Recording meetings: what to clarify first

As a cautious rule, you record a meeting only if everyone speaking has agreed beforehand, they know where the recording is processed and when it is deleted, and an existing works council (Betriebsrat) is involved. If consent is missing, write the minutes as before. This article describes the legal position in general terms. Your data protection officer (Datenschutzbeauftragter) or your lawyer clarifies the individual case.

The spoken word is protected

Under section 201(1) of the German Criminal Code (Strafgesetzbuch, StGB), anyone who without authorisation records another person’s non-publicly spoken word on a sound recording is punishable by up to three years’ imprisonment or a fine. Using a recording made in this way, or making it available to a third party, is also punishable. So is the attempt (subsection 4).

A meeting with a fixed group of participants in the office or in the site cabin is generally regarded as non-public. Whether that is so in an individual case is for a lawyer to clarify. The decisive word is “without authorisation” (unbefugt). The standard rule is therefore: record only with the consent of everyone involved. Whether consent is enough in a particular case, for instance with external people, a lawyer checks if in doubt.

The second part of the provision concerns handling the recording, since use and passing on are covered as well. Restrict access to the people who write the minutes.

Voices and names are personal data

A recording contains voices, names and statements about people. To process it, the controller needs a legal basis under Article 6(1) of the General Data Protection Regulation (GDPR, in German DSGVO), for example the consent of the person concerned (point (a)) or the protection of legitimate interests (point (f)). Which basis holds for you depends on the individual case. For employees additional rules apply, which your data protection officer knows.

Anyone who consents can withdraw consent. Under Article 13(2)(c) GDPR, data subjects must be told of this right at the time of collection where the processing rests on consent. Plan a way, therefore, for someone to drop out even during an ongoing series of meetings.

The notice in the invitation

Article 13 GDPR lists what data subjects must be told at the time of collection. For a recording these are mainly the purposes and the legal basis, the recipients, any transfer to a third country and the storage period. An invitation sentence could read as follows. It is an unchecked example: neither a lawyer nor a data protection officer has seen it, and it replaces neither the consent nor the full information under Article 13.

The meeting will be recorded to produce the minutes, provided all participants agree. The recording will be processed by [provider, place of processing] and deleted no later than [period] after the minutes are approved. If you do not agree, please say so in advance. The meeting will then not be recorded.

Repeat the notice orally at the start of the meeting and note who agreed. An entry in the header of the minutes is a practical way. Whether it is sufficient as evidence is for your data protection officer to clarify.

Also decide beforehand what happens if someone objects in the middle of the meeting. The simplest rule is to stop the recording at once. How you handle what has already been recorded, settle with your data protection officer in advance.

External parties, online meetings and the transcript

At site meetings it is rare for only your own employees to sit at the table. The client, subcontractors and specialist designers are third parties. They too must receive the notice before the meeting and consent themselves. Your consent does not replace anyone else’s.

The same rules apply to the recording function of a video conference. Check whether the tool informs the participants and where it stores the recording.

The transcript is also personal data, since it holds the statements in text form. Treat it like the recording: same access, same deletion period. How a recording and transcript become a draft of the minutes is covered in the article on meeting minutes with AI.

If you want to work without recording other people, one alternative remains: after the meeting, the person writing the minutes speaks a summary alone. Then only their own voice is recorded. The draft is shorter and contains less, and the consent question under section 201 StGB does not arise for the others. If the summary names other people and what they said, it still contains personal data, and the GDPR rules apply to it.

Where the recording is kept and when it disappears

Say concretely in the invitation where processing takes place. “In the cloud” is not enough; provider and country are meant. For project and client data I recommend operation in the EU or locally and a data processing agreement (Auftragsverarbeitungsvertrag) with the provider. Which data belongs in which tool is covered in the article on data zones. Consumer chat services are not a suitable route for project and client data. Such an operation can be set up in line with the GDPR, but it is not a guarantee.

The deletion period follows from the principle of storage limitation in Article 5(1)(e) GDPR: data that identify people may be stored only as long as necessary for the purpose. The purpose of the recording is the minutes. Deleting shortly after the minutes are approved, and after a period for objections, is the obvious choice. You settle the exact period with your data protection officer. Also check that deletion actually happens, because a period alone deletes nothing. A spot check after expiry shows whether the recording is really gone, including in the recycle bin and in backups.

The principle of data minimisation under point (c) applies equally: only as much as necessary. As a rule I recommend only numbering speakers, using no voice recognition and no sentiment analysis, and building no performance or behaviour evaluation of employees from transcripts.

Works council

Under section 1 BetrVG, a works council is provided for in establishments that normally have at least five permanent employees entitled to vote, of whom three are eligible for election. It comes into being only when the employees elect one. If your business has one, two provisions come into play.

Section 87(1) no. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) governs co-determination on the “introduction and use of technical devices designed to monitor the behaviour or performance of employees” (our translation). Whether a recording and transcription solution falls under it is a question of interpretation that I do not decide. It depends on which data the system captures, who can see them and what it logs. That is a matter for employment-law advice.

Section 90(1) no. 3 and (2) BetrVG also oblige the employer to inform the works council about the planning of work procedures and workflows “including the use of artificial intelligence” (our translation) and to consult it. Without a works council, these rights fall away, but the GDPR duties remain. Inform your employees in every case about purpose, storage period and access.

Status of the provisions

I read the wording of section 201 StGB and sections 1, 87 and 90 BetrVG on gesetze-im-internet.de, and Articles 5, 6 and 13 GDPR in the Official Journal text, on 13 November 2026. The individual case is still for your data protection officer or a lawyer to check.

What you can do now

1. Write down the rule “recording only with everyone’s consent” and put it in every invitation.
2. Word the notice with purpose, provider, place of processing and deletion period. Have your data protection officer review it.
3. Set the deletion period and settle who checks that deletion has happened.
4. If there is a works council, speak to it before you start the first recording.