You may transcribe a conversation if you were allowed to record it. For everyday business in Germany there is a safe rule for that: record only once everyone else involved has agreed beforehand. Recording another person's non-publicly spoken word without authorization is a criminal offence under § 201 of the German Criminal Code (StGB), not an administrative fine: up to three years in prison or a fine, and even the attempt is punishable. The second step is a separate question: once a lawfully made recording goes to a transcription service or an AI, that is processing of personal data and needs its own legal basis under Art. 6 GDPR, or Art. 9 GDPR for health data and other special categories. If the service works on your instructions, you need a data processing agreement under Art. 28 GDPR, and if it sits outside the EU, Art. 44 ff. GDPR on third-country transfers applies.
This post describes German and EU law, because that is the framework I work under. If you record calls elsewhere, the structure below still helps, but the rules differ, sometimes sharply. And a second note up front: I'm a developer, not a lawyer. This is the working basis I run call analysis on in my own business, with the statutes open next to me, but it isn't legal advice and it doesn't replace a conversation with someone qualified about your specific case. In my workforce, Gustav handles call transcript analysis, and his first rule isn't technical but legal: without a clean legal basis, he never gets to see a transcript. What data goes anywhere near AI in my business is in AI and Privacy: What the AI Gets to See.
Two questions that keep getting mixed up
Discussions about transcription go in circles because two separate legal questions land in the same pot.
A tidy GDPR setup does not cure a secret recording, and valid consent to be recorded does not yet permit every later analysis.
The recording: what § 201 StGB requires
§ 201(1) StGB penalizes anyone who, without authorization, records the non-publicly spoken word of another person. Three phrases carry the weight.
"Without authorization" is the hinge. Prior consent from everyone else involved makes the recording authorized, and for everyday business that is the safe rule. Whether narrowly drawn statutory or emergency-like exceptions exist alongside it is a question for the individual case and belongs with a lawyer, not in a house rule. That is why "is it legal to transcribe conversations" is almost never a transcription question but a consent question.
"Non-publicly spoken" draws the line: a talk in front of an undefined audience is something different from a sales call or a two-person phone conversation. The conversations solo business owners want to mine for knowledge are mostly in the second group.
"Of another person" means every other person. Not just the person you are talking to has to agree, but everyone else whose words end up on the recording. In a video call with four participants, you need the consent of the other three; your own isn't the point of contention.
Two points get overlooked: § 201(1) no. 2 StGB also covers anyone who uses such a recording or makes it available to a third party, so whoever merely processes it or uploads it into a tool is not outside the provision. And § 201(4) StGB makes the attempt punishable.
The foundation underneath is older than any transcription app: in its tape recording decision of 31 January 1973 (2 BvR 454/71, BVerfGE 34, 238), the German Federal Constitutional Court recognized the right to one's own spoken word under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law. The same root feeds the labour court line that secretly recording a personnel meeting can justify termination without notice (Hesse Regional Labour Court, 23 August 2017, 6 Sa 137/17).
Consent: what it has to carry
The agreement has to exist before the recording, relate to a specific purpose, and the participants have to know what they are agreeing to. Art. 7 GDPR adds three requirements:
- Provability (Art. 7(1) GDPR). In a dispute, what counts is not that you asked but that you can show it.
- Withdrawal at any time (Art. 7(3) GDPR), as easy as giving consent. It doesn't work retroactively, but it ends further processing. In practice that means you have to be able to find out which recording belongs to which person.
- Bundling is risky (Art. 7(4) GDPR). Making a service conditional on consent to recording, when the recording isn't necessary for that service, undermines the voluntary nature of the consent.
Three routes combine well: a clause in the contract, a notice with active confirmation in the booking process, and the spoken announcement at the start of the call with a note in the minutes. Whether a bare notice without confirmation is enough depends on wording and context; active confirmation is the more robust option.
The later processing: what the GDPR governs
The recording now exists lawfully and is to be transcribed. That is its own processing operation with its own basis.
Legal basis under Art. 6(1) GDPR. The realistic candidates are consent (lit. a), performance of a contract (lit. b), and legitimate interests (lit. f). If the conversation was recorded on a consent basis anyway, it is not convincing to base the analysis on legitimate interests afterwards. It is cleaner to put the purpose into the consent from the start: not just "recording" but "recording, transcription and internal analysis".
Special categories under Art. 9 GDPR. Health data, religious beliefs, trade union membership, sex life and further categories are subject to a processing prohibition with narrow exceptions, including explicit consent under Art. 9(2)(a) GDPR. That hits coaches working near therapy faster than they expect: a client mentions an illness in passing, and such a passage is now in the transcript. The workable answer is rarely explicit consent for everything, but not carrying those passages forward at all.
Processing on your behalf under Art. 28 GDPR. A service working on your instructions is a processor: you need a contract with the content required by Art. 28(3) GDPR, the provider has to offer sufficient guarantees (Art. 28(1)), sub-processors need your authorization with a right to object (Art. 28(2)), and the contract has to cover deletion at the end of the engagement.
Third-country transfers under Art. 44 ff. GDPR. If the provider processes outside the EU, the transfer needs a basis. For the United States, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. It doesn't cover the US wholesale, only companies that have certified under the framework. Check the official list for your provider, otherwise the route runs via standard contractual clauses under Art. 46 GDPR.
Separately, it's worth checking your plan: are inputs used for model training, and how long are they stored? For Claude that is in Claude Privacy and GDPR: What Applies, the trade-off for your own machine in Local AI and Privacy: Cloud or Server?, including the caveat that local doesn't automatically mean compliant.
When employees are in the conversation: § 26 BDSG
As soon as employees are recorded, the employment context comes in. § 26(1) of the German Federal Data Protection Act (BDSG) permits processing employee data insofar as it is necessary for establishing, carrying out or ending the employment relationship. § 26(2) BDSG looks at consent separately: the dependency in the employment relationship and the circumstances of the declaration count towards whether consent is voluntary, consent generally has to be given in writing or electronically, and the purpose and the right to withdraw have to be explained.
Caution is warranted here, because the legal position is in motion. On 30 March 2023 (C-34/21), the Court of Justice of the European Union held that a national rule on employee data protection only counts as a more specific rule within the meaning of Art. 88(1) GDPR if it meets the requirements of paragraph 2, and must otherwise be disapplied unless it is itself a legal basis under Art. 6(3) GDPR. On the almost identically worded comparator § 23 HDSIG, the Court noted in its reasoning that the provision appears merely to repeat the condition already set out in Art. 6(1)(b) GDPR (paragraph 81), but left the final assessment to the referring court. How durable § 26(1) sentence 1 BDSG is has been debated since. So don't rely on it alone, check Art. 6 GDPR in parallel, and get professional advice before establishing a permanent recording practice in a team. If there is a works council, § 87(1) no. 6 of the Works Constitution Act applies to technical equipment intended to monitor conduct or performance.
The practical path in five steps
- Ask before, not after. One sentence at the start of the call naming the purpose, the retention period and the option to say no. If someone says no, the conversation continues without a recording, and that option has to be real.
- Document the consent. Date, time, who agreed, which purpose was named, and with several participants, each person individually. That is Art. 7(1) GDPR in its smallest form.
- Strip the personal detail before the analysis. Role instead of name, industry instead of company, order of magnitude instead of amount, region instead of town. Sensitive passages about health, family or private finances get removed, not replaced.
- Set a retention period. Art. 5(1)(e) GDPR requires storage limitation: one deadline for the raw recording, a separate one for the condensed result.
- Delete, and be able to find things. Keep a record of which recording belongs to which person, otherwise you can implement neither a withdrawal under Art. 7(3) GDPR nor an erasure request under Art. 17 GDPR. Deletion covers the tool and the backups too. In immutable backups a single file often can't be removed physically straight away; then you block it from being restored into the live set, record the backup's own retention period, and delete it for good when that period runs out.
Where the answer depends on your case
Any general statement is unreliable at four points:
- Your supervisory authority. In Germany that is usually the data protection authority of the federal state you are based in, and the authorities don't all set the same priorities.
- Professional confidentiality. Anyone covered by § 203 StGB, such as doctors, psychotherapists or lawyers, has additional duties, including towards service providers. Coaching doesn't automatically fall under it, but work close to therapy may be assessed differently.
- Conversations across borders. Other legal systems use other standards, and in some, one party's consent is enough. If someone in Germany is on the call, don't rely on the more permissive rule.
- Admissibility in court. Whether a recording may be used in proceedings is a separate balancing exercise and doesn't follow from the recording being lawful.
What comes after the legal groundwork
Once that's settled, the actual work starts: three hundred conversations as text files are mostly three hundred files nobody reads.
That's exactly where Gustav, my AI employee for call analysis works, in the same order as above. Speech recognition runs locally in my setup, so the raw transcript never leaves the machine. Then comes the fixed anonymization pass, and only the checked extracts go further. A separate index records which call belongs to which person, so that a withdrawal or an erasure request stays actionable.
His output is deliberately not the transcript but a pattern register: the recurring questions across many conversations, each paired with your own clearest answer so far, which then turns into a playbook, FAQ answers, content raw material and an objection library. The difference from a pure transcription service is also a data protection one: what remains at the end isn't a growing pile of personal recordings but a condensed register, while the raw recordings disappear at their deadline. Whether that register is genuinely anonymous is something you check entry by entry: role, industry, date and a verbatim quote can together still point to a person, and as long as the index holds the link, the set is pseudonymized and needs purpose, deadline and access control like any personal data. How a role like that is built is in Hiring an AI Employee: The Process, the other roles on the AI employees page, and which of them carry in a coaching business in AI for Coaches.
Frequently asked questions
Is it legal to transcribe conversations?
Yes, if the recording was made lawfully, safely meaning: everyone else involved agreed beforehand. The criminal law risk mostly arises at the recording itself, because § 201 StGB penalizes recording without authorization. Transcribing is nevertheless processing and needs its own basis under the GDPR.
Is it legal to transcribe phone calls?
Phone calls follow the same rule as conversations in a room: recording without authorization is a criminal offence under § 201 StGB, and you are safe with prior consent from everyone else involved. An automated announcement carries the information, but the consent itself should be documented so you can prove it.
Is AI transcription GDPR compliant?
That doesn't hinge on the AI but on the setup: a legal basis under Art. 6 GDPR, Art. 9 for special categories, a processing agreement under Art. 28, and, with a provider outside the EU, a basis under Art. 44 ff. With those points settled and documented, the use is possible in principle.
May I analyze old recordings made without consent?
There is no retroactive cure: later consent does not make a recording that was already made without authorization lawful in hindsight. The safe route is therefore to stop analyzing it, block or delete the recording, and obtain valid consent before future conversations. Anonymizing heals nothing either, because § 201 StGB attaches to the act of recording. Special cases belong with a lawyer.
What applies when employees are recorded?
Then the employment context comes in: § 26 BDSG, the question of voluntary consent inside a dependency, and § 87(1) no. 6 of the Works Constitution Act if there is a works council. Since the CJEU ruling of 30 March 2023 on the comparable § 23 HDSIG, § 26(1) sentence 1 BDSG is contested. Have this checked professionally.
How to continue
Don't start with the software, start with a sentence. Write down the announcement you'll open every call with: that you're recording, what for, how long the recording stays, and that saying no has no consequences. Next to it, keep a simple list with date, participants, consent and deletion date. You write those two notes yourself, because they have to fit your business. You don't have to sit with them alone: in the community there are wordings from people who already say the same sentence before their calls, and on a call we can go through your version together.
How that turns into a register you actually use is what Gustav does as a ready-made package in my community, with the anonymization pass and consent templates to build on. Those templates are samples without warranty and don't replace a lawyer reviewing your case.
