English · Deutsche Version
Free tool · Compliant Rollout Kit 2 of 4
Answer three questions about who is in the meeting and how you process it. The decision tree sets your legal basis and assembles four ready-to-use templates: an invite paragraph, an in-meeting announcement in English and German, a privacy notice block and a CRM documentation snippet. Everything runs in your browser. Nothing is uploaded or stored.
Updated 30 July 2026 · Template, not legal advice
Template, not legal advice. These templates are based on GDPR, the German Federal Data Protection Act (BDSG) and Section 201 StGB, and on published templates from data protection authorities and associations. They do not replace individual review. Confirm the wording with your data protection officer and, where in doubt, with a lawyer. Made with numigtm.com.
Most English-language consent scripts online are written for US wiretapping law, where the question is whether the parties were notified and, in all-party states, whether they agreed. Reusing that language in the EU is the single most common mistake. GDPR consent is a higher bar. It must be freely given, specific, informed and unambiguous, and under Article 7(3) it must be as easy to withdraw as it was to give.
A US-style This call is being recorded for quality purposes line does not, on its own, meet the GDPR standard. It gives notice but no real choice, names no controller, no purpose, no retention period, and offers no withdrawal path. In Germany it also runs into Section 201 StGB, which makes recording the non-publicly spoken word without every speaker's consent a criminal offence, punishable by up to three years imprisonment or a fine.
So an EU-ready consent flow does two things at once: it satisfies the GDPR conditions for a valid legal basis, and it obtains the all-party agreement that criminal law requires for the audio recording itself. The templates below do both.
Every recording needs a legal basis under Article 6 GDPR and, because a conversation is being recorded, compliance with Section 201 StGB. Who is in the room decides which of the three bases makes sense.
| Basis | When it fits | Limits |
|---|---|---|
| Consent Art. 6(1)(a) |
External participants, customer calls, sales calls. The clean route when there is no authority relationship. | Must be freely given, informed, documented and revocable at any time. For your own employees, it is often not truly free because of the dependency relationship. |
| Legitimate interest Art. 6(1)(f) |
Narrowly defined purposes where consent is impractical. Requires a documented balancing test. | Does not cover the criminal-law side: Section 201 StGB still requires each speaker's consent for the audio recording. Rarely sufficient on its own for recording. |
| Works agreement + Section 26 BDSG |
Internal meetings with your own employees where a works council exists. The robust basis in the employment context. | Requires a negotiated works agreement (see artefact 1 of the kit). External participants are not covered and still need consent. |
Consent is withdrawable at any time under Article 7(3) GDPR, and withdrawal must be as easy as giving it. If someone withdraws mid-call:
The generated in-meeting script includes a prepared line for this, so the host does not have to improvise.
An account executive runs a recorded video call with a prospect. An AI assistant joins the call, records it and drafts notes. Here is how the generator is filled in:
The generator puts the invite paragraph into the calendar invite, so the customer knows about the recording before the meeting. At the start, the AE reads the in-meeting announcement and waits for agreement. The privacy notice travels along as a link; the CRM snippet records that consent was obtained. If the customer objects, the prepared withdrawal line applies and recording stops.
The generator assembles these from your inputs. The full text below shows the most common case (external participants, recording, consent, auto-join bot) and can be used directly. You can also open all templates as a standalone printable document.
No. In Germany, recording the non-publicly spoken word of another person without consent is a criminal offence under Section 201 StGB, punishable by up to three years imprisonment or a fine, and similar protections exist across the EU. Unlike many US states with one-party consent, the EU position is effectively all-party: every person whose spoken word is recorded must agree. GDPR adds a separate requirement of a legal basis under Article 6. A legitimate interest under Article 6(1)(f) can provide the GDPR basis but does not remove the criminal-law need for each speaker's consent to the audio recording.
No. US two-party laws are wiretapping rules that ask whether the parties were notified. GDPR consent is stricter: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. A US-style "This call may be recorded" line does not meet the GDPR standard because it offers no real choice and no withdrawal path. In the EU you also have to name a legal basis, a controller, a purpose and a retention period, and honour withdrawal at any time. The generator produces language that meets the GDPR bar.
Three bases are relevant. Consent under Article 6(1)(a) is the clean route for external participants and customer calls: freely given, informed and revocable. Legitimate interest under Article 6(1)(f) is possible for narrow purposes but needs a documented balancing test and does not cover the criminal-law side. In an employment context, a works agreement plus Section 26 BDSG is the robust basis for internal recordings, because employee consent is rarely truly free. The decision tree picks the basis from who is in the room.
Consent is withdrawable at any time under Article 7(3) GDPR. If someone withdraws mid-call, recording of their spoken word must stop from that moment. The portion recorded before withdrawal stays lawful because withdrawal is not retroactive; continued recording is not. In practice: stop the recording or exclude and delete that person's further contributions, document the withdrawal and treat the person without disadvantage. The generator provides a prepared in-meeting line for this.
Yes. If an AI assistant auto-joins and records or transcribes, all participants must be clearly told at the start and be able to object. This follows from the GDPR transparency duty and, for recording, from Section 201 StGB. From 2 August 2026, Article 50 of the EU AI Act strengthens transparency obligations for the use of AI systems. The safe route is an explicit spoken announcement plus a note in the invite. The generator produces both.
No. The generator and templates are samples and educational aids, not legal advice. They are based on GDPR, the German Federal Data Protection Act, Section 201 StGB and published templates from data protection authorities and associations. Review the wording with your data protection officer and, where in doubt, with a lawyer.
Four legally required artefacts belong to every German AI-notetaker rollout. This is the second. The others are reachable from the Rollout Kit overview.