Recording business-related conversations with an employee, for example a performance review, falls under the General Data Protection Regulation (GDPR). The GDPR permits such a recording when this is necessary because of:
- Legal requirements; or
- A legitimate interest for your organization.
In both situations, you must notify the employee before the start of the recording that (s)he is being recorded. When you want to record out of a legitimate interest, the employee is permitted to object. In such case, you must explain to the employee why the interest of the organizations outweighs the interest of the employee. You must be able to support your argument. The employee is entitled to a copy of the recording. At most, you may deleted sections of the recording to protect the privacy of other employees. Permission by an employee is not a legal basis for legitimizing the recording.
The GDPR does not apply to personal or non-business-related use of information; even in a business-related environment. For example, an employer may include the birthdays of employees in a planner for personal use, such as for buying presents or wishing them a happy birthday. However, this is not possible for recordings of business conversations, as these are always for non-personal (i.e. business-related) use.