AI Meeting Note-Takers: Who Has to Consent Before the Bot Joins the Call?

If an AI note-taker is going to sit in a client meeting, everyone on that call must be told before it starts, and they need a real chance to say no. Under Singapore's Personal Data Protection Act, a recording or transcript of a conversation is a collection of personal data, and the obligation to notify and obtain consent sits with the business running the bot, not with the software vendor. The practical version is short: announce it in the first thirty seconds, note in the minutes that you announced it, keep the bot out of meetings covered by a confidentiality clause, and write down who is allowed to switch it on. That is a one-page policy, not a project.

This matters now because the feature arrived without anyone buying it. Teams, Meet, Zoom and the standalone note-takers have all pushed recording and summarisation into the default meeting experience during 2026, and in many SMEs a staff member has already turned it on because it saves them forty minutes of typing a week. The time saving is real. The exposure is that nobody decided it.

What does an AI meeting note-taker actually collect?

More than the owner usually assumes. A single sixty-minute call produces the audio of every participant, a voice recording that can identify a named individual, a written transcript, an AI summary, the calendar invite list, and frequently whatever was on a shared screen. The transcript is the part that gets overlooked. It is not only your own data and your client's contact details. It is every third party your client mentions in passing, which in a real meeting means a customer's payment dispute, a candidate's current salary, a staff member's medical leave, or a supplier's confidential pricing. None of those people were on the call and none of them agreed to be written down and stored in a vendor's cloud.

Does consent really apply to an internal staff meeting?

The obligation is lighter inside the company, but it does not disappear. The PDPA excludes business contact information such as a name, job title and work phone number, so a transcript that only captures those is low risk. The Act also allows an employer to collect employee data without fresh consent where it is reasonable for managing the employment relationship. What it does not remove is the duty to tell staff what you are collecting and why.

So the correct handling for internal meetings is one written notice, once, in the staff handbook or an all-staff email, rather than a consent ritual at every stand-up. State which tool is used, that meetings may be transcribed, what the notes are used for, how long they are kept, and that a staff member may ask for the bot to be switched off in a one-to-one. If recordings will ever be used in a performance or disciplinary process, say that plainly in the same notice. Discovering it later is what turns a convenience tool into a grievance.

What do you say in the first thirty seconds of a client call?

Use the same sentence every time so nobody has to improvise: "Before we start, I have an AI note-taker on this call that produces a transcript and summary for our internal records. Is everyone comfortable with that?" Wait for the answer. If anyone hesitates or declines, turn it off and take notes by hand without debating it. Then have the person chairing the meeting write one line in the minutes: recording announced, no objection, or recording declined and disabled.

That single line is the whole audit trail. If a client later asks whether a conversation was recorded, or a larger customer asks during a vendor assessment how you obtain consent, the answer is a dated record rather than a recollection. It costs about five seconds per meeting.

Which meetings should the bot stay out of entirely?

Decide this once and publish the list, because it cannot be judged well in the moment. A sensible default bot-free list for an SME: anything covered by a client non-disclosure agreement that limits who may receive the information, conversations with your lawyer, HR disciplinary and grievance meetings, termination and salary discussions, commercial negotiations where a competitor's pricing is discussed, due diligence on a sale or investment, and any call involving a client in a regulated sector such as financial services or healthcare who has not given written permission.

The confidentiality point is the one that bites. Many client contracts list the parties permitted to receive confidential information. Passing a transcript to a note-taking vendor adds a recipient to that list. Even where the vendor is only processing data on your behalf, the contractual clause may not allow it, and that is a commercial breach question, separate from the PDPA question. If your largest client's contract has such a clause, the bot stays out of their meetings until they say otherwise in writing.

Where does the transcript go, and for how long?

Four questions to the vendor, answered in writing: where is the data stored, is it used to train their models, who in our account can see past meetings, and can we set automatic deletion. Transfers of personal data outside Singapore carry a standard of protection requirement under the PDPA, so the storage location is not a trivia question. On training, enterprise and paid business tiers commonly state that customer content is not used to improve their models while free tiers often do not, so check the tier you are actually on rather than the marketing page.

Then set a retention period and let the tool enforce it. Ninety days covers almost every legitimate reason an SME keeps a meeting summary, and anything needed beyond that should be copied into the project file as notes rather than left as a searchable archive of recorded voices. Restrict the workspace so a new hire cannot scroll two years of client calls on day one, and remove departing staff from the note-taker on their last day along with everything else.

What should you write down before January?

Seven lines, signed off by the owner: the one approved tool, who may enable it, the announcement script, the bot-free meeting list, the retention period, the storage location, and the removal step when someone leaves. Add a standing instruction that no other note-taking tool may be installed without approval, because the real risk is five different tools arriving through five personal free accounts.

Drafting this takes about twenty minutes. The alternative is answering a procurement questionnaire from a larger customer in the middle of a tender, or explaining to a client why a recording of their meeting sits in a system you cannot name.

Frequently asked questions

Do I need consent if only my own staff are on the call?

You do not need meeting-by-meeting consent, because collecting employee data for managing the employment relationship is permitted without it, but you do need to have told staff clearly and in advance what is recorded, why, and for how long it is kept. One written notice in the handbook satisfies that. A hidden recording does not.

What if the client says no to the note-taker?

Switch it off, take manual notes, and record in the minutes that recording was declined. Do not fall back to recording "just the audio for internal use", which is the same collection with a softer label. Where a client declines regularly, mark their account as bot-free so nobody has to ask again.

Is a breach of this a reportable incident?

It can be. Singapore has mandatory data breach notification, and a breach must be reported to the PDPC where it is likely to cause significant harm to affected individuals or involves 500 or more individuals. An exposed archive of meeting transcripts naming clients and their customers could meet that bar, which is the main argument for a short retention period rather than keeping everything forever.

If you want the seven-line version drafted against your own client contracts and the tool your team is already using, Digital Perpetual can sit down with you and have it finished in a single session.