Recording Meetings With AI: Consent and Privacy Law (LGPD)

Recording Meetings With AI: Consent and Privacy Law (LGPD)

Recording meetings with AI raises consent and privacy law questions that you should answer before the first recording. Under Brazil's LGPD, notify every participant before you start, state the purpose, choose a legal basis you can justify in writing, and decide where the transcript is stored and for how long. Consent is not always the right basis, but a clear notice is essential, because transparency is one of the law's core principles. This guide shows how to do it in a simple, auditable way.

Key takeaways

• Voice, image, name and the content of the conversation are personal data, so recording and transcribing is data processing.
• The notice must come before the recording, at more than one moment (invitation, start of the meeting and meeting record), with the purpose and retention period.
• Consent is one possible legal basis, not the only one. The right choice depends on who attends and what the recording is for.
• Audio, transcript and summary are three different artifacts, and each can have its own storage location, access rules and retention period.
• Before turning on any tool, find out where the data goes, whether the vendor uses the content to train models, and how to delete it.

What follows combines the text of the LGPD, the public guidance of Brazil's data protection authority (ANPD) and deployment practice. It is not legal advice. For cases involving sensitive data, employees or regulated sectors, involve your legal team or the company's data protection officer.

What changes when an AI handles the recording?

Recording a meeting has always had consequences. AI adds layers: the audio is converted to text, the text is summarized, the summary generates tasks, and all of it usually passes through third-party servers. Each layer is a processing operation with its own risk.

There are three points most companies underestimate:

• A transcript is easier to search, copy and forward than an audio file. That widens the reach of any leak or misuse.
• Spoken content is not always predictable. A routine status meeting can touch on someone's health, customer data, salaries or family matters. Sensitive personal data falls under stricter rules in Article 11 of the LGPD.
• The generated summary can be wrong, attribute a statement to the wrong person or invent a commitment. Treating an unreviewed summary as the official record creates a new problem. If the summary feeds decisions about people, also read about LGPD automated decision-making and the right to review.

So the useful question is not only whether you can record, but what exactly will be recorded, processed and stored, and who will be able to see it.

How do you notify participants before recording?

The notice fulfills the transparency principle and gives people a chance to speak up. To be useful, it must come before the recording, and it must be clear and specific. A generic notice buried in a footer helps no one.

Give the notice at three moments:

• In the meeting invitation: say that the meeting will be recorded and transcribed by AI, for what purpose, and who to contact with questions.
• At the start of the meeting: repeat it out loud and, if the platform allows, keep the recording indicator visible. Leave room for someone to say they do not agree.
• Afterward, in the record: note in the minutes or in your system that the notice was given, when and how. That record is your evidence.

A short script you can read at the start:

We will record and transcribe this meeting with an AI tool to capture decisions and tasks; the material stays restricted to the project team and will be deleted under our policy, and anyone who prefers can say so now and we will continue with notes only.

The most delicate point is refusal. If someone does not agree, you need a real plan B: turn off the recording, take manual notes or talk in another format. If the person has no genuine choice, the notice becomes a formality and, where consent is the basis, it loses its validity.

For external participants (customers, candidates, suppliers), a written notice before the meeting matters even more, because they do not know your internal policies. For your team, include the rule in internal regulations and in your AI tool usage policy. A template for that is in company policy for employee ChatGPT use.

Which legal basis should you choose for recording a meeting?

The LGPD lists legal bases in Article 7 (and, for sensitive data, in Article 11). No single basis fits every recording. The choice depends on context. A practical decision guide:

• Consent: makes sense when the recording is optional and the person can decline without penalty, such as an open webinar or a research interview. It must be free, informed and unambiguous. In relationships of subordination, such as employer and employee, consent is fragile because the freedom to refuse is questionable.
• Contract performance or preliminary procedures: can apply when the record is necessary to deliver the contracted service, for example a requirements workshop whose minutes are part of the scope. The recording must be truly necessary for the contract, not merely convenient.
• Legitimate interest: can work for recording internal decisions and quality control, provided there is a legitimate purpose, only the necessary data is used, the impact on people is assessed and documented, and they would reasonably expect it. It requires a written balancing test.
• Regular exercise of rights: applies when the record serves to defend a position in judicial, administrative or arbitration proceedings. Do not use it as a generic justification.
• Legal or regulatory obligation: only when a specific rule requires the record, which is common in some regulated sectors.

To choose, answer four questions in writing. What is the exact purpose? Do participants have a real option to refuse? Is the recording necessary or only useful? Could the content include sensitive data? If the answer to the last one is yes, the basis and safeguards must be stricter, and legal should review.

A common mistake is asking for consent out of habit and then using the recording for another purpose, such as evaluating people's performance. The LGPD requires compatibility with the stated purpose. If the idea is to measure productivity, first read how to measure AI productivity without surveillance.

Where should the transcript be stored?

The decision about where to store the material is as important as the notice. Before adopting an AI recording tool, ask the vendor (and yourself) these questions:

• Do the audio and transcript stay in your account or in the vendor's account? Who is the controller and who is the processor in this relationship?
• In which countries is the data processed and stored? If it is sent abroad, see what the LGPD requires in international data transfer when using AI providers.
• Does the vendor use the content to train or improve models? Is there a contractual or configuration option to turn that off?
• Who inside the company can open, download and share it? Is there access control per meeting or per folder?
• Is there an access log (who saw what and when)?
• Can you truly delete it, including copies and backups, and receive confirmation?
• If the tool integrates with other systems (CRM, email, WhatsApp), what data travels and where does it go?

For very sensitive meetings, one alternative is to transcribe with a model running on your own infrastructure. That reduces the number of third parties, but it brings operating costs and security responsibility. The guide on running Ollama local models in a company explains the precautions. For voice messages, the logic is similar to the one described in transcribing WhatsApp voice messages with AI.

Whatever you choose, separate what you keep: raw audio or video, full transcript, and summary with tasks. In general, the summary is what the team actually uses. Keeping only the reviewed summary and discarding the raw material early greatly reduces exposure.

Also treat the tool as a risk surface. Summaries and transcripts can contain malicious instructions spoken aloud or typed into the chat, and agents that act on them need limits. The OWASP Top 10 for LLM applications is a good reference for this kind of review.

How long should you keep audio, transcript and summary?

The LGPD does not set a single retention period for meeting recordings. What it asks for is adherence to principles such as purpose and necessity: keep the material as long as it is needed for the stated purpose and delete it afterward, except for legal exceptions such as compliance with an obligation or defense in a proceeding. That means the retention period is your decision, and it should be written down.

A practical way to set retention periods:

• List your meeting types: internal status meetings, customer meetings, hiring interviews, board meetings, support calls.
• For each type, define the purpose and the shortest period that fulfills it. Raw audio normally needs a shorter period than reviewed minutes.
• Define the deletion trigger: a fixed date, the end of the project or the end of the contract.
• Define the exception: when litigation or a legal obligation requires retention, who decides and how it is recorded.
• Automate deletion whenever the tool allows it. Manual deletion tends to be forgotten.

Keep data subject rights in mind (Article 18): a person can request access to their data, correction or deletion, within the limits of the law. If the transcript is scattered across emails, folders and chats, answering the request becomes a problem. Keeping the material in a single place with clear permissions makes a response feasible. The ANPD website gathers official guidance on data subject rights and good practices.

Illustrative scenario: a diagnostic meeting with a customer

Imagine a services company that holds diagnostic video meetings with new customers and wants AI to generate the minutes and the list of open items. This is an illustrative scenario, unrelated to real cases.

The company decides that the purpose is to record requirements and commitments for the contracted project. Because the record is part of the service, the likely basis is contract performance, validated by legal. In the invitation, it states that the meeting will be recorded and transcribed by AI, who will have access, and when the material will be deleted. At the start, the host repeats the notice and asks whether anyone objects. If the customer declines, the meeting proceeds with manual notes.

The audio stays in the tool's corporate account, with access limited to the project team, and the setting that allows model training on customer data is turned off. A person reviews the transcript and produces the final minutes. The raw audio is deleted right after the review. The minutes stay in the project repository until the contract ends, when they are deleted unless a retention requirement applies. Every step was decided and recorded before the first recording.

A step-by-step plan to roll this out without improvising

If your company does not have a rule yet, follow this sequence:

• Map: list which meetings are recorded today, with which tool, by whom, and where the material is stored. Many companies discover recordings scattered across personal accounts.
• Limit: define which meetings may be recorded, which may not (for example, conversations about health, dismissals or disciplinary matters), and which data the AI must not process.
• Choose the legal basis for each meeting type and record the justification.
• Write the standard notice for invitations and meeting openings, and train the people who run meetings to use it.
• Configure the tool: access, region, model training turned off, retention and deletion.
• Pilot on one real workflow, with logs of who accessed the material and an agreed metric, such as time spent on minutes or the number of corrections the summary needs.
• Hand the routine to an internal owner, with periodic review, and decide whether to expand, adjust or stop.

This sequence follows the working method we apply in AI projects: map the current process, limit data and actions, pilot a real workflow with a record, and hand over operations with clear decision criteria. To measure the pilot, the article on how to measure an AI automation pilot details metrics and decision gates. For broader risk management, the NIST AI Risk Management Framework offers a recognized structure.

Frequently asked questions

Do I need everyone's consent to record a meeting with AI? Not always, because the LGPD accepts legal bases other than consent, such as contract performance and legitimate interest. Even when the basis is not consent, advance notice is still required for transparency, and it is advisable to offer an alternative to anyone who does not want to be recorded. Validate the choice with legal or your data protection officer.

Can I record a meeting with employees to evaluate their performance? This is a high-risk use, because it changes the purpose and involves a relationship of subordination, where consent is fragile. If that is the intention, it must be declared explicitly, rest on an adequate legal basis, be proportionate and go through legal review. Without that, the safest course is to keep recordings limited to capturing decisions and tasks.

Does an AI transcript count as the official minutes? It is an input, not a final record. The AI can misspell names, swap who said what and invent commitments. Have a person review it before circulating the summary or creating tasks from it, and keep the reviewed version as the reference document.

What should I do if someone asks me to delete the recording? Assess the request under the Article 18 rights of the LGPD and the legal grounds for retention. Locate the audio, transcript, summary and copies, decide whether there is a legitimate reason to keep any of them, and answer the data subject in a documented way. Having a single storage location and a defined owner makes this process much simpler.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications