AI Meeting Notes and GDPR Compliance: What You Need to Know

• GDPR applies globally if you process data of EU residents—Malaysia location doesn't exempt you
• Personal data in meetings includes names, email addresses, voice recordings, and discussion content
• You are the data controller—you decide whether to record; the software vendor is the processor
• Enforcement is real: 4,321 GDPR complaints filed across EU in 2023 alone
• Fines are severe: €10–€20 million or 2–4% of global annual revenue for serious violations
• Reputational damage often exceeds the fine—clients withdraw trust in weeks

1. Data Processing Agreement (DPA)

• Legally bind your software vendor to GDPR rules in writing
• Vendor must agree to only process data as you instruct
• Must cover sub-processors (third parties your vendor uses)

2. Encryption and Security

• Data must be encrypted in transit (TLS 1.2+) and at rest (AES-256 minimum)
• Software costing RM500–RM5,000/month must include these as standard
• Ensure vendor conducts annual penetration testing or ISO 27001 audit

3. Explicit User Consent

• Inform meeting participants *before* recording that notes will be made
• Get written consent—a pop-up or email confirmation counts
• Make opting out easy; don't bury consent in legal jargon

4. Data Retention Limits

• Don't keep recordings longer than necessary (typically 30–90 days)
• Auto-delete old files; don't archive indefinitely
• Document your retention policy in writing

5. User Rights and Accountability

• Employees/clients must be able to request, view, and delete their data
• Implement a process to handle "right to be forgotten" requests within 30 days
• Keep audit logs showing who accessed what, when

• ❌ No Data Processing Agreement provided by vendor
• ❌ Vendor shares data with US servers without Privacy Shield equivalent
• ❌ Automatic data sharing with marketing/analytics partners—even anonymised
• ❌ No encryption between your device and vendor's cloud
• ❌ Data retention policy is vague ("we keep it indefinitely")
• ❌ No way for users to request data deletion
• ❌ Vendor cannot prove ISO 27001 certification or recent security audit
• ❌ Cost suspiciously low (under RM200/month) with no clear data handling policy
• ❌ Vendor located in non-GDPR jurisdiction with no EU subsidiary

Step 1: Request a Signed Data Processing Agreement

• Email the vendor's legal team; demand a DPA within 14 days
• If they refuse or delay, flag them as high-risk
• Ensure the DPA covers your specific use case (internal meetings, client calls, training, etc.)

Step 2: Check Data Location and Servers

• Ask: Where are recordings and transcripts stored? (EU, US, Australia, etc.)
• Verify if data leaves the EU at any point in the pipeline
• Demand documentation proving encryption in flight and at rest

Step 3: Review Their Privacy Policy

• Look for: data retention timeline, deletion procedures, sub-processors listed
• If the policy is a generic template, assume they're not GDPR-ready
• Check if they monetise user data (e.g., sell insights to third parties)

Step 4: Verify User Consent Mechanisms

• Test the software: does it clearly ask permission before recording?
• Can meeting participants easily opt out or request deletion?
• Is the consent mechanism documented in your contracts?

Step 5: Request a Security Certificate

• ISO 27001, SOC 2 Type II, or equivalent audit report (dated within 2 years)
• Penetration test results from an independent firm
• If the vendor won't share, consider it a disqualifier

1. Document Your Data Handling Process (Week 1)

• Create a 1-page policy: when you record, who sees notes, how long you keep them
• Share with your team and all meeting participants
• Store the policy in a shared drive with version history

2. Update Your Meeting Invitation Template (Week 1)

• Add a standard line: *"This meeting will be recorded and transcribed. By joining, you consent to participate."*
• Include a link to your data handling policy
• Offer participants the option to join audio-only (video off) if uncomfortable

3. Configure Auto-Delete Settings (Week 2)

• Set your meeting software to auto-delete recordings after 60 days
• Move sensitive recordings (layoffs, salary reviews, legal) to a separate folder with manual deletion
• Test the auto-delete function once before deploying

4. Train Your Team (Week 2)

• 30-minute session on what GDPR means for your software choice
• Teach employees how to handle deletion requests (answer within 10 days)
• Share the list of approved vendors; block others via IT policy

5. Audit Quarterly (Ongoing)

• Run a spot-check: pick 5 random recorded meetings, verify they're deleted on schedule
• Review user deletion requests; ensure they're completed on time
• Re-confirm vendor's DPA and security certification status annually

Tier 1: Enterprise (RM3,500–RM8,000/month)

• Full DPA included; EU data residency guaranteed
• ISO 27001 + SOC 2 Type II certified
• Dedicated GDPR compliance officer available
• Examples: Otter.ai Enterprise, Microsoft Teams Premium with compliance add-ons
• Best for: Large teams, regulated industries (finance, healthcare), high-value client calls

Tier 2: Mid-Market (RM800–RM2,500/month)

• DPA available on request (usually within 7 days)
• EU servers with optional encryption add-on
• Annual security audit provided
• Examples: Fireflies.ai, Otter.ai Pro, Avoma
• Best for: SMEs with 10–50 employees, occasional EU client exposure

Tier 3: Startup / Self-Hosted (RM150–RM600/month or free)

• DPA rarely available; often requires legal negotiation
• Data location varies; US default in many cases
• No formal security certification
• Examples: Jott, Mem.ai, open-source transcription (whisper.cpp)
• ⚠️ High risk for GDPR if you process EU resident data—avoid unless you have a lawyer review