service.
5. In which country are the servers, and on what basis can data be transferred outside the EU?

With business accounts, most of these settings are changed by the administrator. If someone at your company uses a private, free account for meetings with clients, that is the biggest risk: nobody is in control of it.

GDPR: what you need to do

The voice and statements of the person you are talking to are personal data. When you record and store them, you become the controller of that data. In practice, it comes down to three things.

Inform participants

GDPR requires that people know their data is being processed, for what purpose and for how long (Art. 13 GDPR). For meetings, the simplest way is to do this at the start of the call, and to add permanent information to your privacy policy and invitations.

Sign a data processing agreement with the provider

If the tool provider processes data on your behalf, you need a data processing agreement. On the business plans of large providers, it is usually available in the terms or in the admin panel. Private free accounts often don’t have one, so don’t use them for calls involving client data.

Limit the amount of data and how long you keep it

The principles of data minimization and storage limitation (Art. 5 GDPR) say to keep only what is needed and no longer than necessary. A note with the agreed points is usually enough, and you can delete the recording after a few weeks. An example period, e.g., 30 days, is your decision, not a legal requirement.

Whether legitimate interest is enough for you or consent is needed depends on the purpose and the circumstances. If in doubt, ask a lawyer or a data protection officer.

Recording calls with clients

Recording a conversation you take part in is a different situation from eavesdropping. Even so, let the other person know in advance: it’s fair, safe for your image and helps you stay GDPR compliant. If someone objects, turn off the recording and take notes by hand.

A few practical rules:

• give notice of recording at the start, not halfway through the meeting,
• ask whether the other person agrees when the conversation covers sensitive topics,
• don’t record meetings where health or financial data or passwords come up, unless you have a solid basis for doing so,
• don’t send the full transcript to people outside the conversation without a need.

For meetings with clients from abroad, remember that the laws of their countries may differ. When you are not certain, ask for explicit consent.

Professional secrecy

If you run a law firm, a medical practice, a tax advisory office or another business bound by professional secrecy, the matter is more serious. Sending a recording to the cloud means passing information to a third party. Check the rules of your profession and the recommendations of your professional body before you turn on an assistant during a conversation with a client or patient.

A safer option is tools that run on your own hardware. I write about this in the guide on a local AI model for your business: the data does not leave the company.

A ready-made notice for the start of a meeting

Say it out loud and paste it into the invitation or the meeting chat:

Hello. At this meeting we are using an AI assistant that records the conversation and prepares a note of what was agreed. We use it only for our own records and delete the recording after 30 days. If anyone does not want to be recorded, please let me know, and I will turn off the recording and take notes by hand.

Version for an email invitation:

The meeting will be recorded, and an AI assistant will prepare the transcript and the note. You will find details of how we process data in our privacy policy. If you do not consent to the recording, please write to us before the meeting.

Information obligations regarding AI assistants may also arise from the AI Act, but for meeting notes they mainly concern tools you talk to like a chatbot. I write more about this regulation in the guide on labeling AI content on your website.

Checklist before first use

• A business account, not a private one.
• The data processing agreement with the provider read and saved.
• Model training on meeting content turned off (if the provider offers this option).
• A set retention period for recordings and a person who deletes them.
• The notice for the start of meetings ready to paste.
• Rule: a human always reads the AI note before it is sent.
• Rule: recordings are not kept on shared drives accessible to everyone.

Write down the rules for the whole team on one page. You will find a template in the guide on an AI use policy for your company.

Summary

A note-taking assistant saves time, but along with it, recordings or transcripts of conversations with clients appear in your company. Use a business account, have a data processing agreement, tell participants that you are recording and keep recordings for a short time. If professional secrecy applies to you, check the rules of your profession first.

If you want to roll out an assistant in your company with rules for the team, or connect notes with your CRM and email, write to me. I will help you assess where AI in your business will bring real gains, and process automation will take care of the rest. I reply within 24 hours.