Recording and Transcribing Research Interviews: Consent Requirements Around the World

A researcher in London interviews a participant in Berlin over Zoom. The recording goes to a US-based transcription service. The transcript lives on a Canadian university server.

Four jurisdictions. One consent form. Written for none of them.

This is the reality of modern qualitative research, and it's the reason why consent for research recordings cannot be treated as a local compliance question.

The requirements depend on where each participant is located, where the data travels, how it is stored, and who processes it along the way. Get any one of those wrong, and a legally recorded interview can still become a data protection violation.

In this guide, I'll cover the full picture: the three consent layers every researcher must satisfy, what a consent form must cover, a jurisdiction-by-jurisdiction breakdown of recording law, and a look at what changes once a recording becomes a transcript.

Why researchers face a different consent standard

Recording consent law applies to everyone, but research interviews carry an additional compliance burden that journalists, podcasters, and business teams do not face. Three factors create that difference.

1. IRB requirements

Institutional review boards (IRBs) in the United States and research ethics committees in the UK, EU, Canada, and Australia require documented consent that recording law alone does not mandate.

A researcher in a one-party consent state can legally record without telling anyone, but their IRB will not approve a study where participants were recorded without being informed.

2. Dealing with personally identifiable information (PII)

Research interviews frequently involve sensitive personal data. Health histories, political opinions, religious beliefs, sexual orientation, and experiences of trauma all appear routinely in qualitative interviews.

Under GDPR Article 9 and its equivalents in most national frameworks, this "special category" data triggers a higher standard of consent and additional safeguards, regardless of what local recording law allows.

3. What happens after the recording stops

Recordings do not end at the interview.

They get uploaded to transcription services, coded in qualitative data analysis software, shared with co-investigators, and stored for years.

Each step creates a new data processing event that must have been covered in the original consent.

If a participant agreed to be recorded but was never told the recording would be uploaded to a cloud transcription platform, the researcher may be in breach of their consent terms even if local recording law was satisfied.

A revision of the Common Rule (45 CFR 46) reinforced this by expanding requirements for how consent forms describe data handling and storage, including requirements around the storage, maintenance, and secondary use of identifiable private information.

GDPR Article 89 requires researchers to apply safeguards (such as data minimization and pseudonymization) where possible.

Once those safeguards are in place, member state or EU law can use them as the basis for limiting certain data subject rights, such as the right to access, correct, or object to one's data, specifically for research purposes.

But it does not relax the consent or lawful basis requirements for processing in the first place.

The three consent layers every researcher must satisfy

Before getting into jurisdictions, let’s understand the structure of consent obligations for research recording. There are three distinct layers, each governed by a different body.

Satisfying one layer does not satisfy the others. A researcher in a one-party consent US state who records without telling the participant has complied with local recording law but has likely violated their IRB approval and may have breached GDPR if the participant is an EU resident.

The consent form that passes IRB review must also meet the disclosure requirements of the data protection framework that applies to the participants.

In practice, researchers who build their consent process around the most demanding applicable framework, like GDPR or their institutional ethics board requirements, will usually satisfy the other layers automatically.

What a consent form must cover for research recordings

A valid consent form or verbal consent script for research recording needs to address eight things. The specifics will vary by jurisdiction and study design, but none of these elements should be missing.

1. Purpose of the study and the recording

Participants need to know why the study is happening and why the conversation is being recorded, not just that it's for research purposes. A concrete statement, such as "this will be used to produce an accurate transcript for analysis," gives them something real to base their consent on.

2. Who will access the recording

Name the specific individuals or roles that will hear the audio, e.g., the principal investigator, co-investigators, or a research assistant. If anyone outside the core research team will have access, state that as well.

3. Transcription process

If the recording will be transcribed, you must inform the participant. If transcription will be handled by a third-party service or a cloud-based AI tool, that must be disclosed.

Researchers can follow a clear framing like this:

"The recording will be transcribed using [tool/service], which operates under [GDPR/SOC 2 Type II/relevant framework] compliance standards. The transcript will be accessible only to [named individuals]."

4. Storage location, country, and retention period

Where the data lives matters legally, particularly for EU residents. Specify the country, the platform, and how long the data will be retained. This does not need to be a technical document, but it needs to be honest and specific.

5. Anonymization method

Will names be replaced with codes or pseudonyms in the transcript? Will the recording be deleted once the transcript is verified? Participants should know what steps will be taken to protect their identifiability.

6. Right to withdraw

Participants must be told they can withdraw consent at any time, including after the interview, and what that means in practice: whether they can request deletion of the recording, the transcript, or both.

7. Publication and quotation

If verbatim quotes from the transcript may appear in publications, reports, or presentations, this must be stated in the consent form, along with whether those quotes will be attributed or anonymized.

8. Contact for questions

Add a named individual or institutional contact through whom participants can exercise their data subject rights (access, correction, deletion) or raise concerns.

Recording consent laws by region: What researchers need to know

The EU and GDPR

GDPR is the dominant data protection framework for researchers working with EU or EEA participants, regardless of where the researcher is based. If the participant is in Germany, France, or any other EEA country, GDPR governs how their data is handled even if the researcher is in the US or Australia.

The lawful basis most researchers use is consent under Article 6(1)(a), supplemented by explicit consent under Article 9(2)(a) for special category data.

Some institutions use legitimate interest or the research exemption under Article 89, but both require documentation and ongoing justification. The safest approach is to obtain clear, informed consent and document it.

Since GDPR came into force in 2018, regulators have issued over €7.1 billion in cumulative fines, with approximately €1.2 billion issued in 2025 alone, broadly matching 2024's total, according to the DLA Piper GDPR Fines and Data Breach Survey (January 2026).

Enforcement remains active across Europe, with regulators continuing to issue substantial penalties year over year.

The United States

Regarding recording consent in the US, federal law sets a one-party consent baseline under the Electronic Communications Privacy Act. It means a researcher can legally record a conversation they are part of without notifying the participant.

However, IRB approval for most federally funded research requires informed consent that covers recording, and 12 states impose all-party consent requirements.

Oregon separately applies all-party rules to in-person conversations only, while treating electronic recordings under the one-party standard.

Cross-border and online interviews

When the researcher and participant are in different countries or states, the safest practice is to follow whichever rule is stricter, even though no single law always settles the question.

For instance, a researcher based in New York interviewing a participant in California should follow California's all-party consent requirement.

The same logic applies internationally: a researcher anywhere in the world who interviews an EU resident must comply with GDPR because GDPR's protections follow the participant's location, not the researcher's.

Online and remote research interviews: Additional considerations

The shift to remote qualitative research over the past several years has created consent complexities that in-person research did not face. Three deserve specific attention.

Platform-level vs. researcher-controlled recording

When a researcher uses a platform's built-in recorder (such as Zoom's local recording or Teams' in-meeting recording), participants usually see a visual notification on screen.

When a researcher records using a separate tool or a bot-free recorder, no such notification appears.

Consent must explicitly cover the recording method being used, not just the fact that recording will happen.

Bot-based AI notetakers

If a bot joins the meeting as a participant to handle recording and transcription, this must be disclosed in the consent form and explained in the ethics application.

Some participants object to visible bots, particularly in sensitive research contexts.

Bot-free recording options allow researchers to capture audio without adding a visible participant to the call.

But the use of any recording tool still needs to be disclosed to participants before the interview begins.

Cross-border online interviews

A UK researcher running Zoom interviews with participants across the EU, North America, and Australia in a single study is managing potentially four or five different consent frameworks simultaneously.

The practical approach is to identify the strictest applicable rule for each jurisdiction and build a consent form that satisfies all of them.

For most international research teams, this means designing to GDPR standards as a baseline.

Sending recordings to a transcription service: What are your compliance obligations?

Uploading a recording to a cloud transcription service is a separate data processing event, and it needs to have been covered in the original consent.

Under GDPR Article 4(8), any organization that processes personal data on behalf of a data controller is a data processor. A transcription service that receives, stores, and processes a research recording is acting as a data processor.

Two compliance obligations follow from this:

1. The researcher (as data controller) needs a Data Processing Agreement (DPA) with the transcription service. IRBs and ethics committees at EU-affiliated institutions require evidence of this agreement in research ethics applications. Researchers should check whether their transcription service can provide a DPA before submitting an ethics application that names it.

2. The participant's consent form must explicitly cover transcription by a third party. If the form says only "the recording will be heard by the research team," using a cloud service without further disclosure may breach the consent terms, regardless of whether local recording laws were satisfied.

AI-generated transcripts are also personal data if they contain identifiable information, which most research interview transcripts do.

The same protection obligations that apply to the recording apply to the transcript, including storage location, access controls, and retention limits.

What about storage location?

Storage location is a separate issue under GDPR. Transfers of EU participant data outside the EEA require a valid transfer mechanism, such as a European Commission adequacy decision or standard contractual clauses.

Researchers should verify what transfer mechanism their transcription service relies on before using it for EU participant interviews.

Special cases that change your consent obligations

The following research contexts require more than standard consent.

Vulnerable populations

Research involving children, prisoners, or people with cognitive impairments requires additional consent layers.

The applicable test for in-person research interviews is whether the participant has sufficient capacity to understand and freely consent, a judgment that IRBs and ethics committees assess in their approval criteria.

Where capacity is in doubt, or the participant is clearly a minor, guardian or next-of-kin consent is required.

GDPR Article 8 sets age thresholds for self-consent, but only for information society services (online platforms and apps), not for research interviews. As a reference point, Germany sets the threshold at 16; the UK, Denmark, and several others have set it at 13.

Special category data

If the interview covers health, ethnicity, religion, sexual orientation, political opinions, or biometric data, GDPR Article 9 requires explicit consent, which is a higher standard than standard consent under Article 6.

Criminal records and convictions fall under the separate Article 10 regime, which also requires additional safeguards.

Explicit consent means the participant has been specifically informed about the sensitive nature of the data and has given a clear affirmative agreement to its processing. A generic consent form that covers the study broadly is not sufficient.

Focus groups and multi-participant interviews

Every participant requires individual consent. Confidentiality within the group cannot be guaranteed by the researcher because other participants may disclose what was discussed.

Consent forms for focus groups should acknowledge this explicitly and invite participants to consider what they share accordingly.

Longitudinal and multi-stage research

Participants who consent at the start of a study need to be re-consented if the scope of data use changes, if new researchers join the team with access to recordings, or if the originally stated retention period needs to be extended.

Close the consent gaps before data collection starts

Consent requirements for research recordings vary by jurisdiction, but the structure is consistent everywhere: local recording law sets the floor, data protection regulation governs what happens to the file afterward, and your IRB or ethics committee ties both together through the consent form.

The details that create compliance problems tend to be operational, not jurisdictional: a transcription service that cannot provide a DPA, a consent form that covers recording but not storage, or a retention period that was never stated.

These are easy to close at the planning stage but costly to address once data collection has begun.

Map the full lifecycle of your recording before drafting your consent form. Everything else follows from that.