In short
Under Article 17 of the GDPR, someone recorded in a meeting can ask you to delete their data where, say, it is no longer needed, they object and you have no overriding grounds, or it was processed unlawfully. Exceptions include legal claims. Answer within one month and delete every copy.
The right to erasure applies to meeting recordings like any other personal data. Under Article 17 of the GDPR, a person who was recorded can ask you to delete their data, and you must do so without undue delay — and within one month — where one of the listed grounds applies and no exception does. The usual grounds for a meeting recording are that you no longer need it, or that the person objected and you have no overriding reason to keep it.
The hard part is rarely the law; it is finding every copy. A recorded meeting can exist as audio, a transcript, notes, exports, synced copies and backups. This guide covers when the right applies, the exceptions, the deadline, and a way to find and delete everything.
When the right to erasure applies to a meeting recording
Article 17(1) of the GDPR lists six grounds. Four are the ones that come up for meetings:
| Ground | How it arises with a meeting recording |
|---|---|
| (a) The data is no longer necessary for the purpose | The notes are checked and the audio has done its job |
| (b) Consent is withdrawn and there is no other legal basis | You recorded on consent, and the person withdraws it |
| (c) The person objects under Article 21 | You rely on legitimate interests and cannot show overriding grounds |
| (d) The data was processed unlawfully | No lawful basis, or people were not told |
The other two — a legal obligation to erase, and data collected from a child for online services — are less common for meeting recordings.
The GDPR does not apply to "purely personal or household activity" (Article 2(2)(c)). A recording of a family call kept for yourself is outside it; a recording of a work meeting generally is not.
The exceptions
Article 17(3) says the right does not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- to comply with a legal obligation, or for a task in the public interest or official authority;
- for public health reasons;
- for archiving, research or statistics, in some cases;
- for the establishment, exercise or defence of legal claims.
The last is the one most likely to matter. If a meeting is part of a dispute, a complaint or an investigation, you may need to keep the recording, and a legal hold may require it. National law can add restrictions too; Ireland's Data Protection Act 2018, section 60, for example, allows rights to be restricted in contemplation of legal claims.
An exception covers only what is necessary. If you need the recording for a claim, you may still be able to delete copies you do not need, or the notes unrelated to it.
Deadlines and the process
Under Article 12(3), you must act "without undue delay and in any event within one month of receipt of the request". That can be extended by two further months where necessary because of complexity or the number of requests, if you tell the person within the first month and give reasons. The ICO's guidance on the right to erasure adds that a request can be made "verbally or in writing", so a sentence at the end of a call counts.
A workable process:
- Log the request with the date received. The clock starts then.
- Confirm who is asking, if you are not sure, without asking for more than you need.
- Decide whether a ground applies and whether an exception does. Write down the reasoning.
- Find every copy (next section).
- Delete, or explain. Reply saying what you deleted and when, or why you are keeping something and that they can complain to the data protection authority.
- Tell the recipients. Article 19 asks you to tell anyone you disclosed the data to about the erasure, unless that is impossible or involves disproportionate effort.
Find every copy
| Where it may be | What to check |
|---|---|
| The notetaker or recorder | The recording, the transcript, AI notes, questions asked about it |
| Your other devices | Synced copies of the same meeting |
| Cloud copies | Any uploaded or backed-up recordings |
| Exports | Transcripts or notes saved as files, pasted into documents or wikis |
| Email and chat | Follow-up emails, minutes, summaries shared with others |
| Processors | Transcription or AI services, and what they retain |
| Backups | Disk and cloud backups |
| Voiceprints | Any stored representation of the person's voice |
Backups
Editing a single meeting out of a backup is usually impossible. The ICO's guidance says you must not use the data in the backup for any other purpose and should put it "beyond use"; it may remain in the backup until that is replaced on its normal schedule. Tell the person that is what will happen and when.
Other speakers
A meeting has several people in it. The right covers the requester's data, not everyone's. In practice, their voice and words are woven through the recording, and deleting the whole recording is often the only clean answer; notes can sometimes be kept with their contributions removed. Think about the other participants' interests before you delete a record they may rely on.
How Notey fits into this
Notey keeps meetings on the Mac that recorded them, which makes the list of copies short. What it does:
- Deleting a meeting removes its recording, transcript, notes, the questions asked about it and its contribution to any learned voice. With sync on, it goes from your account and every one of your Macs, recording included. Deleting meeting recordings has the steps.
- Forget this voice deletes a person's voiceprints from every meeting, and with sync, from every Mac.
- It cannot yet delete the audio and keep the transcript. If you must keep notes but delete the recording, export the notes first, remove the requester's contributions, then delete the meeting.
- Exports and disk backups are outside Notey. Check them yourself.
- AI requests send transcript text to Notey's service and on to OpenAI as a processor; Notey does not keep the text after the response. See the privacy policy.
- ⌘K search finds meetings by what was said, which helps when you need every meeting a person appears in.
For how long to keep recordings in the first place, see how long to keep meeting recordings. If the person asks for a copy before deletion, subject access requests for meeting recordings covers that; the GDPR basics are in recording meetings under GDPR.
Frequently asked questions
Can someone make me delete a meeting recording they are in?
Under the GDPR, they can ask, and you must erase their data without undue delay if one of Article 17's grounds applies and no exception does. Common grounds are that the recording is no longer needed or that they objected and you have no overriding legitimate grounds.
How long do I have to respond to an erasure request?
Without undue delay and within one month of receiving it. The GDPR allows two further months for complex or numerous requests, if you tell the person within the first month and say why.
Do I have to delete the whole recording if one person asks?
Not necessarily. The right covers that person's personal data. In practice, their voice and words run through the whole recording, so deleting the recording and keeping notes without their contributions is often the workable answer. Other speakers' interests matter too.
Can I refuse an erasure request?
Yes, where an Article 17(3) exception applies — for example, where you need the recording to establish, exercise or defend legal claims, or to comply with a legal obligation. Tell the person why and that they can complain to the regulator.
Do I have to delete backups?
The data must not be used or restored into live use. The ICO's guidance allows the data to stay in a backup until it is replaced on schedule, provided it is put beyond use in the meantime. Say so in your answer.