AI note takers and the GDPR: the questions to ask before you use one

Whatever writes your meeting notes, these are the questions to ask before you use it at work, with Prokoll's answers beside them.

By Therese AnhammerUpdated Oct. 16, 2026

Why the questions are yours to ask

When you record a meeting and have it transcribed, you or your organisation decide why and how, which usually makes you responsible for that data under the GDPR.

What a tool says about itself does not change that, so check any tool against the questions below.

The questions, and Prokoll's answers

Question	Why it matters	Prokoll
Where is the meeting transcribed?	If it happens on a server, the meeting leaves your computer and someone else handles it.	On your Mac. The sound, the transcript and the notes are never uploaded.
Who else receives the meeting?	A service that handles personal data on your behalf is a processor, and the GDPR requires a data processing agreement with it.	Nobody. We never receive your meetings, so there is no processor for them and no agreement to sign.
Does anything go outside the EU?	Sending personal data outside the EU and the EEA needs a safeguard, such as an adequacy decision or standard contractual clauses.	Your meetings stay on your Mac, so they are not sent anywhere.
Is it used to train AI?	Some services may use recordings or transcripts to train their models, so check the terms and the settings.	No. We never receive your meetings.
How long is it kept, and where?	To delete data when it is no longer needed, you need to know everywhere it ends up.	The recording is deleted once it has been transcribed. The transcript and the notes stay encrypted on your Mac until you delete them.
What is the lawful basis, and are people told?	Recording people is processing their personal data: you need a lawful basis, and you must tell them (GDPR, Articles 6 and 13).	That part is up to you. Prokoll reminds you to tell people before your first recording, with a notice you can copy.
Is an impact assessment needed?	Where processing is likely to result in a high risk to people, the GDPR requires a data protection impact assessment first (Article 35).	Your organisation decides. With Prokoll, no outside party receives the meetings, so there is none to include in it.
What does the app itself send?	Even an app that runs on your computer may contact its maker, for updates, licences or error reports.	The files it needs, once; a daily check for updates; licence activation; and a crash report only if you choose to send one.

Where is the meeting transcribed?: If it happens on a server, the meeting leaves your computer and someone else handles it.; ProkollOn your Mac. The sound, the transcript and the notes are never uploaded.
Who else receives the meeting?: A service that handles personal data on your behalf is a processor, and the GDPR requires a data processing agreement with it.; ProkollNobody. We never receive your meetings, so there is no processor for them and no agreement to sign.
Does anything go outside the EU?: Sending personal data outside the EU and the EEA needs a safeguard, such as an adequacy decision or standard contractual clauses.; ProkollYour meetings stay on your Mac, so they are not sent anywhere.
Is it used to train AI?: Some services may use recordings or transcripts to train their models, so check the terms and the settings.; ProkollNo. We never receive your meetings.
How long is it kept, and where?: To delete data when it is no longer needed, you need to know everywhere it ends up.; ProkollThe recording is deleted once it has been transcribed. The transcript and the notes stay encrypted on your Mac until you delete them.
What is the lawful basis, and are people told?: Recording people is processing their personal data: you need a lawful basis, and you must tell them (GDPR, Articles 6 and 13).; ProkollThat part is up to you. Prokoll reminds you to tell people before your first recording, with a notice you can copy.
Is an impact assessment needed?: Where processing is likely to result in a high risk to people, the GDPR requires a data protection impact assessment first (Article 35).; ProkollYour organisation decides. With Prokoll, no outside party receives the meetings, so there is none to include in it.
What does the app itself send?: Even an app that runs on your computer may contact its maker, for updates, licences or error reports.; ProkollThe files it needs, once; a daily check for updates; licence activation; and a crash report only if you choose to send one.

What leaves your Mac

What Prokoll cannot decide for you

Whether a recording is lawful depends on why you record, who is told and what you do with the notes. A transcript or a note can also be wrong, so read it before you rely on it.

This is not legal advice

This page covers the usual questions in plain words. If you are unsure about your own case, ask whoever looks after data protection where you work.

Get your licence