Companies and organisations routinely hold meetings and document outcomes through minutes. But what about recording them to ensure accuracy? The CNPD issued a related opinion on April 1st, 2026 and no, it’s not an April’s fool joke. While audio recordings may seem practical, they also raise a few data protection issues. Luxembourg law does not specifically regulate this practice, so legality depends on identifying a valid legal basis under the General Data Protection Regulation.
Is voice considered personal data?
Yes, the answer is unambiguous here. Personal data is any information relating to an identified or identifiable person. A voice qualifies because it can identify someone either (a) directly when it is distinct and recognizable or (b) indirectly when combined with context, e.g. meeting participants, role, content.
Is recording a voice, “processing” of personal data in the sense of the GDPR?
Yes, recording a voice is processing of personal data under the General Data Protection Regulation. “Processing” includes collection and recording of personal data, so the moment you hit record, processing has already started.
So, what about the legal basis?
In short, the CNPD says:
👉 Consent is rarely valid in practice (not truly freely given in meetings),
👉 Legitimate interest is the main option, but only if it passes a strict necessity and balancing test.
Article 6(1)a GDPR – consent, could in theory form the basis for the processing of meeting audio recording. However, consent comes with very strict requirements to be considered valid:
1. Freely given: Participants in a meeting do not have the option to refuse the recording without suffering any disadvantage. They most often would have to leave the meeting. Solutions such as pausing the recording while someone speaks or not recording at all if there has’nt been a 100% consent rate, do not seem reasonable in practice.
2. Specific: Participants have to consent specifically for the audio recording of the particular meeting. Each time. Having that in an HR form or privacy statement will not suffice.
3. Informed: Participants must receive prior information (art. 13 GDPR).
4. Unambiguous: A clear affirmative act, individually by each person, is required. Where recording results from a vote, this cannot replace individual consent.
Article 6(1)f GDPR – legitimate interest, shall therefore apply on the following three conditions:
1. The interest must be lawful, sufficiently clear and specific. Audio recording is not prohibited by law and serves the practical purpose of accurate minutes, so it can reasonably be considered a legitimate interest.
2. The processing must be necessary for that interest. If the objective can be achieved by other equally effective but less intrusive means, then the processing does not pass the necessity test. Alternatives here could include a trained note-taker, fast note-taking techniques or automated transcription tools. However, in case of disputes over the content, only a recording may help resolve the issue. Therefore, necessity must be assessed on a case-by-case basis as the CNPD recommends.
3. The processing must not override the rights and freedoms of the individuals concerned. The impact on the individuals (e.g. they can’t talk freely), the nature of the data, the context and consequences as well as the reasonable expectations of the participants, shall all be considered to see if the processing passes the balancing test. Additional elements to take into consideration: the organisation’s nature and activities, the frequency and importance of meetings and the specific need justifying the recording.
Regardless of the legal basis relied upon, the CNPD considers that the retention period for recordings is intrinsically linked to the transcription of discussions in the minutes. The recordings must therefore be deleted once the minutes have been drafted, signed, and approved.
A few additional considerations if you ask me:
In the context of the necessity test, the CNPD is mentioning voice transcription tools should be favoured. Time to put in action this “Live Transcription” Teams AI feature or equivalent.
It goes without saying that if for the purpose of minute taking, voice recording needs to pass the necessity test, video-recording should not be an option at all… Recording the image or likeness of someone for the purpose of minutes is certainly not necessary, and consent won’t solve that.
In the context of the proportionality test, once a recording exists, the real risk is not the initial purpose (minutes), but what happens next. Audio files can easily be reused for HR monitoring, performance assessment, or internal investigations. Under the General Data Protection Regulation, this raises purpose limitation and compatibility issues. If you record, you need very tight governance on who can access it, for what purpose, and with what safeguards.
And keep in mind, recording cannot be a “silent default.” Participants must be clearly informed in advance (who records, why, who accesses, how long it’s kept), and ideally reminded at the start of each meeting. Under the General Data Protection Regulation, this is not just a transparency obligation, it directly affects the reasonable expectations of participants. If people do not genuinely expect to be recorded, the balancing test under legitimate interest is more likely to fail.
All in all, the real question is not “can we record?” but “do we genuinely need to?” In most cases, well-structured note-taking or transcription tools will achieve the same objective with far less intrusion. And if you do record, your compliance posture will be judged not only on the decision to press “record,” but on everything that follows: access, use, and timely deletion.
0 Comments