Reviewed and fact-checked: 21 July 2026.
An ordinary meeting can unexpectedly reveal health information, ethnicity, religion, trade-union membership, sexual orientation or another protected characteristic. Once an AI system transcribes, summarises, classifies or infers that information, the organisation may be processing special category data under UK data-protection law.
This guide explains the extra governance questions organisations should ask before using AI transcription with particularly sensitive personal information. It is general information, not legal advice.
Quick verdict: identifying a normal lawful basis is not enough. Organisations generally need both an Article 6 lawful basis and a separate Article 9 condition, documented before processing begins. High-risk use may also require a DPIA, stronger supplier controls and an appropriate policy document.
Commercial disclosure: NERALVO sells the Halo AI voice recorder. The legal and governance duties described here apply to the complete recording, app, AI supplier and export workflow—not merely the hardware.
What counts as special category data?
UK data-protection rules give additional protection to personal information revealing or concerning:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade-union membership
- Genetic data
- Biometric data used for identification
- Health
- Sex life
- Sexual orientation
Special category data can be factual or inferred. An AI tool that labels a speaker as anxious, disabled, politically aligned or likely to hold a particular belief may create sensitive inferences even when nobody stated them directly.
Official source: ICO guidance on special category data.
Recording creates several separate processing activities
Do not assess only the moment of capture. A typical workflow can involve:
- Recording identifiable voices
- Uploading or syncing audio
- Creating a transcript
- Generating a summary or action list
- Searching or classifying the content
- Inferring characteristics or risk
- Sharing exports
- Retaining audio, text and backups
Each stage should be covered by the defined purpose, lawful basis, Article 9 condition, transparency information and supplier arrangements.
Identify the Article 6 basis and Article 9 condition separately
The ICO states that organisations processing special category data must identify both:
- A lawful basis under Article 6 of the UK GDPR; and
- A separate condition under Article 9.
These do not have to be linked, but both should be selected and documented before processing starts. Some Article 9 conditions require a basis in UK law and additional safeguards under the Data Protection Act 2018.
Official source: ICO rules on processing special category data.
Do not default automatically to consent
Explicit consent is one Article 9 condition, but it is not automatically appropriate. In employment, healthcare, education, care and other settings involving power imbalance, consent may not be freely given. Another condition may apply, or the processing may not be justified at all.
Where explicit consent is relied upon, it should be specific, informed, unambiguous and expressly confirmed in words referring to the sensitive information and purpose. The organisation also needs a practical process for withdrawal and its consequences.
Apply a strict necessity test
For many Article 9 conditions, processing must be necessary for a specific purpose. “Useful,” “convenient” or “standard practice” is not enough. Ask:
- Could accurate written notes achieve the same result?
- Could only one section be recorded?
- Could sensitive details be excluded before AI processing?
- Could the final record contain a summary rather than full verbatim text?
- Could identifiers be separated from the transcript?
The ICO explains that processing should be targeted and proportionate and that a less intrusive method may defeat a claim of necessity.
Decide whether a DPIA is required
A data-protection impact assessment is required where processing is likely to result in high risk to people. Special-category recording is more likely to require one, particularly where use includes systematic monitoring, vulnerable people, large-scale processing, new technology, profiling, workplace decisions or combining datasets.
The DPIA should cover:
- Purpose and necessity
- People and data categories
- Device, app, supplier and subprocessors
- International transfers
- Accuracy and inference risks
- Access, security and incident handling
- Retention and deletion
- Rights and safeguards
- Residual risk and approval
Check whether an appropriate policy document is needed
Some Data Protection Act 2018 Schedule 1 conditions require an appropriate policy document. This normally explains compliance with the data-protection principles and retention and deletion arrangements. Do not assume a general privacy policy satisfies this requirement.
Control sensitive inferences
Transcription and summarisation should not quietly expand into emotion recognition, health prediction, political profiling, credibility scoring or employee-risk ranking. These uses may create new special-category data, inaccurate assumptions and unfair automated decisions.
Define prohibited uses and disable optional features that do not serve the approved purpose.
Choose an approved supplier
Before uploading sensitive audio, assess:
- Controller and processor roles
- Contract terms and confidentiality
- Subprocessors and processing locations
- International transfer safeguards
- Whether customer content trains models
- Authentication and role-based access
- Encryption and security evidence
- Incident notification
- Deletion, backups and account closure
- Support for access, correction and restriction requests
A consumer account may not provide the controls required for professional, clinical, legal or employment information.
Use stronger accuracy controls
Errors involving health, union membership, allegations or protected characteristics can cause serious harm. Verify:
- Names and speaker labels
- Medical terms, medicines and dates
- Whether a statement was fact, allegation or opinion
- Negative wording such as “does not have”
- Uncertainty and qualifications
- Whether the AI inferred information not actually stated
Do not use an unchecked transcript or summary to make employment, care, insurance, legal or access decisions.
Restrict access by record type
Different people may need different records:
- Raw audio: smallest authorised verification group
- Draft transcript: trained reviewers
- Approved note: relevant operational team
- Aggregated themes: wider management audience where justified
Do not grant broad access merely because storage is convenient.
Set separate retention periods
Raw audio may be needed only until verification is complete. Draft transcripts may have an even shorter purpose. The approved record may follow a longer professional schedule. Include app trash folders, downloads, emails, shared links and backups.
Using NERALVO Halo in sensitive workflows
NERALVO Halo is an ultra-slim AI voice recorder with NOTE mode, CALL mode for supported and permitted calls, 64GB local storage, up to 35 hours of recording and Bluetooth connection to the DOWAY app. DOWAY can generate transcripts, summaries, templates, translations, mind maps and exports, with one year of DOWAY Max included.
Halo is a general recording tool. It does not select the lawful basis, Article 9 condition, supplier controls or retention schedule. Organisations should assess the Halo, DOWAY, paired phone, user account and export destinations together before recording special-category information.
Decision checklist
- Specific purpose documented
- Less intrusive alternatives tested
- Article 6 basis selected
- Article 9 condition selected
- Schedule 1 safeguards checked
- DPIA decision recorded
- Appropriate policy document considered
- Supplier and transfers assessed
- Inferences and automated decisions controlled
- Human verification assigned
- Access and retention restricted
- Rights and incident process confirmed
Frequently asked questions
Is every voice recording biometric data?
No. Voice information becomes special-category biometric data where it is processed through specific technical means for uniquely identifying a person. The recording may still contain other personal and special-category information.
Does removing names solve the issue?
Not necessarily. Roles, events, locations and the voice itself may still identify people.
Can explicit consent make any sensitive recording acceptable?
No. The processing must still be fair, transparent, secure, purpose-limited and compliant with all other duties.
Can AI analyse emotion or health from speech?
Technical capability does not establish a lawful or fair purpose. Such inference requires separate assessment and may be prohibited by policy or law.
Use a higher standard before sensitive data enters AI
Special-category transcription should be exceptional, purpose-led and tightly controlled. The strongest safeguard is often reducing what is recorded, which AI outputs are created and how long the sensitive material exists.
Ready to capture meetings properly?
View the NERALVO Halo AI voice recorder with 64GB local storage, meeting capture, compatible phone-call recording workflows and one year of DOWAY Max included.
View NERALVO Halo