Is it legal to record a meeting in Estonia?

Karistusseadustik § 137, in the official English translation: "Unauthorised surveillance. (1) Observation of another person in order to collect information relating to such person by a person without the lawful right to engage in surveillance is punishable by a pecuniary punishment or up to three years' imprisonment."

Two neighbours matter. § 156, violation of confidentiality of messages: violating the confidentiality of a message communicated by a letter or other means of communication is punishable by a pecuniary punishment, aggravated to up to one year where the offender has access by reason of official duties. §§ 157 and 157¹ cover illegal disclosure of personal data and of sensitive personal data.

The framing is surveillance by someone without the lawful right to conduct surveillance. This is a provision about jälitustegevus, the statutory surveillance activity, not about recording another person's words.

Yes, on the face of the statute. § 137 requires observation of another person for the purpose of collecting data about them by a person without the lawful right to engage in surveillance, which is aimed at private surveillance dressed as jälitustegevus rather than at a meeting participant keeping a record. § 156 is about the confidentiality of a communicated message and is not naturally engaged by a participant recording a conversation addressed to them.

No Estonian case law was opened, and that hedge should travel with the answer.

Nothing in Estonian criminal law requires you to say anything as a participant. GDPR does, and it wants the information before the substance of the meeting rather than after it.

Quick note before we start: I'm recording this so I can write my notes up afterwards. It transcribes on my laptop, nothing goes to the cloud, and I only keep the text. Say so now if you'd rather I didn't.

Longer versions, and what to do when someone says no, are on telling people you're recording.

No Estonian authority was found on whether a participant's consent must be express or whether a calendar invite suffices.

GDPR applies as well, and the analysis is the ordinary European one: a meeting recording is personal data about every identifiable speaker, a transcript without speaker labels is still personal data, the household exemption is read narrowly and a work meeting has a direct connection to a professional activity, you need a lawful basis, and Art. 13 wants the information at the time the data are obtained, which for an always-on recorder means before the substance of the meeting. The European framework covers all of that once rather than on every country page.

Estonia has the closest thing in this survey to guidance on a tool like this one. AKI's explanation of 16 April 2026 answers a request about AI-based documentation software in healthcare: a tool that records a consultation, transcribes it and drafts a summary. Four positions from it generalise beyond healthcare.

Recording the whole session is the sensitive step, and it is a separate step. AKI says the audio must be assessed separately from the documentation itself, because creating a recording of the whole appointment brings about the processing of personal data on a substantially greater scale than the normal case where the professional writes down only what is needed, and it drags in third parties the subject happens to mention. Consent is the candidate basis and it is conditional: audio recording can be built on consent only where the person genuinely can receive the service without that processing and refusal does not worsen their position; silence or inaction is not consent and consent must be demonstrable. AKI has already enforced on this, in a precept of 8 December 2023 finding that recording, retaining and transmitting a patient conversation could not be treated as permitted under the sectoral health law alone. And on roles, transfers and a DPIA, the provider is typically a processor needing an Art. 28(3) contract, model improvement is a new purpose needing its own basis, transfers outside the EEA need their own assessment, and a DPIA is indicated where health data, AI processing, multiple providers and possible third-country transfer combine.

Be precise about which of those apply to a purely local tool. Four do not: the Art. 28 contract, the third-country transfer, the model-improvement purpose and the retention of the recording all fall away for something that uploads nothing, uses no processor, writes no audio to disk and trains on nothing. Two do: the minimisation point that a full-session capture sweeps in far more than the professional would otherwise write down, and the point that consent is valid only if it can actually be refused without detriment.

Estonia has no works council in the German sense. The employee-side counterparty is the töötajate usaldusisik, the employees' trustee, with information and consultation rights under the Employees' Trustee Act. We did not verify that, so it should not be treated as a rule without a citation.

AKI publishes a guide on processing personal data in employment relationships, and a separate guide on cameras. We opened the index page but not the guide document. Nothing was found on standalone audio monitoring of employees.

Andmekaitse Inspektsioon, AKI. In one line: it has not published general guidance on audio recording, but its 2026 explanation on AI documentation software treats capturing a whole session's audio as a distinct and data-hungry processing step needing its own basis, and treats consent as valid only where refusal costs the subject nothing. That reasoning is set out above, with the four concerns that a local tool answers and the two it does not.

Because the binding layer in Estonia is data protection rather than criminal law, this is where the product's architecture does real work. Transcription runs on your own device, the audio is never written to disk, and nothing is sent anywhere. There is no cloud component, so on our reading we are not a processor under Art. 4(8), which processes personal data on behalf of a controller and presupposes receiving it. That means no Art. 28 data processing agreement to sign with us, no sub-processor list, no international transfer and no transfer impact assessment, because there is no transfer. We found no decision squarely holding that an on-device-only vendor is not a processor, so that is reasoning you can check rather than a settled point.

What it does not do is disclose anything. There is no bot in the participant list and no banner on anyone else's screen, so the transparency obligation rests entirely on you saying something. Earkeep does not make anyone compliant and could not: a tool cannot be compliant, only a processing operation can be lawful.

Where it helps in the room is that stopping is real and checkable. A pause from the live edge releases the microphone and the system audio stream, so your operating system's own recording indicator goes dark in front of the person who asked. A meeting on a connected calendar can be marked never-record. And a stretch of the day, or a saved meeting with its transcript, can be purged from the file on your own disk, with no server copy anywhere to reconcile against.

• Penal Code, Riigi Teataja official English translation (§§ 137, 156, 157)
• AKI, explanation on AI-based documentation software (16 April 2026)
• AKI, personal data in employment relationships
• GDPR, EUR-Lex

• European recording laws: the four layers, the controller question, and all 32 countries.
• Telling people you're recording: the scripts, and the three ways to stop.
• Private by design: why the audio never leaves your computer.

This page is legal information, not legal advice. It summarises provisions and guidance rather than replacing them, and we are not lawyers. If the answer matters, ask someone who can be held to their answer.