Do you need consent to use an AI notetaker?

Usually not formal consent, but you do need a clear, lawful reason for recording, and anyone outside your business, such as a client or a job candidate, must be told at the start of the call that it's being recorded and why. For a quick internal meeting where everyone knows the notetaker is on, the practical steps are light. For calls with clients, candidates or the public, they matter more.

An AI notetaker is a tool that joins or listens to a video call, records what's said, and turns it into a transcript and a summary. They're genuinely handy, and they're one of the easier ways to get real time back from AI. They just come with a few rules that are easy to miss.

This article explains what the regulator's guidance says. It isn't legal advice for your situation.

Even the regulator did its homework first

When the Information Commissioner's Office (ICO), the UK's data protection regulator, looked at switching on recording and transcription in Microsoft Teams for its own employee relations meetings, it drafted a data protection impact assessment running to 41 pages. That's a written check of the risks to people's personal information. (Since 30 September 2026 the regulator has formally been the Information Commission, though it still goes by the ICO.) The draft plans to keep the video for 60 days and the transcript for six years from the closure of the employee relations file, and the listed recipients include external legal advisers and, potentially, the Employment Tribunal.

You can read the disclosed copy, which is marked as a draft. Most businesses won't need anything like that for a routine meeting, and that's fine. Some meetings do need more thought, and the line between the two is clearer than you might expect.

Recording a meeting means you need a reason

If people are talking in a meeting, the recording and the transcript contain personal information, and using it is what the law calls "processing". That isn't a grey area. The ICO's guidance on monitoring workers is clear: you must identify a lawful basis (one of the legal reasons the law accepts for using personal information), you must be clear about your purpose, and you must not monitor workers "just in case".

Asking everyone for consent sounds like the obvious answer, but it usually doesn't work at work. The ICO says consent "is not usually appropriate in the employment context, due to the imbalance of power between you and your workers. Workers are likely to feel that they have no choice but to give you consent." It's a bit like your boss asking if you "mind" something: it's hard to say no.

That usually leaves "legitimate interests", meaning a genuine business reason that you've weighed against the interests of the people involved. The ICO calls it the most flexible basis, but it comes with a three-part test: is your purpose legitimate, is recording necessary for it, and does it fairly balance against the people affected? You're expected to have actually worked through that and written it down. The guidance also warns that legitimate interests may not fit if "it is likely some workers would object if you explained it to them", which is a useful question to ask about your own notetaker.

One line in the ICO's guidance points in this direction. Discussing audio surveillance, it notes that "many video conferencing apps also have the capability to record audio", that audio recording "is considered more privacy intrusive than purely visual recording", and that "you should switch off by default any capability to record audio". That was written about monitoring workers, not a tool summarising a project call, and the two aren't the same. But it shows where the regulator starts from, which isn't where many default settings start.

Worth knowing: this guidance is currently under review because of changes made by the Data (Use and Access) Act, so the detail may shift.

Your own team meeting and a client call are different

Three of you recording your own Monday planning call, on your business account, with everyone aware of it, isn't a cause for alarm. You still need a purpose and a lawful basis, and you should know where the file ends up. But it doesn't need an elaborate process.

A call with a client, supplier, job candidate or member of the public is different, for a simple reason: they aren't your staff, they haven't seen your staff handbook, and they won't know a transcript is being made unless you tell them. The ICO's guidance on monitoring telephone calls is direct: "You must tell these people that you are recording the call and why. A recorded message is good practice."

Under Article 13, people have to be given privacy information "at the time when personal data are obtained". For a call, that means at the start of it, not in a policy on your website they'll never read.

Interviews with job candidates need the most care. There's a lot of personal information, the power imbalance is considerable, and it's exactly the kind of record that gets asked for later if someone doesn't get the job.

A transcript is a record, and records can be requested

This is the part people tend to miss. A transcript isn't just a handy summary. It's a document, and documents can be asked for.

Anyone in the meeting can make a subject access request, which is a person's legal right to ask for a copy of the personal information you hold about them. You have one month to respond, but since the Data (Use and Access) Act, Article 12A of the UK GDPR starts that month from the latest of three moments: when you receive the request, when you receive anything you asked for to confirm who the person is, and when any fee you've charged is paid. If you reasonably need to ask what data the request is about, the days from when you ask until they reply don't count. You can extend by two further months if the requests are complex or numerous, as long as you tell the person why before the first month is up. That applies to requests received from 5 February 2026. The ICO's Q&As for employers still say "within one month of receipt", which was the old rule.

The monitoring guidance adds a warning worth reading twice: responding may be hard "if the systems you use do not store information in a way that makes personal information readily retrievable", and you should think about how easily you can find it before you choose the tool. It's like a filing cabinet: if everything's thrown into one drawer, finding every mention of one person takes a long time.

In a court case, the definition is wider still. Under Civil Procedure Rule 31.4, a document means "anything in which information of any description is recorded". A word-for-word transcript of a call where somebody said something careless fits that exactly.

Written notes have always been something you might have to hand over. What's changed is the amount. Where you used to have a few bullet points chosen by whoever took notes, you now have every word, including the chat before the meeting properly started.

Some tools can clear old transcripts out for you. In Microsoft Teams, for example, recordings and transcripts can be set to expire after a number of days you choose, and Microsoft says they're then moved to the recycle bin automatically. Not every notetaker offers that. If you'd like your notetaker set up so transcripts are kept only as long as you've decided, we're happy to set that up for you.

What happens to the recording depends on the tool

The tools handle this very differently, and the details are in each company's own documents. For a wider look at the training question, see our article on whether AI trains on your business data.

Otter.ai says in its privacy policy that it uses meeting information to improve its services, "including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)". "De-identified" means names and obvious identifying details have been removed. It also shares data with "data labeling service providers who provide annotation services", which are companies whose staff tag data to help train AI, and it gives no fixed retention period, saying it stores personal information "for as long as necessary to fulfill the purposes set out in this Policy".

Microsoft takes the opposite position for Microsoft Copilot, its assistant built into Microsoft 365: prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation LLMs", according to its privacy documentation. Microsoft Graph is the behind-the-scenes connection that lets Copilot see your emails, files and calendar. Teams recordings and transcripts are saved in the meeting organiser's OneDrive, and Microsoft notes that "all meeting invitees, except for external participants, automatically get a personally shared link". So by default, a transcript of a client call sits in one person's own storage. Microsoft also notes that Copilot prompts and responses in a meeting "might be retained for compliance purposes, even if recording and transcription are turned off".

These sources don't contradict each other. They're two companies with genuinely different policies, which is the point: "an AI notetaker" isn't one thing, and you can only answer the training question for the tool you're actually using.

If comparing those policies and choosing a notetaker that fits how you work isn't something you want to spend an afternoon on, we're happy to help you pick one and set it up.

Being within the rules isn't the same as people being comfortable

You can follow every rule above and still make people uneasy.

People talk differently when they know a tool is transcribing. The half-formed idea doesn't get mentioned. An honest "we're behind, and here's why" becomes more guarded. On a sales call, a notetaker nobody mentioned can make the other person feel processed rather than listened to.

The courtesy is simpler than the law. Say it in the first few seconds: what's recording, what you'll use it for, and that you'll turn it off if they'd prefer. It costs nothing, and if someone does object, they usually have a reason worth hearing.

It works the other way too. When someone else's notetaker is in your meeting, your words are subject to their retention policy and their tool's training terms. It's entirely reasonable to ask about them.

What we'd suggest

For your own internal meetings, on a business account, with everyone aware: carry on. Choose how long transcripts are kept rather than letting them pile up, and know where they're saved.

When clients, candidates or the public are on the call: mention the recording at the start, every time, and write one short paragraph explaining what you record, why, how long you keep it and who can see it. That paragraph covers a lot of what people need to know.

Then read your tool's privacy policy once, looking for what it says about training and about how long it keeps things. It's much better to know that now than to find out when someone asks.

If you'd like a notetaker, or other AI, working inside the tools you already use, there's more on what we do, and we're happy to talk it through.

Sources

• Employment practices and data protection: monitoring workers - ICO
• Specific considerations for different methods of monitoring workers - ICO
• Subject access request Q and As for employers - ICO
• UK GDPR, Article 12A - legislation.gov.uk
• When should we provide privacy information? - ICO
• DPIA: Microsoft Teams recording and transcription - ICO
• ICO governance changes confirmed for 30 September 2026 - ICO
• Civil Procedure Rules, Part 31 - Ministry of Justice
• Privacy Policy - Otter.ai
• Data, privacy, and security for Microsoft Copilot - Microsoft
• Teams meeting recording and transcript storage and permissions - Microsoft
• Manage Teams recording expiration policy - Microsoft
• Manage Microsoft Copilot in Teams meetings and events - Microsoft

Checked on 9 October 2026. Vendor retention and training policies change often, and the ICO's monitoring guidance is under review following the Data (Use and Access) Act, so check the links rather than trusting this page.