Recording meetings in the United Kingdom.
Brexit changed less here than people expect. The UK kept the Regulation's substance, so the obligations around a meeting recording are close to an EU state's, with a different regulator and a different label.
The UK is no longer an EU member state, but it retained the Regulation's substance as the UK GDPR, sitting alongside the Data Protection Act 2018 and supervised by the Information Commissioner's Office. Separately, Section 3 of the Investigatory Powers Act 2016 addresses intercepting a communication in the course of its transmission without lawful authority.
For an ordinary meeting, the interception offence is not usually the operative provision: it targets interception in transmission rather than a participant recording a conversation they are part of. The data protection layer is where the work happens, and the ICO's employment practices material on monitoring at work is the practical reference for any organisation recording staff routinely. One structural point worth knowing: the UK holds an EU adequacy decision, so data flows from the EEA to the UK without additional safeguards, but that decision is periodically reviewed rather than permanent.
- The data protection instrument
- UK GDPR and the Data Protection Act 2018 (UK GDPR and the Data Protection Act 2018), DPA 2018 c. 12
- Who supervises this
- Information Commissioner's Office (Information Commissioner's Office)
Criminal provisions
These sit alongside data protection law rather than replacing it. They generally address conduct that is covert or that involves conversations the recorder was not part of, which is a narrower category than everyday meeting recording, and a considerably more serious one.
Investigatory Powers Act 2016, Section 3
Investigatory Powers Act 2016
Unlawful interception. The provision addresses intercepting a communication in the course of its transmission without lawful authority. It is aimed at interception rather than at a participant recording a meeting they are taking part in, which is the more common case here.
What is specific to this country
- The UK left the EU but kept the Regulation's substance as the UK GDPR, sitting alongside the Data Protection Act 2018. The obligations for a meeting recording are materially the same as an EU state's: a lawful basis, and telling people at the time.
- The UK holds an EU adequacy decision, so personal data can flow from the EEA to the UK without additional safeguards. That decision is periodically reviewed rather than permanent.
- The ICO publishes an employment practices code covering monitoring at work, which is the practical starting point for any organisation recording staff routinely.
What to do in practice
The practice below is not the legal minimum in every jurisdiction. It is the practice that is defensible in all of them, which is a more useful target when your calls cross borders.
- Say it out loud at the start, before anything substantive is discussed, and say what the recording is for. Not a line in the invite nobody read.
- Give people a real way to decline. An announcement that leaves no room to object is closer to a notification than to consent.
- Write it down. A line in the notes recording that the meeting was recorded, and that nobody objected, is worth more later than anyone's memory of the moment.
- Keep external meetings to a higher standard than internal ones. Colleagues share an employment context; a customer, a candidate, or a supplier does not.
- Decide how long you keep recordings, and actually delete them. Indefinite retention converts a small, well-handled recording into a growing liability.
- Treat sharing as a fresh decision. The question is not whether you were allowed to record, it is whether this particular person was meant to hear it.
Questions
Is UK law still the same as the GDPR?
Substantially. The UK GDPR retains the Regulation's structure, so lawful basis and transparency obligations look much the same. Divergence is possible over time and has been the subject of reform proposals, so check the current position rather than assuming continued alignment.
Can data still flow between the EU and the UK?
The UK holds an EU adequacy decision, so EEA-to-UK transfers do not need additional safeguards. Adequacy decisions are reviewed periodically and can be revisited, so it is not a permanent fixture.
What does the ICO expect for recording employees?
Its employment practices material covers monitoring at work: proportionality, telling staff, and considering less intrusive alternatives. Recording meetings routinely falls squarely within it.
Sources
Primary sources, so you can check this rather than take our word for it.
Recording that announces itself.
Canto's notetaker joins as a named participant the organiser admits, and the recording, the transcript and who can see it stay under your control. 300 minutes a month, free forever.