Can I Record a Meeting? GDPR and Criminal Law Explained

Anyone who wants to record a meeting needs a legal basis under GDPR and the consent of everyone involved. Unsurprisingly, many companies are unsure where they stand. In a survey by provider Sonix (2026), 73% of the companies surveyed name privacy concerns as the biggest obstacle to AI transcription tools. With the right preparation, you can record without violating GDPR or criminal law. Anyone who records without a clear legal basis, however, risks more than a fine. §201 StGB criminalizes the unauthorized recording of a conversation, and GDPR requires a documented legal basis for every processing of personal data. Both laws apply to every online meeting that gets recorded.

What rules apply to recording online meetings?

Meeting recordings touch two areas of law at the same time, each applying independently. Data protection law (GDPR) protects personal data, criminal law protects the spoken word. Since May 2018, GDPR fines across Europe have totaled around EUR 6.11 billion across 2,685 individual penalties (CMS.law, as of March 2026). At the same time, AI use in meetings multiplied 17-fold between January and August 2024 alone (Speakwise/Zoom, 2024). Where new tools make recording easier, the risk of crossing legal boundaries when processing personal data also rises. Which technology fits online, in-person, and hybrid meetings is covered in the article Recording a Hybrid Meeting.

Choosing the right basis for the recording

Every processing of personal data needs a legal basis under Art. 6(1) GDPR. Audio and video recordings contain voices, faces, and often names, all of which are personal data. Without one of the six legal bases, the recording is unlawful. In practice, three variants apply to meeting recordings: consent (lit. a), legitimate interest (lit. f), and a legal obligation (lit. c). The other three legal bases, contract performance, vital interests, and public interest, play no role for business recordings. Producing GDPR-compliant minutes also requires one of these legal bases.

When does a recording become a criminal offense?

§201 of the German Criminal Code criminalizes the unauthorized recording of the non-publicly spoken word. It carries up to three years in prison or a fine, and up to five years for public officials. The provision applies independently of GDPR and requires the consent of everyone involved, not just a majority. Even if you had a data protection legal basis, a secret recording remains criminally relevant. Anyone who wants to record a meeting must clear both hurdles at once: the criminal one and the data protection one.

When are you allowed to record a video conference?

The decisive question is usually not whether, but on which of the three relevant legal bases you are recording. Each has its own requirements, and the choice of legal basis determines which concrete obligations apply to you as the controller.

Consent of the participants

Consent is the most common legal basis and works well in practice when obtained correctly. According to exkulpa.de, consent must meet five conditions. It must be obtained before recording starts, phrased in understandable language, clearly state the purpose, be verifiable, and point to the right to withdraw at any time. In an employment relationship, consent must also be voluntary, because employees are in a dependent relationship and must not fear disadvantages if they decline. Always offer an equivalent alternative without recording, such as a follow-up summary.

In practice, participants do not need to consent again before every single meeting. Many companies set up a general consent declaration that employees sign once during onboarding or as part of an internal policy. This covers all future meetings as long as the purpose stays the same and employees can object to individual sessions at any time. A brief technical notice at the start of the recording (such as a pop-up or an announcement in the meeting tool) then reminds participants of the ongoing recording and gives them a chance to object.

Legitimate interest of the company

Legitimate interest under Art. 6(1)(f) GDPR applies when the recording serves a concrete, documented purpose, such as quality assurance, training, or compliance. According to an analysis by Datenschutz-Agentur, three conditions must be met: a justifiable business interest, the necessity of the recording for that purpose, and a documented balancing test showing that your interest outweighs the participants' personal rights. Datenschutzkanzlei points out that the balancing test for meeting recordings usually falls against the recording, because it creates significantly more surveillance pressure than a live broadcast. Recording individual training sessions or client calls with a clear documentation purpose is easier to justify than recording entire team meetings. Anyone relying on legitimate interest should therefore document in advance why a less intrusive means, such as written minutes, does not serve the purpose equally well.

Statutory minute-taking obligations

In certain cases, the legal basis follows from a statutory obligation under Art. 6(1)(c) GDPR. Works council meetings require minutes under §34 of the German Works Constitution Act, resolutions of a single-member GmbH require minutes under §48(3) of the German GmbH Act, and supervisory board meetings are subject to their own documentation duties under §107 AktG. The recording can then serve as a tool to fulfill this obligation, but only as far as the obligation extends. The recording must be deleted after it has been transcribed. A complete audio or video recording is only proportionate here if written minutes cannot equally fulfill the documentation purpose. In every case, the minutes must be archived in a GDPR-compliant way and deleted once the retention period ends.

What mistakes should you avoid when recording a meeting?

Meeting recordings are completely normal in everyday work and unproblematic in most cases, as long as the process is right. 58% of German companies now enable mobile work (Bitkom, 2025), and 24% of all employed people worked from home at least occasionally in 2024 (Destatis, 2025), almost double the 2019 share. More video conferences mean more recordings, and the same rules apply to every recorded online meeting as to an in-person discussion. The following three points are the most common pitfalls.

Consent obtained incorrectly or not at all

"I'm recording now, okay?" is a sentence many meeting participants know. Verbal consent is generally valid as long as it is verifiable, for example because it is captured on the recording itself. However, Datenschutzkanzlei notes that consent must be voluntary, informed, and verifiable. That means you must state the purpose and the right to withdraw before recording starts. Participants must also be able to object at any time without suffering any disadvantage. Anyone who joins the meeting after the recording has already started has not given informed consent and must be informed separately.

Storage without a deletion concept

Many companies record meetings and don't think about what happens afterward. Without defined deletion periods, storage violates the storage limitation principle under Art. 5(1)(e) GDPR. Personal data may only be stored as long as necessary for the original purpose. GDPR itself does not name specific periods. As FTAPI explains, specific retention periods only follow from other laws, such as 6 years for business correspondence under the German Commercial Code or 10 years for billing records under the German Fiscal Code. There is no statutory retention obligation for meeting recordings, which is why a documented deletion concept is essential. Decide in advance how long recordings are stored, who is responsible for deletion, and how it is documented.

Cloud tools without a data processing agreement

If your recording tool transfers data to the cloud, you need a data processing agreement (DPA) under Art. 28 GDPR. A DPA is a contract between your company and the cloud provider that governs how the provider may process your employees' personal data. This applies to all common video conferencing platforms where the recording runs through the provider's servers. Without a DPA, you as the controller are liable for all data protection violations by the service provider. The EUR 45 million fine against Vodafone in June 2025 traced back a third (EUR 15 million) to inadequate data processing arrangements, with the remaining EUR 30 million relating to insufficient authentication processes (DSGVO-Portal, 2025). Before using a new tool, check whether a valid DPA is in place. One way to reduce this risk from the outset is to use a tool like Jexity Meet, which by default processes recordings entirely locally on your own machine. Where no data is transferred to third parties, the risk of unlawful data transfers and the dependency on an external provider's contract terms both go down. With AI-assisted transcription in particular, local processing is an important building block for data protection, because voice data is among the most sensitive personal data. What to look for when choosing a conferencing provider yourself is covered in our article on secure video conferencing without the Cloud Act.

What happens with a secret recording?

The typical case in companies is an open, announced recording, and that raises no legal concerns. It only becomes a problem when someone records without the others' knowledge. The 249 GDPR fines totaling EUR 46.9 million issued by German authorities in 2025 cover the entire data protection field (DSGVO-Portal, 2025), but they show that authorities enforce consistently.

Criminal consequences

§201 StGB has no minor-offense threshold. Even a single secret recording of a team call can be a criminal offense. Prosecution requires a criminal complaint from the affected person. Besides imprisonment of up to three years, the recording and the devices used can be confiscated. In a professional context, a conviction can also trigger employment law consequences, ranging from a formal warning to summary dismissal.

Civil consequences and the exclusion of evidence

Secretly recorded conversations are generally not admissible as evidence before German courts. Anyone who presents such a recording, for example in a wrongful termination lawsuit, risks it being disregarded and can also become liable for damages themselves. Affected people can additionally assert claims for injunctive relief and deletion.

Recording law in Austria and Switzerland

Companies with locations in several countries need to know the strictest applicable rule. Across the DACH region, the legal situation for meeting recordings differs considerably.

Germany

Germany combines criminal protection (§201 StGB, up to three years in prison) with GDPR fines (up to EUR 20 million or 4% of annual revenue). Recording is only permitted with the consent of everyone involved or another legal basis.

Austria

In Austria, §120 of the Austrian Criminal Code also protects the non-publicly spoken word, but with an important difference. Participants in a conversation are generally not covered, as long as they do not pass the conversation on to third parties. In practice, this means a meeting participant may record the conversation for themselves, as long as the recording is not forwarded to uninvolved parties. The same GDPR fine ceilings apply as in Germany, since both countries fall under EU GDPR.

Switzerland

In Switzerland, the revised Data Protection Act (revDSG) has applied since September 2023. Art. 179ter of the Swiss Criminal Code criminalizes recording a conversation even if you are a participant yourself. The revDSG provides for fines of up to CHF 250,000, where liability falls not on companies but personally on the responsible individuals (datenschutz.law, 2024).

Does your company need a works agreement for meeting recordings?

A works agreement is a written contract between employer and works council that sets binding rules for all employees at the company. For meeting recordings, it is often the most elegant solution, because it replaces individual consent from every employee with a collective rule and creates legal certainty for both sides. If the recording solution is capable of monitoring employee behavior or performance, the works council's co-determination right also applies, which is almost always the case for meeting recordings. According to Sally.io, an effective works agreement contains at least the following points.

• Purpose: What is the recording for, such as producing minutes or exclusively supporting absent team members?
• Scope: Which meetings or bodies are covered, and which are explicitly excluded?
• Access rights: Who is allowed to view, listen to, or edit the recordings?
• Retention and deletion periods: When are the audio, video, or text files permanently deleted?
• Transparency: How and when are participants informed in advance?
• Right to object: How is it handled if individual employees object to the recording in a specific meeting?

Since February 2, 2025, companies must also train their employees in AI literacy (Art. 4 EU AI Act, daproserv, 2025). If AI-assisted transcription is part of the recording, the training obligation belongs in the works agreement. The agreement should also govern how minutes are created, stored, and deleted in a GDPR-compliant way. If the company uses a locally operating tool like Jexity Meet, the agreement can state that recordings and transcripts do not leave the machine as long as the optional cloud AI stays switched off.