Start with the purpose and legal basis
A recording or transcript can contain personal data about identifiable participants. Your organization needs to decide why the processing is necessary and identify a suitable legal basis before it starts. Consent is one possible basis, rather than a universal requirement for every recording. Special categories of personal data require an additional applicable condition. See the EDPB's legal-basis guidance.
Six questions for your assessment
- What purpose and legal basis apply to the recording, transcription and subsequent AI use?
- What information will participants receive about purposes, recipients, retention and their rights?
- Which services process or store the data, and who can access it?
- What security controls apply to each data type and service?
- How are access, correction, objection and erasure requests handled?
- What processor agreement, instructions and supplier evidence cover the workflow?
Participant information and retention need to reflect actual use. The European Commission's business guide explains the information organizations should provide.
EU storage is one part of the assessment
Check actual processing, storage and provider access separately. GDPR provides mechanisms for transfers outside the EU/EEA; an EU storage location alone does not settle the transfer assessment. Review the applicable mechanism and circumstances. IMY explains third-country transfers.
Security also requires a risk assessment. Article 32 addresses suitable measures, including encryption where appropriate, resilience, recovery and regular evaluation. It does not prescribe TLS 1.3 and AES-256 as universal minimum versions. See GDPR Article 32.
Rights and deletion need a working process
Erasure depends on the applicable grounds and exceptions. A request does not always mean immediate deletion of every record; legal retention duties and legal claims can affect the response. Distinguish live data, provider recordings and backups, and document the actual outcome. The European Commission's guidance on individual requests describes these qualifications.
Assessing ReVoice
Review ReVoice's security controls, sub-processor information, privacy policy and DPA against your intended workflow. Processing regions depend on the service and configuration; request dated evidence of current endpoints, provider access and accepted terms.
Meeting capture runs in Recall.ai's EU region in Frankfurt. Transcription through Recall uses Deepgram's EU endpoint. Some optional features and administrative services process data outside the EU/EEA.
We do not use your meetings, audio, transcripts or documents to train, fine-tune or improve AI models, whether our own or anyone else's. Provider-specific retention and model-improvement terms need separate assessment. Product controls support your organization's work; their presence does not establish complete GDPR compliance for every use.