Pressing Record Is Easy. Explaining It to a Regulator Is Harder

A convenient feature becomes a data-processing operation

Few people stop to consider the consequences that arise when they begin recording a meeting in Google Meet, Zoom, or Microsoft Teams.

When Otter.ai, Fireflies.ai, tl;dv, or Fathom joins the conversation to produce a transcript, a summary, and a list of action items.

When Gong analyses the sales team’s conversations.

When Genesys Cloud, NiCE CXone, Five9, or Dialpad records and analyses contact-centre calls.

Today, all these actions look almost identical: a few familiar product names, a short notification, and a red dot in the corner of the screen.

For the user, it is a convenient feature.

For the organisation, it is the beginning of a new data-processing operation.

A voice is sent to the cloud.

Audio becomes text.

Text becomes model-generated conclusions.

Those conclusions become tasks, CRM records, employee assessments, management reports, and part of a corporate AI assistant’s memory.

A single conversation may simultaneously exist as a meeting recording, a transcript, a backup copy, a CRM record, a message in an internal chat, an entry in an analytics platform, and an item in a corporate knowledge base.

With every copy comes responsibility.

Questions that arise with every copy

Who defined the purpose of the recording?

What is the legal basis for processing the conversation?

What exactly were the participants told?

Who received access to the audio and transcript?

Can the conversation be used to assess an employee, profile a customer, or train a system?

How long will the copies be retained?

Who will still be able to find the conversation a year from now?

And does the organisation genuinely need the entire conversation—word for word and without a clearly defined deletion date?

The statement “we only used a familiar service” does not answer any of these questions.

Engaging an external provider adds another participant to the processing chain, but it does not eliminate the organisation’s own obligations. The precise allocation of roles depends on the configuration, purposes, and contractual relationships, but sending data to a vendor does not automatically transfer all responsibility to that vendor.

The risk is not theoretical

For the most serious GDPR infringements, the maximum administrative fine may reach €20 million or 4% of the total worldwide annual turnover for the preceding financial year, whichever is higher.

That is a statutory maximum, not an automatic penalty for pressing Record.

The risk, however, is not theoretical.

On 16 October 2025, the French data protection authority CNIL fined a call-centre company €250,000. The listed infringements involved data minimisation, retention periods, and data security.

Another recent example concerns not the moment recording begins, but what an organisation must be able to do with the data afterwards.

On 18 November 2025, the European Data Protection Board published information about a €100,000 fine imposed on a bank by the Italian data protection authority. The case concerned customers’ right to access their personal data contained in recordings of telephone orders.

The recordings already existed.

The organisation still had to know where the data was stored, how to retrieve it, and how to provide the individual with access to it.

The central question is therefore not only:

Was the organisation allowed to press Record?

An equally important question is:

What happens to the conversation afterwards?

Before launch: the data route

The answer is not panic, and it is not a complete rejection of recording technology.

The best protection is knowledge of the data route.

Before launching the process, an organisation should understand:

• exactly what is being recorded;
• why the recording is genuinely necessary;
• the legal basis for the processing;
• which external services receive the data;
• where additional copies are created;
• who can access the audio, transcript, and AI-generated conclusions;
• how long the data is retained;
• how an individual can obtain a copy, correct the data, or request its deletion;
• how AI-generated conclusions are reviewed;
• whether the full transcript can be replaced with a minimal set of verified decisions, facts, and action items.

Context / Record

This is the purpose of Context / Record—an interactive examination of what is actually set in motion when someone presses Record.

The project follows the conversation from voice capture through cloud processing, transcription, and AI analysis to the CRM, knowledge base, and long-term memory of a corporate assistant.

It does not promise magical legal safety.

It offers something more useful: the ability to see the process before a convenient feature becomes a complaint, a data breach, a regulatory order, or a fine.

Limitations and scope

The publication does not claim that every recording is automatically unlawful. The applicable obligations depend on the purpose, categories of data, the organisation’s role, the providers involved, national law, and the system’s actual configuration.

It is an informational publication, not individual legal advice; a particular recording arrangement must be assessed against its own facts and applicable law.

A recording may end after an hour. Responsibility for the data it created may remain for years.

Check the consequences before recording begins →