Otter.ai and GDPR / AI Act: meeting transcription and transfers

Overview and data processed

Otter.ai is a US transcription and meeting note-taking service. Its OtterPilot assistant joins meetings (Zoom, Teams, Google Meet), records, transcribes and summarises.

Otter processes participants' voices, transcriptions, summaries and metadata. US publisher: hosting/processing in the United States likely, with exposure to the CLOUD Act. Check whether data may be used to improve models depending on your plan.

Risks for your organisation

Transfer outside the EU of voice data, participants' consent (especially external parties) and retention constitute the main risks, aggravated by the potential sensitivity of what is said.

Main GDPR risks:

• Insufficient information (a banner is not enough); internally, employee consent rarely valid (legitimate interest/contract).
• Meetings with third parties: information and consent essential.
• Transfer outside the EU (CLOUD Act); safeguards to be established (SCCs).
• Potential use of data for training (to be checked/disabled); retention and minimisation.

GDPR obligations

1. Inform in the invitation and orally; obtain consent from third parties.
2. Sign the DPA; frame transfers (SCCs); check/disable training on your data.
3. Define short retention periods; minimise (audio).
4. Consult the works council if monitoring/assessment; record in the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform of the AI and flag AI-generated minutes. GPAI (provider obligations); AI literacy required. Prohibition (Article 5): analysis of tone/mood/stress/emotional engagement prohibited in the workplace — disable these functions. Participation analyses feeding HR decisions shift to high risk (Annex III). See the AI Act guide.

AI Act risks: participants not informed of the AI; tone/emotion analyses (prohibited); participation analyses for HR purposes (high risk).

Cybersecurity and best practice

Cyber risks: voice recordings outside the EU; access to transcripts to be compartmentalised; bot in confidential meetings; NIS 2 depending on size.

Best practice: frame transfers (SCCs), check/disable training; information + consent from third parties; audio rather than video; minimal retention; disable emotional analysis; for sensitive meetings, prefer a sovereign solution; AI charter, record, AI training.

Checklist:

• Information + participant consent, DPA + transfers framed (SCCs), training checked/disabled
• Short retention, no emotion/tone analysis, works council consulted if monitoring/assessment
• DPIA if behavioural analysis, sovereign alternative for sensitive matters, teams trained

Penalties, conclusion and recommendations

Penalties: GDPR (up to €20M or 4%); AI Act (€35M/7% or €15M/3%); criminal aspect (Article 226-1 of the Criminal Code); obstruction offence (works council).

Recommendation: Otter.ai is effective but combines transfer outside the EU and voice recording. Frame transfers, check training, inform/obtain consent, minimise and delete quickly. For confidential meetings, a sovereign alternative such as tl;dv is preferable. Compare with Fireflies.ai and Fathom. See the AI tools comparison.