Voice AI Meeting Transcripts: Privacy Controls

Decide the purpose, lawful basis, participant notice, access group and retention period for meeting transcripts before anyone switches transcription on.

What the risk is

A meeting transcript is a verbatim record of everything said, by named people, stored as searchable text. It contains the throwaway remark about a colleague, the customer's phone number read out loud, the health reason for someone's absence, and the moment a director said something they would not have written down. AI summaries then lift the most quotable lines and put them in an email.

Under UK GDPR that record is personal data about every participant, and often about people who were not in the room. The ICO's guidance on monitoring workers treats recording and transcribing staff as monitoring that needs a lawful basis, transparency and proportionality. The practical risk for a small business is rarely a deliberate leak. It is a transcript left in the organiser's OneDrive for years, shared with the wrong Teams channel, or fed into an assistant that then answers a question it should not.

A realistic UK SME example

A property management firm turns on transcription for all Teams meetings so that Copilot can produce minutes. It saves a great deal of typing. A tenant complaint meeting includes a discussion of the tenant's mental health, which a manager mentions to explain the tenant's behaviour. Three months later a new starter asks Copilot for "everything we know about" that tenant before a visit. The summary includes the health remark, and it goes into a briefing note that is later disclosed in a subject access request.

No one intended this. The firm never decided who could see transcripts, never told participants what would happen to them, and never set a deletion date.

Controls in priority order

1. Decide the purpose and lawful basis first. For internal meetings the basis is usually legitimate interests, with a short written assessment; consent is a poor basis for employees because they cannot freely refuse. For meetings with customers or third parties, tell them at the start and give them the option to have transcription turned off.
2. Give notice that people will actually see. Put the transcription notice in the meeting invitation and in the recording announcement, and update the staff privacy notice. Teams and Google Meet both show participants an on-screen indicator when transcription is running; that helps but does not replace notice.
3. Restrict who can start transcription. In Teams, transcription is controlled by meeting policy in the Teams admin centre under Recording and Transcription, or with the -AllowTranscription parameter of Set-CsTeamsMeetingPolicy. Turn it on for the roles that need it, not for everyone. Note that Copilot in Teams meetings depends on transcription, so a decision about one is a decision about the other.
4. Know where the files land and who can reach them. Teams recordings and transcripts are stored in the organiser's OneDrive for private meetings and in SharePoint for channel meetings, with normal file permissions. Google Meet saves transcripts to the organiser's Google Drive. Check the default sharing on those locations and stop transcripts being posted into wide channels.
5. Set retention and deletion. Use Microsoft Purview retention policies, or the equivalent in Google Workspace, so transcripts are deleted after a fixed period unless someone has a documented reason to keep one. Ninety days is a common starting point for routine internal meetings. Recordings that must be kept, such as disciplinary hearings, are moved to a controlled location, not left in personal storage.
6. Control what AI assistants can read. If Copilot or another assistant can search transcripts, then every transcript is in scope for every question. Use sensitivity labels and search exclusions for sensitive meeting types, and review the Copilot semantic index oversharing note before enabling assistant access to meeting content.
7. Block uninvited transcription bots. Third-party note-taking bots join meetings as participants and send audio to their own vendor. Decide whether they are allowed; if not, configure the lobby so unknown participants wait, and tell staff to remove them.
8. Do a DPIA where the meeting content is sensitive. HR, health, safeguarding, legal and customer-complaint meetings are the obvious cases. The ICO expects an impact assessment where processing is likely to result in high risk, and systematic recording of staff qualifies.

What to write into policy

• Transcription is used for named purposes only; meetings involving health, disciplinary, grievance, legal or safeguarding matters are not transcribed unless a named manager approves it.
• Participants are told at the start of every transcribed meeting, and external participants can ask for transcription to be turned off.
• Transcripts are stored in the organiser's controlled location, are not shared into open channels, and are deleted automatically after the retention period.
• AI assistants may only read transcripts that carry an approved label.
• Third-party transcription bots are not permitted without IT approval.

The AI and HR data boundaries note covers the closely related question of what an assistant may read about staff.

How to test

Pick one transcribed meeting from last month. Find the transcript. List everyone who can open it and check the list against who attended. Search it for a phone number, a name that was not in the meeting, and a health or personal remark. Ask your AI assistant a question about the meeting from an account that did not attend and see what comes back. Then check the retention setting on the file. If any step surprises you, that is the control to fix first.

Source basis

• ICO: employment practices and data protection, monitoring workers
• ICO: a guide to lawful basis
• Microsoft Learn: manage Teams recording policies for meetings and events
• Microsoft Learn: manage Microsoft Copilot in Teams meetings and events