In this guide · 8 sections
- 01Why AI voice recorders raise PDPA questions
- 02What the PDPA expects: notify, consent, protect, retain
- 03Where the audio goes: check the vendor's terms
- 04A short consent script for meetings
- 05When not to record at all
- 06Retention and access: a rule that works
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
You can use AI voice recorders at work, but tell everyone and get their agreement before you record, because the PDPC says audio that identifies a person can be personal data. Use a company account, check where the vendor processes audio, limit who can access recordings and delete them on a schedule.
Why AI voice recorders raise PDPA questions
Unlike meeting software where a banner shows "recording", a pocket or wearable recorder is easy to miss. Most such devices upload audio to the maker's app and cloud, where speech-to-text and a large language model produce the transcript and summary. So a single meeting creates personal data in several places: the device, your phone, the vendor's servers and possibly its AI providers.
The PDPC's Advisory Guidelines on Selected Topics (chapter 4, photography, video and audio recordings) say an audio recording may be personal data if someone can be identified from it, from their voice alone or combined with other information you have. In a client meeting, where you know who was there, that is almost always the case. This guide is general information, not legal advice.
What the PDPA expects: notify, consent, protect, retain
The PDPA's data protection obligations apply to recordings the same way they apply to forms and spreadsheets.
| Obligation | What it means for a meeting recorder |
|---|---|
| Notification | Tell people the purpose before recording: minutes, action items, accuracy |
| Consent | Get agreement before you record; let people say no |
| Purpose limitation | Use the recording only for what you said, not marketing or staff monitoring |
| Protection | Company account, MFA, restricted sharing, secure device |
| Retention limitation | Delete when no longer needed for the purpose |
| Transfer limitation | If audio is processed overseas, the vendor must protect it to a comparable standard |
| Access and correction | People can ask what you hold about them, including recordings |
On how to get consent, the PDPC's guidelines say the PDPA doesn't prescribe a method, but as good practice an organisation should obtain consent in writing or record it in a way that can be referred to later, because you may have to prove it. For a recorded meeting, the easiest proof is the consent itself at the start of the recording, plus a line in the calendar invite.
Where the audio goes: check the vendor's terms
Before buying devices for staff, read the vendor's privacy policy and AI terms. As an example, Plaud's privacy policy (last updated 16 June 2026) states that:
- It operates servers in the United States, Germany, Japan and Singapore, and stores data in the data centre for the user's region.
- It will not use audio, photos or text to train its own or third-party AI models without explicit, informed consent.
- Content sent to AI features is shared with its LLM service providers only to perform the task, under agreements that bar training and limit retention.
- Users can delete individual files, reset a device, or delete the whole account and its data in the app.
Ask the same questions of any device or app: where is audio stored and processed, who are the AI subprocessors, is content used for training, can an admin control accounts, and can you delete data and prove it. Prefer a business plan where the company, not the employee, owns the account. For transcription accuracy with Singapore accents and Singlish, see our guide to AI transcription for Singlish meetings.
A short consent script for meetings
Staff are far more likely to ask if they have words ready. Adapt this and put it on a card or in your meeting checklist.
In the invite
"With your agreement, we'd like to record this meeting on an AI note-taking device so we can prepare accurate minutes and action items. Let us know if you'd prefer we don't."
Before pressing record
"Is everyone okay if I record this for our notes? It's processed by [vendor] to produce a transcript, only our project team sees it, and we delete the audio after [30] days."
Get a clear yes on the recording
Start recording, then say: "Just to confirm on the recording, everyone has agreed." Pause for replies.
Respect a no, or a partial no
Switch off, or pause for sensitive parts. Take written notes instead. Never record secretly.
New people joining
Repeat the notice when someone joins late, and pause recording until they agree.
Mention it again in your minutes: "Recorded with participants' agreement; audio deleted on [date]."
When not to record at all
Some conversations carry too much risk for a convenience tool. As a rule, don't record:
Don't record
The same applies to software meeting bots; our guide to AI meeting notes tools and the PDPA covers Teams, Zoom and bots that join calls automatically.
Retention and access: a rule that works
Raw audio is the riskiest part: it holds everything said, including side remarks. The transcript and approved minutes are usually all you need.
- Keep raw audio for a short, fixed period, for example 30 days, then delete it in the app.
- Keep the approved summary or minutes as your record, in your normal document system.
- Share summaries, not audio, with people outside the project team.
- Turn on MFA for the recorder's app account and use a company email to sign up.
- When a staff member leaves, transfer or delete their recordings and unbind their device.
Write the rule into your AI policy. Our ChatGPT at work policy guide and IT security policy template both have a section you can extend.
Do it yourself or get help?
A small team can adopt recorders safely with three things: an agreed consent script, a company-owned account, and a retention rule. The harder parts are checking vendor terms for transfer and training, and updating your PDPA notices and policies.
Our Security Awareness Training (S$390) covers safe AI tool use, including recorders, with a staff session. Our PDPA Compliance Pack (S$690) updates your notices, retention schedule and data inventory to include recordings.
Frequently asked questions
Recording is not banned, but if the recording identifies people, the PDPA applies to your organisation. You need to tell people the purpose and get their consent unless an exception or deemed consent applies, protect the recording, and delete it when no longer needed. Other obligations, such as confidentiality agreements, may also apply. This is not legal advice.
It can be. The PDPC's Advisory Guidelines on Selected Topics say an audio recording may be personal data if an individual can be identified from it, from their voice alone or together with other information the organisation has. In a business meeting where you know the participants, recordings are almost always personal data.
The PDPC says the PDPA doesn't prescribe a method, but recommends consent that is in writing or recorded for future reference, since you may need to prove it. A line in the calendar invite plus a spoken confirmation at the start of the recording is practical evidence. Note in the minutes that participants agreed.
Plaud's privacy policy, last updated 16 June 2026, says it will not use your content to train its own or third-party AI models without explicit, informed consent, and that its LLM providers are contractually barred from training on submitted content. It stores data in regional data centres including Singapore. Check the current policy before buying.
It's better not to. Recordings made for work are the organisation's responsibility under the PDPA, but a personal account means the company can't control access, retention or deletion, especially when the employee leaves. Provide approved devices on company accounts, or ban personal recorders for work meetings in your policy.