Is it legal to record a meeting in Europe?

Every entry below is a summary of a provision, not a substitute for reading it, and several carry named gaps where nothing authoritative could be found. We are not lawyers. If the answer matters, ask someone who can be held to their answer. The cross-border question, which a European reader hits immediately, is on recording laws.

Yes. Art. 4(1) GDPR defines personal data as any information relating to an identifiable person, and Art. 4(2) makes recording, storage and transcription "processing".

A transcript with no speaker labels is still personal data. Removing the name does not make the content anonymous where the speakers are identifiable from context, and in a meeting transcript they nearly always are: the participant list, the calendar event and the content itself identify them. Recital 26's test is whether identification is reasonably possible, not whether a name field exists.

It is probably not Art. 9 biometric data, and that matters. Art. 4(14) defines biometric data as data resulting from specific technical processing which allows or confirms unique identification. A recording transcribed to text with no voiceprint, no enrolment and no speaker identification is not being processed to identify anyone, so the special category regime is not triggered by the voice itself. Two caveats. The content can be special category data even when the voice is not, if someone mentions their health, union membership or religion. And the conclusion depends on there being no diarisation.

This is the question most likely to be answered wrongly in a vendor's favour, so it is the one to be hardest on. Art. 2(2)(c) excludes processing "by a natural person in the course of a purely personal or household activity". Recital 18 settles it, and the operative words are the ones after the comma: "and thus with no connection to a professional or commercial activity".

Recording your own work meetings has a direct connection to a professional activity. That is the exact phrase the recital uses to draw the boundary. The CJEU has read the exemption narrowly and consistently: Ryneš (C-212/13) held a home camera capturing public space was outside it and said the exemption must be narrowly construed; Lindqvist (C-101/01) and Jehovan todistajat (C-25/17) point the same way. Norway's Datatilsynet says directly that recording meetings is "som regel ikke" a personal activity.

Does it matter whether the notes stay private? It changes the risk, not the exemption. The test is the nature of the activity, and a work meeting fails it whether or not the notes are shared. Do not treat yourself as exempt. A page that offers a professional the household exemption as a shield is the most harmful thing this subject can publish.

Almost every question below has two answers depending on which of these you are.

You, on your own device, for your own notes. There is a real argument that you are the controller, because you determine the purposes and means and your employer neither instructed the processing nor receives the data. Under EDPB Guidelines 07/2020 controllership follows factual influence rather than a label. Two honest complications: if the notes feed work output, your employer may become a joint or subsequent controller for that output; and being your own controller for processing about colleagues offers you no shelter behind your employer's compliance programme. We found no supervisory authority statement squarely on an employee-as-controller meeting recorder, so treat this as reasoning rather than settled.

Your employer, deploying it across a team. The employer is the controller and the obligations arrive as a stack: a documented legitimate interest assessment, an Art. 13 notice to every participant, a retention period and a deletion routine, an Art. 30 record, a plausible DPIA, national employment-law compliance, and works council involvement where the country requires it. This is the case the table's last column is about, and it is where most of the real obstacles are.

Where there is an employment relationship, consent is rarely freely given, because the employee cannot refuse without fearing detriment. The Article 29 Working Party's Opinion 2/2017 on data processing at work treats employee consent as problematic for most workplace processing, and the consent guidelines make the imbalance-of-power point generally.

Three distinctions are worth drawing. Employer to employee consent is the weak case: a manager asking their own reports is close to the paradigm the guidance warns about. Peer to peer consent is meaningfully less fragile, because two colleagues at the same level are not in the hierarchical relationship the argument rests on, though that is reasoning rather than a cited holding. And criminal-law consent is a different thing from GDPR consent. In Germany, consent is what makes a recording not "unbefugt" under StGB § 201, and that question is not governed by GDPR's freely-given test. A recording can be lawful criminally and lack a valid GDPR basis, or the reverse.

Legitimate interest under Art. 6(1)(f) is usually the better fit, and needs a documented three-part test. Two facts about a local, on-device recorder help it honestly: audio is not retained, and there is no third party in the chain. Two facts hurt it, and a balancing test that omits them is not a balancing test. Capture is continuous rather than per-meeting, which cuts against necessity and against reasonable expectations, and participants have no way to verify what was captured.

The EDPB's Guidelines 1/2024 on legitimate interest set out the structure, but as of this page's date they remain a draft whose consultation closed in November 2024 with no final version adopted. Cite them as a draft.

Art. 13 applies where the data are obtained from the data subject, and requires the information "at the time when personal data are obtained". The required set includes who you are, the purposes and the legal basis, the recipients, the retention period, the right to object and the right to complain to a supervisory authority.

For an always-on recorder that is the sharpest point on this page. "At the time the data are obtained" means the announcement belongs at the start, before the substance, and a tool that is already recording when the meeting begins does not satisfy Art. 13 by mentioning it at the end. Because Earkeep puts no bot in the call and shows no banner to anyone else, there is no automatic disclosure at all: the obligation rests entirely on the person running it.

Art. 5(2) makes the controller responsible for demonstrating compliance, and Art. 7(1) requires being able to demonstrate that consent was given. Practically: written down, dated, and specific about what was announced. That is why a script is worth more than a good intention.

Art. 35(3)'s presumptive triggers do not obviously fit a private meeting; the operative test is the WP248 nine criteria, where meeting two or more usually indicates a DPIA is needed. Applied honestly to an employer-deployed always-on transcriber, several land: systematic monitoring, data concerning vulnerable data subjects (which explicitly includes employees because of the imbalance), innovative use of a technology, large scale where a team is involved, and evaluation or scoring if the transcripts feed anything performance-related. On that reading a DPIA is plausibly required, and it is cheap insurance either way.

For an individual recording their own meetings on their own device, a formal DPIA is much harder to argue as required, mainly because scale and systematic monitoring of others are weaker. We have not verified the German, French and Dutch mandatory-DPIA lists, so we do not assert what is on them.

"May a participant record" is the criminal layer only. A yes there does not mean GDPR is satisfied and it does not mean an employer may deploy the tool. The last column is about the employer case, which is usually where a rollout actually stops. Every row has a page of its own, with the provision, the participant question and what you have to say.

The table looks like a ranking and it is not. European recording law splits by how the offence happens to be drafted, and the split is close to arbitrary from a reader's point of view.

Family one, sixteen countries, where the participant is outside the offence, because the provision is written around recording a conversation between others: Sweden, Denmark, Norway, Finland, Estonia, Latvia, Belgium, Ireland, Slovenia, Malta, Spain, Italy, Poland, France, the United Kingdom and the Netherlands.

Family two, nine countries, where the participant is caught, so consent is not a courtesy but the thing keeping the recording lawful: Germany, Switzerland, Portugal, Greece, Iceland, Lithuania, Croatia, Cyprus and Luxembourg.

Family three, five countries, criminally clear but civilly not, arriving at the same practical place by another route: Austria, Liechtenstein, Slovakia, Hungary and Czechia.

Two are their own category. Romania exempts a participant only where they justify a legitimate interest, which is undefined. Bulgaria's constitution sets knowledge rather than consent as the baseline, plus an express-objection veto, so notice is required but agreement is not.

On exposure rather than on reputation, the five strictest for an individual are Greece (ten years), Cyprus (ten years or €100,000, on an unsettled question, which is worse to plan around than a clear prohibition), Portugal, Switzerland and Germany. Earlier readings that put Germany at the top were wrong.

Sixteen of these jurisdictions produced nothing at all from their data protection authority on audio recording. Two did, and both are directly on point.

Luxembourg's CNPD published guidance on recording meetings specifically, rather than on cameras or call centres, which as far as we can tell makes it the first in Europe to do so. Four things it says: Luxembourg law does not address meeting recording directly, so the analysis runs on GDPR and case law; for consent to be free, people must be able to decline without disadvantage, and its own example is providing a way to switch the recording off while a particular person is speaking; legitimate interest is available in principle but equally effective less intrusive alternatives usually exist, and it names automated transcription among them; and recordings must be deleted once the minutes have been written and approved. That first example is in direct tension with a continuous recorder, and the tension is in the product rather than in how it is described.

Finland's Data Protection Ombudsman answered this exact question on this exact scenario in decision 2007/223, though its household-exemption reasoning is pre-GDPR and cannot simply be recycled.

France's CNIL and the UK's ICO are the two regulators with real published positions on the employer case, and both are adverse. CNIL: "une surveillance constante est excessive". The ICO: "you should switch off by default any capability to record audio", and continuous recording is "unlikely to be able to justify in most circumstances".

Two things about the product are relevant, and they are relevant to different layers.

On the data protection layer, the architecture genuinely changes the analysis. Transcription runs on your own device, the audio is never written to disk, and nothing is sent anywhere. There is no cloud component, so on our reading we are not a processor under Art. 4(8), which processes personal data on behalf of a controller and presupposes receiving it. The practical consequence is concrete and checkable: there is no Art. 28 data processing agreement to sign with us, no sub-processor list, no international transfer and no transfer impact assessment, because there is no transfer. We have not found a decision squarely holding that an on-device-only software vendor is not a processor, so that is reasoning you can check rather than a settled point.

On the criminal layer it changes nothing at all, and this is the sentence that matters most on this page. In Germany, Austria, Switzerland and Portugal a recording made without the other speakers' consent is the same offence whether it was processed locally or in someone's cloud. Local processing is a data protection argument and nothing else. Austria makes the point sharper still: OGH RS0127498 reaches the transcript, not only the audio, so "we never keep the audio" does not help there.

Earkeep does not make any recording lawful, does not make anyone GDPR compliant, and cannot: a tool cannot be compliant, only a processing operation can be lawful. It announces itself to nobody, so telling the room is entirely yours to do. What it gives you is three ways to stop, each usable in front of the person who asked. A pause from the live edge releases the microphone and the system audio stream, so the operating system's own recording indicator goes dark. Any event on a connected calendar can be marked never-record. And a stretch of the day, a saved meeting or a whole day can be purged, with no server copy anywhere to reconcile against.