In short
Under Article 15 of the GDPR, a person can ask for a copy of their personal data, which includes recordings and transcripts of them in meetings. You generally must answer free of charge within one month, redacting other people's information where needed rather than refusing outright.
A subject access request can cover meeting recordings. Under Article 15 of the GDPR, anyone whose personal data you hold can ask for confirmation, information about the processing, and a copy of the data. A person's voice and what they said in a recorded meeting are their personal data, and so are transcripts and notes about them. You generally have one month to answer, free of charge, and where other people's information is mixed in, the expectation is to redact rather than refuse.
This guide covers what a person can ask for, how to deal with the other speakers, the deadlines in the EU and the UK after the Data (Use and Access) Act 2025, and how to find the right meetings. For the other direction, a request to delete, see the right to erasure and meeting recordings.
What a subject access request for a meeting recording covers
Article 15 gives the person three things:
- Confirmation that you process their data.
- Information: the purposes, the categories of data, the recipients, how long it is kept, their other rights, and where the data came from.
- A copy: "The controller shall provide a copy of the personal data undergoing processing" (Article 15(3)).
The EDPB's Guidelines 01/2022 on the right of access (version 2, adopted March 2023) address recordings directly:
- Recordings of telephone conversations, and their transcription, between the requester and the controller "may fall under the right of access".
- For audio, "the voice of the data subject itself is personal data". In some cases access can be given "by providing a transcription … if agreed upon between the data subject and the controller".
- The copy should be in a permanent form, which can be "a transcript or a compiled form as long as all the information is included and this does not alter or change the content".
| Part of a recorded meeting | Likely within a request? |
|---|---|
| Audio of the person speaking | Yes: their voice is personal data |
| Transcript lines they spoke | Yes |
| Notes and summaries about them | Yes, where they relate to the person |
| Other people's speech about them | Often yes, subject to others' rights |
| A voiceprint of them | Yes, if you hold one |
| Other speakers' unrelated remarks | Generally no, and may need to be redacted |
Other speakers in the recording
Article 15(4) says the right to a copy "shall not adversely affect the rights and freedoms of others". Recital 63 adds that the result "should not be a refusal to provide all information". The EDPB's guidelines say other people's information should be made illegible "as far as possible instead of refusing to provide a copy".
For a meeting, that usually means one of:
- A redacted transcript: the requester's lines and lines about them, with other people's unrelated remarks removed. This is often the most practical form, and the EDPB's guidelines allow a transcript where the person agrees.
- An edited audio extract: the parts where the requester speaks or is discussed.
- The full recording, where the other speakers' information is minimal or professional. The EDPB gives an example of a customer-service call where the agent is not easily identifiable and the content is professional, and says the full record may be provided.
Weigh it case by case and write down why you redacted what you did.
Deadlines and fees
In the EU
Under Article 12(3), you must answer "without undue delay and in any event within one month of receipt of the request", extendable "by two further months where necessary, taking into account the complexity and number of the requests", if you tell the person within the first month and say why. Article 12(5) makes it free of charge, except for manifestly unfounded or excessive requests, where you bear the burden of showing that. Ireland's Data Protection Commission, for example, says requests generally cannot carry a fee.
In the UK
The ICO's right of access guidance (updated December 2025) sets the same one month, with a two-month extension for complex requests or several requests from the same person. The Data (Use and Access) Act 2025 changed two things:
- Stop the clock, in law. Section 76 inserted Article 12A into the UK GDPR, in force from 5 February 2026. Where the controller reasonably needs more information to identify what is being asked for, the time until it arrives does not count.
- Reasonable and proportionate searches. Section 78 added that a person is entitled to what the controller can provide "based on a reasonable and proportionate search", treated as in force from 1 January 2024.
The ICO also says it is "not sufficient" only to let someone listen to audio unless they are happy with that, and that a transcript is one way to supply it.
Handling a request, step by step
- Log it with the date received.
- Clarify if needed: which meetings, which period. In the UK, the clock stops while you wait for a reasonable clarification.
- Find the meetings the person was in or was discussed in. Search by name in transcripts and notes, and by date.
- Collect every form: recordings, transcripts, notes, exports, voiceprints.
- Redact others' information where needed, and record why.
- Send the copy in a commonly used electronic form if the request was electronic, with the Article 15 information.
- Keep a record of what you sent.
If you are an employee asking your employer, can your employer record your meetings? covers the rest of your rights.
How Notey fits into this
Notey keeps meetings on the Mac that recorded them, as two tracks — your microphone and the call — with a transcript.
- Finding the meetings: ⌘K searches every meeting by time or by what was said, including names.
- Exporting: the transcript on its own exports as plain text, and notes as Markdown, with the AI and edited-by-you labels. A plain-text transcript is a practical base for a redacted copy.
- Voiceprints: if voice recognition is on, the People screen lists everyone stored, so you can say whether you hold one.
- Retention: keeping less makes requests smaller. How long to keep meeting recordings has a starting schedule.
- AI notes send transcript text to Notey's service and on to OpenAI as a processor, which does not use it to train models; Notey does not keep the text after the response. Mention that in the recipients information. See the privacy policy and recording meetings under GDPR.
Frequently asked questions
Can I get a copy of a meeting recording I was in?
Under the GDPR and UK GDPR, generally yes: your voice and what you said are your personal data. The organisation may redact or withhold parts that would adversely affect other people's rights, but should not simply refuse.
Can a transcript be given instead of the audio?
The EDPB's guidelines say access to audio can in some cases be given by providing a transcript, if the person and the controller agree. The ICO says letting someone only listen is not enough unless they are happy with that, and a transcript is one option.
How long does an organisation have to answer a subject access request?
One month from receipt, extendable by two further months for complex or numerous requests. In the UK, the Data (Use and Access) Act 2025 put the "stop the clock" for clarification into law from 5 February 2026.
Can the organisation charge for a subject access request?
Normally no. A reasonable fee is allowed only for requests that are manifestly unfounded or excessive, or for further copies, and the organisation must be able to show why.
Do I have to search every recording for a person's voice?
In the UK, the law now says a person is entitled to what can be provided on a reasonable and proportionate search. The EDPB also expects searches to be reasonable. Knowing which meetings a person was in makes this much easier.