CNPD — Recording meetings: consent rarely valid, legitimate interest under conditions

Verifiable fact — On 8 July 2026, the CNPD published/updated its thematic file on audio recording of private meetings. Key takeaway: consent is often unsuitable and storage must end once the minutes are approved. See CNPD. (cnpd.public.lu)

The case

On 1 April 2026, the CNPD announced a “new thematic file” dedicated to audio recording of meetings in the private sector (companies, associations). Updated on 8 July 2026, it clarifies the legal basis, participant information, and expected retention period. Two strong messages: 1) consent (Art. 6(1)(a) GDPR) is, in practice, hard to validate; 2) if legitimate interest (Art. 6(1)(f) GDPR) is relied upon, it must be justified case by case; in all cases, recordings “must be deleted as soon as the minutes have been drafted, signed and approved.” Official CNPD sources (news and file). (cnpd.public.lu)

For background, see the Luxembourg GDPR framework.

Legal reasoning

1) Framework and legal bases

• The CNPD notes that Luxembourg law does not explicitly provide for audio recording of meetings; analysis relies on the GDPR and case-law. Relevant bases are consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)). (cnpd.public.lu)
• On consent, the CNPD follows EDPB criteria: freely given, specific, informed, unambiguous (Guidelines 05/2020). In workplace settings, power imbalance and lack of a practical alternative often undermine “freely given”: refusal must not cause detriment. Therefore: possible “in some specific cases,” but rarely workable. (cnpd.public.lu)
• On legitimate interest, the CNPD aligns with EDPB Guidelines 1/2024: the cumulative three-part test (interest–necessity–balancing). It illustrates a plausible interest (accuracy of minutes), necessity (no equally effective and less intrusive means), and balancing (impact, context, data nature, reasonable expectations). (cnpd.public.lu)

2) Case-law

The CNPD cites the CJEU in Meta v Bundeskartellamt (C‑252/21, 4 July 2023) to recall the need for truly freely given consent and proportionality review when invoking legitimate interest. Not a “meetings” case, but it sets a stringent standard. (eur-lex.europa.eu)

3) Participant information and documentation

Whatever the basis, prior information per Article 13 GDPR is required (purpose, legal basis, recipients, retention, rights, etc.). The CNPD stresses “complete and prior” information. Document the chosen legal basis, the LIA (for legitimate interest), and the deletion procedure once the minutes are approved. (cnpd.public.lu)

4) Retention period

Explicit position: retention is “intrinsically linked” to drafting the minutes; deletion occurs “as soon as” the minutes are formally approved. This extends data minimisation/limitation (Art. 5(1)(c) and (e) GDPR), similar to video surveillance where CNPD generally sets 8 days (different context, same demand for short, justified retention). (cnpd.public.lu)

What this changes in practice

• Governance and project meetings: recording may be defensible under legitimate interest to secure the minutes—if, and only if, you prove necessity (no equally effective alternative) and provide advance notice to all participants. In cross-border boards (LU/FR/BE/DE), apply the most protective standard. (cnpd.public.lu)
• HR/sensitive meetings (disciplinary, health, staff representatives): the balance will often weigh against recording (self-censorship, potentially sensitive data under Art. 9). Prefer an independent minute-taker and in-session approval workflow. (cnpd.public.lu)
• AI transcription tools: if used, you remain accountable for the full processing chain (Art. 13 notice, international transfers, deletion). The “ease” of transcription does not establish necessity over note-taking. (cnpd.public.lu) To frame such uses, consider our compliant AI governance.
• Retention: stop recording and delete the file once the minutes are approved (no “just in case” archiving). If a dispute requires re-listening before approval, record the rationale and restrict access. (cnpd.public.lu)

For implementation and regulator-facing work, an external DPO mandate can steer the legal basis analysis, notices, and deletion controls, and align with GDPR compliance in Luxembourg.

Board meeting example

• Before: invite email stating “audio recording to draft minutes,” link to Article 13 notice, basis: legitimate interest + LIA available.
• During: opening statement recalling the legal basis and option to pause recording for individual items.
• After: minutes approved under item 12; immediate audio deletion; deletion log and ROPA entry updated. (cnpd.public.lu)

Common pitfalls

1. Treating a vote as consent — A members’ vote does not replace individual, renewed, unambiguous consent; membership changes over time. Exclude “consent by vote” as a GDPR basis. (cnpd.public.lu)
2. Ignoring “less intrusive” alternatives — Necessity requires serious consideration of note-taking, a minute-taker, or local (non-cloud) transcription. No comparative analysis = weak legitimate interest. (cnpd.public.lu)
3. Informing after the fact — Information must be prior and complete (Art. 13). A Teams/Zoom banner is insufficient if unclear/inaccessible. Prepare a dedicated “recorded meetings” notice. (cnpd.public.lu)
4. Keeping audio “for history” — The CNPD is clear: delete once minutes are approved. Keep the minutes, not the audio. (cnpd.public.lu)
5. Mixing sensitive topics with full recording — If sensitive data (Art. 9) may arise, plan to pause recording or apply a separate lawful basis—otherwise the balance will tilt against recording. (cnpd.public.lu)

Six-step operational method

1. Define scope: which meetings, with the precise purpose (accurate minutes). Draft the Article 13 notice. (cnpd.public.lu)
2. Select legal basis:
   • Consent: only if a truly non-detrimental alternative exists and each participant can refuse. Otherwise, discard. (cnpd.public.lu)
   • Legitimate interest: complete a LIA (interest, necessity, balance) per Guidelines 1/2024. (edpb.europa.eu)
3. Assess alternatives: minute-taker/notes/local tools; document why they are insufficient, if applicable. (cnpd.public.lu)
4. Technical controls: restricted access, local encrypted recording, no disclosure. Log access and deletion. (cnpd.public.lu)
5. Deletion: automatic deletion once minutes are approved; log approval and deletion dates. (cnpd.public.lu)
6. Update the register (Art. 30) and the internal “meetings” policy; train chairs. (cnpd.public.lu)

Related Luxembourg point

In workplace contexts, information and proportionality requirements are historically strict (see CNPD video surveillance stance; short default retention). Different use case, same logic of minimisation and timestamped deletion. (cnpd.public.lu)

For hands-on GDPR posture with the CNPD, see our GDPR Luxembourg compliance.

Official sources

• CNPD — Thematic file “Audio recording of meetings” (last update 08/07/2026). https://cnpd.public.lu/fr/dossiers-thematiques/enregistrement-sonore-reunions.html
• CNPD — Announcement of the “new thematic file” (01/04/2026). https://cnpd.public.lu/fr/actualites/national/2026/04/enregistrement-sonore-reunions.html
• EDPB — Guidelines 05/2020 on consent (4 May 2020). edpb.europa.eu | pdf
• EDPB — Guidelines 1/2024 on legitimate interest (8 October 2024). edpb.europa.eu
• CJEU — C‑252/21, Meta v Bundeskartellamt (4 July 2023). eur-lex.europa.eu
• CNPD — Video surveillance: retention limitation (8 days in principle). cnpd.public.lu

In short, in Luxembourg, recording professional meetings is neither banned nor “self-service.” It requires a robust legal basis, complete prior information, and deletion once the minutes are approved. (cnpd.public.lu)

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.