CNPD frames meeting recordings: divergence with the CNIL

Practical takeaway. On 1 April 2026, the CNPD issued guidance on audio recording of meetings: rely on legitimate interest (Art. 6(1)(f) GDPR) with a documented balancing test and delete audio once the minutes are approved. In France, the CNIL allows call recording for evidential purposes and bans audio paired with video surveillance.

The case

The CNPD weighs consent (Art. 6(1)(a)) against legitimate interest (Art. 6(1)(f)), stressing how hard it is to obtain a “freely given” consent in meetings, and requires deletion “as soon as the minutes have been drafted, signed and approved.” References: CNPD — Audio recording of meetings (01/04/2026), CJEU C‑252/21 (Meta), and EDPB Guidelines 1/2024.

In France, the CNIL permits call recording, under strict conditions, “to establish proof of the conclusion of a contract” and reiterates the general ban on audio capture coupled with video surveillance unless a specific legal basis under Article 23 GDPR applies. References: CNIL — Calls for evidential purposes; CNIL — Audio + CCTV.

Sectoral exceptions (finance): MiFID II and Commission Delegated Regulation (EU) 2017/565 require recording of conversations/communications relating to transactions with five-year retention (up to seven upon request by the authority). See MiFID II Art. 16(7), Delegated Regulation 2017/565 Art. 76, and ESMA Q&A.

Legal reasoning

• Lawful basis and method. The CNPD favours legitimate interest with a three-step test (interest, necessity, balancing), relying on CJEU C‑252/21 and EDPB Guidelines 1/2024. Freely given consent is rarely feasible in meetings (see EDPB 5/2020).
• Retention. Key stance: retention is “intrinsically linked” to transcription into the minutes; audio must be deleted once the minutes are approved (CNPD).
• CNIL divergence. France admits call recordings for evidence but strictly bans audio paired with cameras unless justified by Article 23 GDPR (CNIL — Calls; CNIL — Video surveillance).
• Lex specialis. Where sectoral law mandates recording and retention (e.g., finance), MiFID II/2017‑565 prevail, provided use is limited to the imposed purpose and individuals are informed (EURLex; ESMA Q&A).

What this changes in practice

• Internal meetings (boards, committees, projects). In Luxembourg, the bar is high: enable recording case by case, demonstrate necessity (no equally effective alternative), inform attendees, and delete immediately after approval of the minutes (CNPD). Document your balancing test in your GDPR record of processing.
• Sales and customer service calls. In France, permissible for contractual evidence with spoken notice at the start and an appropriate lawful basis (CNIL). In Luxembourg, absent sectoral law, rely on legitimate interest and limit retention to the “useful evidential period” (auto-deletion policy). Investment firms/PSFs must apply MiFID II (5 years, up to 7 upon authority request).
• Video surveillance with microphones. In France, audio paired with cameras is prohibited unless a specific legal basis exists (Art. 23 GDPR) (CNIL).
• Automated transcription. Check international transfers, lawful basis, security and secondary uses (SSO, logs, training). Align transcription retention with the “minutes” purpose; delete the audio and, if needed, the temporary transcript (CNPD). A DPO mandate can help govern these processing operations.

Common pitfalls

1. Treating a show of hands as valid consent; without a real alternative, it is not freely given (CNPD; EDPB 05/2020).
2. Default-recording all Teams/Zoom meetings and keeping them for months: the CNPD requires deletion once minutes are approved (deletion logs, disable default recording) (CNPD).
3. Blurring purposes (HR appraisal, training, internal AI) without a new lawful basis/notice and, where relevant, a DPIA (see EDPB 1/2024).
4. Overlooking sectoral rules (MiFID II/2017‑565) and wrongly applying the “minutes then deletion” rule (EURLex; ESMA Q&A).
5. Adding microphones to cameras for “security” in France: prohibited without a specific legal basis (CNIL).

Official sources

• CNPD (Luxembourg) — Audio recording of meetings
• EDPB — Guidelines 1/2024 (Art. 6(1)(f))
• EDPB — Guidelines 5/2020 (consent)
• CNIL — Call recording for proof of contract
• CNIL — Audio + CCTV
• EU — MiFID II Art. 16(7)
• EU — Delegated Regulation (EU) 2017/565 Art. 76
• ESMA — MiFID II Q&A

In short

In Luxembourg, for internal meetings the CNPD sets a high bar: finely justified legitimate interest, clear notice, no systematic recording, and swift deletion. In France, CNIL’s stance differs: call recording allowed for evidence, audio + cameras prohibited. Embed these choices into your governance and your GDPR record of processing.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.