AI notetakers and the GDPR: what to look for
An AI notetaker processes everything that is said in a conversation. Under the GDPR you, or your organisation, are responsible for that: you decide why you record and whom you inform. So choose a notetaker that keeps conversation content in the EU, offers a data processing agreement and does not use your conversations to train AI.
What the GDPR requires when you record conversations
- A legal basis. You may only process personal data on one of the six legal bases in the GDPR, for example consent or legitimate interest. You decide on the legal basis before you start. For health data or other special categories of personal data, you also need an exception to the processing ban (Article 9 GDPR).
- Inform the participants. Say at the start of the conversation that you are recording, why, and where people can read more (Articles 13 and 14 GDPR). Only record conversations you take part in yourself.
- Data minimisation. Only record what you really need for your purpose (Article 5 GDPR).
- Retention period. Do not keep recordings and notes longer than necessary. Set a period and stick to it.
- Data subject rights. The people you record have rights such as access and erasure (Articles 15 to 22 GDPR). Make sure you can meet them.
- A data processing agreement. If a supplier processes the recordings for you, a data processing agreement is mandatory (Article 28 GDPR).
- A DPIA for high risk. If the processing is likely to result in a high privacy risk, such as large-scale processing of health data, you must carry out a DPIA first (Article 35 GDPR).
Checklist: how to assess an AI notetaker
Ask every supplier these questions. For each question you also see the answer for My Notetaker.
| Question | Why | My Notetaker |
|---|---|---|
| Where is conversation content processed and stored? | Outside the EU, different rules apply to access to data. | In the EU. Speech recognition, analysis and storage via Artific in Google Cloud, region europe-west4 (the Netherlands). The application server and database are in Frankfurt. |
| Which sub-processors are there? | You need to know who else can access your data. | A public list with service, location and safeguards. We announce a new sub-processor at least 30 days in advance. |
| Is there a data processing agreement? | Mandatory for business use (Article 28 GDPR). | Yes, for business customers. We report a personal data breach within 36 hours at the latest. For a DPIA we provide information free of charge on request. |
| How is everything encrypted? | Security is mandatory (Article 32 GDPR). | In transit via HTTPS with TLS 1.2 or 1.3. At rest with AES-256. Audio that is stored temporarily in our database is additionally encrypted by us (AES-256-GCM). |
| Is my data used to train AI? | Then your conversation leaves the purpose you recorded it for. | No. We do not use your conversations to train or improve AI models. |
| Can I export and delete everything? | Needed to meet data subject rights and retention periods. | Yes. You download all your data as a JSON file and delete single conversations or your whole account, including at Artific. Conversations are kept until you delete them, or you set a retention period yourself. |
| Who can see the conversations? | The fewer people with access, the smaller the risk. | Only the user, also within a team. An admin only sees name, email address, role and minutes recorded. |
The sources for these answers: the privacy statement, the list of sub-processors and the data processing agreement.
What remains your responsibility
For business use, your organisation is the controller and My AI is the processor. A notetaker can take care of a lot, but some things stay with you:
- the legal basis for recording and, for special categories of personal data, the exception you rely on;
- informing the people you speak with;
- the retention period that fits your purpose;
- assessing whether you need a DPIA;
- handling requests from people you have recorded.
Working in healthcare? Then also read AI notetaker for healthcare.
Frequently asked questions
Is an AI notetaker GDPR-proof?
A tool on its own does not make your use compliant with the GDPR. Whether you may record and process a conversation depends on your legal basis, how you inform the participants and how long you keep it. A notetaker can make it easier, for example with processing in the EU, a data processing agreement and export and deletion.
Do I need to ask for consent to record a conversation?
Not always: consent is one of the six legal bases in the GDPR. You must always tell the participants that you are recording and why. Only record conversations you take part in yourself, because recording a conversation you do not take part in is a criminal offence.
Who is responsible: me or the supplier?
For business use, your organisation is the controller and My AI is the processor. That is set out in the data processing agreement. If you use My Notetaker privately, you process the data of the people you speak with on your own behalf.
Do I need a DPIA?
You decide that yourself. A DPIA is mandatory if the processing is likely to result in a high privacy risk, for example large-scale processing of health data. On request we provide information about the processing, our processors and security free of charge.
What happens to my conversations if I stop?
You can always download all your data yourself as a JSON file. For business use this is possible until at least 30 days after the end of the agreement. If you delete your account, everything is deleted, including at Artific.
Try My Notetaker free for 14 days. No payment details needed.
Sources
- Dutch DPA (Autoriteit Persoonsgegevens): legal bases under the GDPR explained (in Dutch)
- Dutch DPA (Autoriteit Persoonsgegevens): data processing agreement (in Dutch)
- Dutch DPA (Autoriteit Persoonsgegevens): privacy rights under the GDPR (in Dutch)
- Dutch DPA (Autoriteit Persoonsgegevens): data protection impact assessment (in Dutch)
- General Data Protection Regulation (EUR-Lex)
This page is general information, not legal advice. Discuss your own situation with your data protection officer or lawyer.