CNPD: recording private meetings — legitimate interest only under conditions

On 8 July 2026, the Luxembourg CNPD released guidance on “Audio recording of meetings” in the private sector. Core message: consent is hard to validate in practice; legitimate interest is only possible after a strict necessity and balancing test; and audio must be deleted once minutes are approved. See CNPD (08/07/2026): CNPD.

The case

The CNPD clarifies GDPR lawfulness, information duties and retention. Key point: “regardless of the chosen legal basis, […] the retention period is intrinsically tied to the transcription into the minutes”; audio files “must therefore be deleted once the minutes have been drafted, signed and approved.”

Legal reasoning

1) Legal basis — Article 6 GDPR

• Consent (Art. 6(1)(a)): valid only if freely given, specific, informed and unambiguous. In meetings, power imbalance and lack of alternatives often make consent not freely given. Refs: EDPB 05/2020, CNPD.
• Legitimate interest (Art. 6(1)(f)): three cumulative conditions — a real and lawful interest; necessity (no equally effective, less intrusive alternative); and a favorable balancing test (reasonable expectations, data nature, context, consequences). Refs: EDPB 1/2024; CJEU, C‑252/21.

2) Information — Article 13 GDPR

Provide complete, prior information on legal basis, purposes, recipients, retention, rights, and any non-EU transfers. In practice: a dedicated notice before the meeting, plus an oral reminder at the start. Basis: Art. 13 GDPR.

3) Data minimisation/necessity and retention — Articles 5(1)(c) and 5(1)(e)

• Necessity: look for equally effective, less intrusive means (trained scribe, note-taking, transcription tools without keeping raw audio). Ref.: CNPD.
• Retention: delete audio once minutes are signed/approved; audio is not an archive. Basis: Art. 5(1)(e) GDPR.

4) Reasonable expectations and context

Being recorded may chill open discussion; the nature and cadence of meetings weigh in the balancing test. Ref.: EDPB 1/2024.

What this changes in practice

• For executives, DPOs and CISOs: recording “to ease minute drafting” is not automatically lawful. Without a true alternative for objectors, consent fails. For legitimate interest, document a LIA proving real utility, lack of an equally effective alternative, and safeguards (no secondary analytics, encryption, restricted access, deletion on minute approval). A certified DPO can structure the legal basis and the LIA.
• Sensitive meetings (audit, HR, employee relations, M&A): the necessity test is rarely met. Prefer robust notes, adversarial review and a fast approval workflow. Ref.: CNPD.
• Recurring meetings: if occasional audio helps resolve an objective dispute, frame it contractually, inform ex ante, trigger recording only when needed, isolate the necessary excerpt and delete the rest once minutes are final.
• AI transcription tools: clarify processor role, processing location, transfer safeguards, auto-deletion, and ban model training. Basis: Arts. 28 and 44–49 GDPR. For guardrails, see our AI governance support.

Common pitfalls

1. Replacing individual consent with a “vote in the meeting”. Unanimity ≠ unambiguous, enduring consent. Ref.: CNPD.
2. No alternative for objectors: without an option to speak off‑record, consent is not freely given. Ref.: EDPB 05/2020.
3. “Comfort” retention periods: keeping audio “until the next meeting” breaches Art. 5(1)(e). Delete upon minute approval. Ref.: CNPD.
4. Incomplete notice (Art. 13): “this meeting is recorded” is not enough. Ref.: GDPR.
5. Unframed AI processor: no compliant DPA (Art. 28) and unchecked transfers (Chapter V). Ref.: GDPR.

Operational checklist

• Fix the purpose: support to draft/approve minutes only.
• Select the legal basis:
  • Consent: real alternatives, no detriment, traceable capture, stop on request. Ref.: EDPB 05/2020.
  • Legitimate interest: documented LIA, proven necessity, mitigating measures, recorded balancing. Ref.: EDPB 1/2024.
• Inform (Art. 13): prior notice + oral reminder at the start.
• Configure tools: local encrypted recording, restricted access, no secondary analytics or model training.
• Delete audio once minutes are approved; log deletion (evidence). For Luxembourg context, see Articles 5, 6 and 13 GDPR.

Official sources

• CNPD (Luxembourg), Audio recording of meetings — 08/07/2026: https://cnpd.public.lu/fr/dossiers-thematiques/enregistrement-sonore-reunions.html
• EDPB, Guidelines 05/2020 (consent): https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en
• EDPB, Guidelines 1/2024 (Art. 6(1)(f)): https://www.edpb.europa.eu/public-consultations/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en
• CJEU, Meta v Bundeskartellamt, C‑252/21: https://infocuria.curia.europa.eu/tabs/redirect/juris/liste.jsf?num=C-252/21
• GDPR (EUR‑Lex, Arts. 5, 6, 13): https://eur-lex.europa.eu/legal-content/EN-SV/TXT/?uri=CELEX%3A32016R0679

In short

In the private sector, recording meetings is an exception to be tightly framed, not a comfort reflex. Organisations in Luxembourg must justify the legal basis, prove necessity, inform clearly — and delete audio as soon as minutes are approved.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.