AI note takers in HR meetings: UK GDPR and confidentiality

What these tools do

An AI note taker records a meeting, turns the speech into text and often writes a summary and action list. Some are built into video platforms. Others join the call as a separate participant or run on one attendee’s device. Automated transcription tools do only the first step.

These tools have real uses, such as searchable records of routine meetings and support for people who find fast speech hard to follow. The difficulties grow when the meeting is sensitive and the record may be relied on later.

How data protection law applies

Audio, transcripts and summaries about identifiable people are personal data, and the employer is normally the controller. The Data (Use and Access) Act 2025 amended parts of UK GDPR, and the ICO is reviewing several related guidance pages.

Lawful basis. ICO guidance on monitoring workers says "consent is not usually appropriate in the employment context" because of the imbalance of power. Legitimate interests may be available as a basis, but it needs a documented three-part test. The ICO has said an AI tool used for existing purposes needs no new lawful basis, although privacy information should be updated.

Transparency. Before the meeting, tell participants which tool will be used, why, who will see the output and how long it will be kept.

Special category and criminal offence data. HR meetings often reveal health, religion, sexual orientation or trade union membership. Processing that data needs an Article 9 condition as well as a lawful basis. Allegations of criminal conduct count as criminal offence data, even when unproven. A draft assessment the ICO disclosed, covering Teams recording of its own employee relations meetings, expected both kinds of data.

Processors and contracts. A provider acting on your instructions is a processor. Article 28 requires a written contract covering instructions, confidentiality, security, sub-processors and the deletion or return of data. The ICO has said a supplier that uses client data to train its own model is a controller for that processing.

International transfers. Many tools process data outside the UK. A restricted transfer needs adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement, or an exception.

Retention. Keep audio, transcripts and summaries only as long as you need them. The ICO’s draft assessment set separate periods for recordings and transcripts. Anything you keep may also fall within a subject access request.

Impact assessments. A data protection impact assessment (DPIA) is required where processing is likely to result in high risk. The ICO lists innovative technology, including AI, as a risk factor and notes the power imbalance in employment. For sensitive HR meetings, a DPIA before first use is the safer course.

Accuracy risks in disciplinary and grievance meetings

Personal data must be accurate. The ICO’s AI guidance says outputs are often best treated as "statistically informed guesses rather than facts". In a disciplinary record, a small error can affect the outcome.

Misattribution. Speaker labels depend on the tool telling voices apart. A shared microphone, similar voices or interruptions can attach words to the wrong person.
Hallucination. A 2024 study found that roughly 1% of one widely used system’s transcriptions contained whole phrases or sentences that were never spoken. Long pauses made this more likely.
Accents and speech patterns. A 2020 study of five commercial systems tested speakers in the United States. Average word error rates were 0.35 for Black speakers and 0.19 for white speakers. Systems have changed since, so test any tool with your own speakers.
Crosstalk and emotion. Heated exchanges, distressed speech and people talking over each other are hard for any transcriber to capture.
Summaries. A summary selects and paraphrases. It can drop a qualification, soften a denial or state an allegation as fact.

Telling participants and agreeing to recording

The lawful basis for processing is rarely consent, but whether to record at all is a separate question of fair process. Acas guidance on investigation meetings says any decision to record "should be agreed by all parties".

In practice:

say in the invitation letter whether an AI tool will be used and what it will produce
ask the employee and any companion whether they object, and note the answer
check the participant list for note-taking bots, and ask attendees not to run their own tools
give participants the transcript or notes to review

Acas consulted in 2026 on a revised disciplinary and grievance Code. The consultation closed on 23 September 2026 and asked whether the Code or guidance should address AI.

Questions to ask a provider

Where are audio, transcripts and summaries stored and processed, and by which sub-processors?
Is customer content used to train or improve models, and can the contract exclude that?
Which provider staff can access content, and when?
What are the default retention periods, including backups, and can you set your own?
Will the provider sign Article 28 terms, and what covers any transfer outside the UK?
Can you export a full transcript with speaker labels, and keep the original audio for checking?

Ask a human provider similar questions, including about subcontracting and automated tools.

When a human note taker is the safer choice

AI tools can suit routine internal meetings where a few errors would not matter. A human note taker is often the safer choice when:

the record may be examined at an appeal, a tribunal or by a regulator
participants object to recording, or no recording will exist
health or other special category data is likely and no DPIA covers the tool
speakers have strong accents or speech differences, or are likely to talk over one another

A human note taker is not automatically accurate. The record still needs review, and an agreed recording allows checking afterwards.

To see how access, transfer and retention are agreed for a human transcriber, read the confidentiality page.

Sources

General information, not legal advice.

AI note takers in HR meetings: confidentiality and data protection