Recording a work meeting can help you remember agreements and save time when preparing a summary. A phone, Teams, Zoom or an AI recorder makes this easy. To make sure this is actually useful for your company, set six things in place first: why you are recording, on what legal basis, with which tool, and what happens to the information after the meeting.
Can an employee record a work meeting?
Yes, if there is a legal basis in the specific situation and the necessary conditions are met. Recording organised by the employer should follow the company's established rules, but an internal policy alone does not create a legal basis for recording. A recording made by an employee to protect their own rights must be assessed separately.
If a person can be identified from the recording, for example by their voice, face or statements, personal data are being processed. This also applies where the recording is not published and is used only to prepare a meeting summary. The legal starting point comes from the General Data Protection Regulation, especially Articles 4–6.
An employer must respect an employee's privacy and monitor performance of work duties in a way that does not infringe the employee's fundamental rights. In Estonia, this obligation also follows from § 28(2)(11) of the Employment Contracts Act.
As a business owner, it is therefore worth asking: is recording the work meeting necessary, and does the recorded information remain under the company's control?
Why does the EDPB statement on smart glasses matter to your company?
On 13 October 2026, the European Data Protection Board, or EDPB, published a statement on the data protection risks of smart glasses. The glasses may look ordinary while containing a camera, microphone and connections to external services. Other people may not notice that data are being collected.
The EDPB specifically highlights workplace risks, including employee monitoring and protection of confidential company information and trade secrets. The statement is interpretative guidance on applying existing rules, not a new law. EDPB statement on smart glasses.
The practical lesson for a company is simple: the less visible the recording, the clearer the rules governing its use must be. The same issue arises with a phone recording from a pocket or an AI assistant taking meeting notes.
1. Decide why you need the recording
Start with the result you want. Do you need an accurate record of a client's instructions, training material, or a summary of action points?
Then choose the method that fits that purpose:
- To record agreements, a written summary reviewed by participants may be enough.
- To prepare minutes, audio alone may be enough, without recording video or screen sharing.
- For later viewing of training, video may be justified, but side conversations between participants may not need to be captured.
“Maybe we will need it later” is too vague a starting point. Saving time does not automatically justify recording every meeting in full.
If you are considering recording on the basis of legitimate interests, you must assess the existence of the interest, the necessity of the recording and the impact on participants' rights. Recording is permissible on this basis only where the participants' interests or fundamental rights and freedoms do not override the company's legitimate interest. The assessment should be documented before recording.
2. Identify the legal basis
Attending a meeting does not automatically mean consenting to being recorded. Nor does the announcement “we are starting the recording” replace the legal basis.
At the same time, not every work meeting recording has to be based on the consent of all participants. The appropriate basis depends on the purpose and circumstances. The mere existence of an employment or client contract does not in itself mean that recording a meeting is necessary for performance of that contract. GDPR, Article 6(1).
Consent requires particular care in employment relationships. An employee must have a genuine opportunity to refuse and to withdraw consent without pressure or adverse consequences. Because of the imbalance between employer and employee, voluntariness cannot simply be assumed. Consent must be informed, specific and unambiguous, and the controller must be able to prove that it was given.
Where recording is based on legitimate interests, a participant may object on grounds relating to their particular situation. Processing may then continue only if the company demonstrates compelling legitimate grounds that override the participant's interests and rights, or where processing is necessary for the establishment, exercise or defence of legal claims.
If the recording includes special categories of data, such as health data or trade union membership, one of the exceptions in Article 9(2) of the GDPR must also apply in addition to the ordinary legal basis. Legitimate interests alone are not enough for processing such data. Recording HR conversations should therefore be considered especially carefully.
3. Choose recording tools that are suitable for the company
The name of the device alone does not show how secure or appropriate the solution is. What matters is where the information goes and who controls its use.
A company's approved tools list could separately address:
- phones and voice recorders: whether the recording stays on the device or is uploaded automatically to cloud backup;
- computer recording applications: which audio, video or screen content is captured;
- Teams, Zoom and other meeting platforms: which account is used to record and who can access the recording;
- PLAUD-type AI recorders: how audio is converted to text and how summaries are generated;
- smart glasses and AI meeting assistants: whether they can also collect data about bystanders or conversations outside the meeting.
PLAUD's documentation describes the use of external AI service providers for transcription and summaries. The exact data flow depends on the feature and settings used. PLAUD explanation of AI processing.
A practical starting point is to choose company-approved solutions and define who may introduce new services. That way, each employee does not have to decide individually where to upload a client meeting recording.
Where the planned processing is likely to result in a high risk to people's rights and freedoms, a data protection impact assessment must be carried out before the processing begins. This should be considered separately, for example, in cases of systematic employee monitoring or large-scale processing of sensitive data.
4. Inform participants clearly
Where the employer organises the recording, inform participants before recording starts and make the required privacy information available to them.
At a minimum, a person should be able to understand:
- who is responsible for the recording and how to contact them;
- why the recording is being made and on what legal basis, and where legitimate interests are relied on, what those interests are;
- to whom, or to what categories of recipients, the data are disclosed, including external services;
- whether the data are transferred outside the European Economic Area and on what safeguards;
- how long the data will be kept or how the retention period is determined;
- what rights the person has, how to exercise them, and whom to contact with questions, including the right to lodge a complaint with the supervisory authority.
A platform's recording notification may help make the recording visible, but it may not provide all the information required. The full information must satisfy the applicable requirements for the specific processing. GDPR, Article 13(1) and (2).
With smart glasses, do not rely only on a small indicator light. The EDPB emphasises the need for signals that bystanders can actually notice and understand.
Clear information also helps maintain client trust. Discovering at the end of a meeting that it was recorded creates questions that could have been resolved before the meeting started.
5. Check where the recording and AI summary go
When using an AI summary, review the entire chain: recording → transcription → summary → sharing.
Ask the service provider:
- Which companies may process the audio or text?
- Do they act only on your company's instructions, or do they also use the data for their own purposes?
- Is the content used for model training?
- Where are the data processed and how are they deleted?
- Are the necessary contracts in place?
If a service provider processes personal data on behalf of your company as a processor, the processing must be governed by a binding agreement or other legal act that meets Article 28 GDPR. The agreement must be in writing, which may include electronic form; appropriate data processing clauses may also be part of the service agreement. Conditions for engaging sub-processors must also be checked.
If data are transferred outside the European Economic Area, the transfer conditions must also be reviewed. The location of a European server alone does not answer every question if a separate provider in a third country can access the data. An adequacy decision or appropriate safeguards, such as standard contractual clauses together with any necessary supplementary measures, may be required.
For client meetings, also check confidentiality obligations. The right to record people does not in itself create a right to send a client's trade secrets to an external AI service.
6. Define access, retention and review of summaries
The existence of a recording does not mean that the entire company should have access to it. Give access only to people who need it for their work and check the permissions on sharing links.
Set justified retention periods for the audio, transcript and final summary. They do not have to be the same. If the original recording is no longer needed for the lawful purpose, delete it according to the agreed procedure. Any new use of the recording, for example for assessing an employee's performance, must be assessed separately.
Example: during a project meeting, possible additional work is discussed. The AI summary describes it as work that has already been ordered. If the team relies on the summary without checking it, a dispute may arise about scope and price.
Therefore, also designate a person who checks the following before the summary is shared:
- decisions and agreements;
- task owners;
- deadlines, prices and other important terms.
The business value comes from the summary helping people act correctly. A well-written text alone does not guarantee that.
Can an employee record a conversation to protect their own rights?
This situation requires a separate assessment. For example, an employee may want to prove workplace harassment or threats. Merely taking part in a conversation does not create a general right to record it secretly or distribute the recording.
The Estonian Data Protection Inspectorate has explained that in exceptional circumstances a recording made without others' knowledge may be necessary evidence if the events cannot be proved otherwise. The important point is to use it to protect one's own rights and avoid distributing it to unrelated people.
The Supreme Court of Estonia stated in its 6 June 2019 judgment in case no. 3-17-842 that secretly recording work-related meetings is generally objectionable and unethical and may be justified only by serious reasons.
That case concerned circumstances predating the application of the GDPR. Today, the legal basis for recording must be assessed primarily under Article 6 GDPR, and where special categories of personal data are involved, Article 9 must also be satisfied. The necessity, scope and recipients of the recording must be assessed case by case.
Therefore, the issue cannot be reduced to a single rule that “recording is prohibited”. The permissibility of making the recording, using it as evidence, and sharing it further are separate questions. The purpose of protecting one's rights does not automatically make every recording lawful or guarantee that it will be accepted as evidence.
Put the recording rules into practice
A good recording policy helps your team decide quickly when to record, which tool to use and when a written summary is enough. This lets you gain the time-saving benefit of technology while keeping client information and agreements under control.
Write to info@magilex.ee and tell us which recording or AI tools your company uses or plans to use. Magilex can help assess the legal basis, service terms and prepare practical internal rules for your company.
