This 30-question checklist helps organisations test an AI voice-recording workflow before deployment. It is designed to expose unclear purpose, excessive collection, weak supplier controls and missing deletion processes.
Answer each question yes, partly or no. A “no” on purpose, authority, participant information, sensitive data, security or deletion should stop deployment until the control is resolved. Check current ICO guidance and obtain professional advice for high-risk uses.
1. Purpose and necessity
- Can we describe the recording purpose in one precise sentence?
- Is recording necessary, rather than merely convenient?
- Have we considered a less intrusive alternative such as agreed written notes?
- Will the recording be used only for the stated purpose?
- Have we identified the final authoritative record the audio will support?
2. Authority and people
- Has the correct organisational owner approved the use case?
- Have we assessed the appropriate lawful and policy basis?
- Will every participant receive clear information before recording?
- Can late joiners, remote participants and bystanders be handled properly?
- Is there a fair alternative when someone declines or objects?
3. Data and sensitivity
- Can we limit capture to the relevant part of the conversation?
- Will passwords, payment details and security answers be excluded?
- Could the meeting include health, employment, legal, financial or criminal-offence information?
- Have additional conditions and safeguards been assessed for sensitive data?
- Has the need for a data-protection impact assessment been recorded?
4. Device, app and supplier
- Do we know every location where audio, transcripts and exports are stored?
- Is the device protected against loss, unauthorised access and accidental sharing?
- Is the processing account an approved business account rather than a personal one?
- Have supplier contracts, security, subprocessors and data locations been reviewed?
- Have we tested whether deletion removes local, cloud and exported copies as expected?
5. Accuracy, access and sharing
- Is a named person responsible for checking names, dates, figures and speaker labels?
- Are proposals, reports, objections and final decisions kept distinct?
- Can people access only the audio or output needed for their role?
- Are public links, uncontrolled attachments and unnecessary downloads prevented?
- Can the organisation handle access, correction, objection, restriction, erasure and complaint requests where applicable?
6. Retention, deletion and accountability
- Are separate retention periods defined for raw audio, working transcript and final record?
- Is the event that starts each retention period clear?
- Is one owner responsible for deletion and evidence of completion?
- Are backups, legal holds and exported copies included in the process?
- Will the workflow be reviewed after incidents, complaints, supplier changes or new uses?
How to score the checklist
| Result | Meaning |
|---|---|
| Green | All material questions are answered yes and evidence exists. |
| Amber | Some controls are partial; restrict the pilot and assign owners before wider use. |
| Red | A core purpose, authority, transparency, sensitive-data, security or deletion control is missing. |
A checklist score is not legal approval. Keep the evidence behind each answer, including policy, supplier review, DPIA decision, participant wording, retention schedule and test results.
How NERALVO Halo may fit the assessment
NERALVO Halo provides NOTE recording, supported CALL capture, 64GB local storage, up to 35 hours of recording and Bluetooth sync with DOWAY. DOWAY can create transcripts and structured outputs, with one year of DOWAY Max included from activation.
Evaluate the complete Halo-to-DOWAY workflow, not only the physical recorder. Device, account, processing, export and deletion controls all form part of the privacy assessment.
Official ICO guidance
- Data protection impact assessments
- Integrity and confidentiality (security)
- Storage limitation and retention
The checklist contains exactly 30 questions, each linked to an operational control that can be evidenced and reviewed.
Ready to capture meetings properly?
View the NERALVO Halo AI voice recorder with 64GB local storage, meeting capture, compatible phone-call recording workflows and one year of DOWAY Max included.
View NERALVO Halo