Ingrid Hansen chairs the Monday team call for a claims department. Six colleagues join, and so does a seventh participant: "Notetaker for Ms Novak". Ms Novak linked a free AI notetaker to her calendar at home, and now it attends every meeting she is invited to. Nobody knows where the recording goes. Halfway through, a colleague explains why he was off sick last week.
The summary was useful, which is the problem. Action points appeared in the chat within a minute. That is why notetakers spread fast, and why a privacy team should look at them before they become habit.
What an AI notetaker does with your meeting
A notetaker records the conversation or turns it straight into text, works out who is speaking and writes a summary with action points. You will meet three kinds:
- Built into Teams or Zoom. Copilot in Teams and AI Companion in Zoom. They run inside your organisation's account and admins switch them on or off.
- A third-party notetaker that joins as a participant. A service linked to someone's calendar that enters the call as a bot. The recording goes to that vendor.
- An app on a phone or laptop that records the room or the computer's audio. The meeting itself sees nothing.
To the GDPR the format barely matters. Voices, names and whatever is said about colleagues, customers or patients are personal data. A transcript by speaker records who said what. What differs is who receives the data and what you can configure.
What the GDPR asks before the notetaker starts listening
The GDPR (checked 26 October 2026) has no article on notetakers. The ordinary rules apply, and most of them come down to a few agreements.
A purpose that makes the recording necessary. Minutes of a project meeting are a different purpose from keeping every one-to-one on file. Write down why you record. If that takes more than a sentence, you probably don't need to.
Telling people before it begins. Article 13 requires you to tell people what happens to their data when you collect it. In a meeting, that means at the start, not in a privacy notice nobody opens.
Deleting what you no longer need. Storage limitation in Article 5 applies to transcripts too. A month after the meeting the summary usually suffices; decide who deletes the recording and transcript, and when.
Special category data. Health, religion, ethnic origin and a few other categories fall under Article 9, and processing them is prohibited unless an exception applies. Sickness absence meetings, case reviews in care and disciplinary hearings are not where a notetaker belongs.
A processor agreement for a third party. A vendor that records your meeting is a processor, and Article 28 requires a contract. What to look for is set out in data processing agreements for AI tools.
An impact assessment for routine use. Rolling a notetaker out across the organisation, including calls with customers or patients, is likely to need a DPIA under Article 35. See DPIAs for workplace AI.
Everyone in the call has to know, guests included
Guidance on recording staff conversations already exists, and it carries over to notetakers. The Dutch regulator's page on monitoring communications (in Dutch, checked 26 October 2026) is a clear example. Recording is allowed when necessary; staff have the right to know when a call is being recorded; telling them once when they are hired is not enough; and the other party must also be told in advance, including what the recording is for. Covert recording to coach or assess staff is not allowed.
That guidance is about phone calls, but it reads straight across to a meeting. In Ingrid's call, colleagues saw an extra name in the list. Nobody said that a recording was running, whose it was or why. An outside guest would have had even less idea.
What Teams and Zoom handle, and what they leave to you
The built-in notetakers do announce themselves. Microsoft's page on live transcripts (checked 26 October 2026) says all participants see a notification when transcription starts. Zoom's AI whitepaper (checked 26 October 2026) describes an illuminated AI icon in the top-right of the meeting window, and participants can ask the host to turn the AI features off.
| Teams with Copilot | Zoom AI Companion | Third-party notetaker | |
|---|---|---|---|
| Notice to participants | When transcription starts | AI icon on screen | An extra participant in the list |
| Where the transcript lives | Organiser's OneDrive | With Zoom; can be set to keep no transcript | With the vendor |
| Training on your meeting | No, according to Microsoft | No, according to Zoom | Depends on the terms |
| Who turns it off | Admin and organiser | Admin and host | The person who linked it |
One Teams setting deserves attention. In the meeting options, Copilot can be set to "Only during the meeting". Copilot then works from speech-to-text during the call, and once it ends that data and the Copilot conversation are gone, unless someone started a transcript. That comes from Catch up on meetings with Microsoft Copilot in Teams (checked 26 October 2026). If someone does transcribe, the transcript sits in the organiser's OneDrive until the organiser deletes it. Teams will not apply a retention period for you.
On training, both vendors are explicit. Microsoft states in Data, Privacy, and Security for Microsoft Copilot (checked 26 October 2026) that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models. Zoom states in the data governance section of its whitepaper (checked 26 October 2026) that it does not use customer audio, video, chat or other communications content to train its own or third-party models. With the transcript set to zero days, Zoom discards the temporary text once the summary is generated.
A third-party notetaker adds a party to the meeting
Ms Novak's notetaker is the hard case. She connected it with a personal account, the organisation has no contract with the vendor, and the recording sits somewhere the organisation cannot reach. Whether the vendor trains on it depends on terms nobody in the meeting has read.
Banning it is rarely the useful first move. The better question is whether you have an approved notetaker to point people to. If you already run Teams with Copilot or Zoom with AI Companion, you can say: use the built-in one, with these settings, and not in these meetings. That gives Ms Novak a reason to unlink her own.
When employee representatives get a say
A transcript by speaker of every meeting shows who said what, how often and for how long. Depending on where you operate, employee representatives may have to agree before such a system is used. In the Netherlands, for instance, the AP's page on works councils and staff monitoring systems (in Dutch, checked 26 October 2026) says a system that could be used to check attendance, behaviour or performance counts as a monitoring system even if it is not used that way, and that the works council has a right of consent over arrangements for it. Check what applies where you operate before the notetaker goes on by default, not after.
The agreements to make up front
- Which notetaker is allowed? A built-in one, a third-party one with a processor agreement, or none. Record the decision and the reason in your AI register.
- Which meetings stay notetaker-free? Sickness absence, performance reviews, confidential HR matters, client and patient case reviews.
- Who announces it? The organiser, before the notetaker starts, with the purpose. External guests hear it too.
- What can participants do? Object without it costing them anything. Then the notetaker goes off.
- How long does each thing stay? The summary goes to the project file; the transcript and recording are deleted after a fixed period.
- Who configures it? The Teams or Zoom admin sets the default; the organiser can change it per meeting.
Most of this lives in the Teams and Zoom settings and in a short agreement per team. What remains is visibility of the notetakers people find for themselves. In the BeeSensible catalogue every AI tool has a category by function, meetings being one, along with whether the vendor trains on input, whether a processor agreement is available and where the service is hosted. When someone opens the web app of a notetaker the organisation has not decided on yet, the tool shows up under See and in the Inbox, and the decision is recorded under Decide. A bot that joins meetings through someone's calendar is something you switch off in Teams or Zoom itself. For privacy teams setting this up alongside their GDPR agreements, there is AI governance for privacy officers.
