AI note-takers in team meetings

Some teams now use a tool that joins the call, writes a transcript and sends round a summary afterwards. A transcript that names people and records what they said is likely to hold their personal data.

The Information Commission (which took over from the ICO on 30 September 2026) publishes general guidance on personal data, and the National Cyber Security Centre (NCSC) on public AI tools. Applying that guidance to a meeting note-taker is this page's reading.

Telling people first

The Information Commission says people "have the right to be informed about the collection and use of their personal data". For a meeting, that means telling the people in it, among other things, why the tool is used, how long the transcript is kept and who receives it. The Information Commission's checklist of privacy information is longer, and also covers the organisation's name and contact details and the lawful basis for using the data. Its name for all this is privacy information, which has to be given when the data is collected. Some exceptions apply, for example where someone already knows.

It also says the information must be concise and easy to get at, in clear, simple language. A new use of someone's data has to be brought to their attention before it starts.

Checking the summary

In the Information Commission's guidance on accuracy, the advice is to take "all reasonable steps to ensure the personal data you hold is not incorrect or misleading". If personal data turns out to be incorrect or misleading, the organisation must take reasonable steps to correct or erase it as soon as possible.

How long to keep it

The Information Commission says, "You must not keep personal data for longer than you need it." An organisation has to be able to justify how long it keeps data, and should have a policy setting standard retention periods wherever possible. It should also review what it holds from time to time, and erase or anonymise what it no longer needs. The guidance says personal data can be kept longer only when it is kept just for archiving in the public interest, for scientific or historical research, or for statistics.

Keeping sensitive items out

For public AI tools, the NCSC advises "not to include sensitive information in queries to public LLMs" (large language models). It wrote that in March 2023, about chatbots such as ChatGPT.

When the data leaves the UK

For a tool that keeps recordings or transcripts outside the UK, the Information Commission has separate guidance on sending personal information to other countries, including when the rules on a "restricted transfer" apply.

When someone asks for a copy

People have the right to see and get a copy of their personal information, the Information Commission's guide to subject access says. They can ask out loud or in writing, including on social media. The organisation must respond without undue delay, and within one month. That can be extended by up to two further months where the request is complex, or where the person has made a number of requests.

Useful links