Video meeting tools and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 9 min read
Every video meeting carries personal data: names, email addresses, faces and voices, chat messages, and, when you record, a full copy of all of it. Under India’s DPDP Act, your business is the Data Fiduciary for what you record and keep, and Zoom, Microsoft or Google is your Data Processor. Zoom and Microsoft Teams offer India data regions; Google Meet’s recordings follow Google Workspace’s US or Europe regions. Tell people before you record, and delete recordings once their purpose is over.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
You review a loan file with a client on Zoom, interview a candidate on Teams, or walk a customer through their account on Google Meet. Someone presses record so the team can refer back later. The recording sits in the cloud with the client’s face, voice and whatever was on the shared screen, and nobody decides when it goes. With the DPDP Act’s full obligations applying from 13 May 2027, meetings and recordings are worth treating like any other store of customer data.
Is any video meeting tool “DPDP-compliant”?
No meeting tool makes you compliant: the DPDP Act puts the duties on your business, not on the software
You decide why a meeting is recorded, what’s kept and who sees it, which makes you the Data Fiduciary. The meeting provider carries and stores that data on your instructions, which makes it your Data Processor. The Act requires a valid contract with any processor you use (Section 8), and you stay answerable for the data either way.
What matters is how you use the tool: whether people know they’re being recorded and why, who can open the recordings, and when they’re deleted. The differences below are about where each tool stores your data and what it gives you to manage recordings.
What personal data flows through a video meeting?
A meeting collects more than the agenda, and a recording keeps all of it
In normal use, a meeting tool handles:
- Participant details: names, email addresses and phone numbers from invites, sign-ins and dial-ins, plus attendance records of who joined and when.
- Video and audio: faces, voices and backgrounds. A recording turns a passing conversation into a stored file.
- Shared screens: whatever is on screen during a share, which is often a customer record, a spreadsheet or an ID document.
- Chat and files: messages and files exchanged in the meeting chat.
- Transcripts and AI notes: written records of everything said, generated automatically if these features are on.
- Your own staff: the same data about your employees. The Act lets you process employee data for employment purposes without separate consent (Section 7(i)), but recordings of staff still need security and deletion.
What DPDP duties do your meetings create?
Recording is where most of the duties start
- Notice before you record. Tell participants that the meeting will be recorded, why, and how long the recording will be kept (Section 5). A line in the invite and a reminder at the start of the call both help.
- Consent where you need it. If you record a customer or a prospect for anything beyond the meeting itself, such as training or marketing, ask for their consent to that purpose (Section 6).
- Purpose limits. A recording made to note what a client agreed is for that. Reusing it in a sales demo or a training session needs its own basis.
- Deletion on time. Recordings, transcripts and chat logs pile up across accounts. Once the purpose is over, they have to be deleted (Section 8).
- Security. Who can open recordings, whether links can be shared outside your organisation, and whether meetings have passcodes or waiting rooms are all part of protecting the data.
- Rights requests. A customer can ask for a copy of what you hold, including a recording of them, or ask you to delete it. Know where each recording lives.
- Breaches. A recording link shared publicly, or an uninvited person in a client meeting, can be a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each tool store your data?
Zoom and Microsoft Teams offer India data regions; Google Meet’s recordings follow Google Workspace’s US or Europe regions
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your recordings are, because it decides which country’s servers hold your clients’ faces and voices.
| Tool | India data centre? | How the region is set |
|---|---|---|
| Zoom | Yes, India is one of Zoom’s Regional Infrastructure regions; we couldn’t independently verify which plans and services it covers | Ask Zoom which region your account uses |
| Microsoft Teams | Yes, for an India-provisioned account’s chats; recordings are saved to OneDrive and SharePoint | By the country your account was set up in; shown under Data location in the admin center |
| Google Meet | No (recordings are saved to Google Drive, whose data regions are the US or Europe) | A data regions policy in the Google Admin console |
Zoom
Zoom lists India among the regions of its Regional Infrastructure, where hosted customers’ data is processed and stored in the region
Zoom’s regional infrastructure fact sheet, dated May 2026, names Australia, Canada, the European Union, India, Saudi Arabia, Singapore and the United Kingdom, and notes that not all products may be available in each. It also lists data that leaves the region even then, including billing data, the account, user and meeting IDs that run Zoom’s core platform in the United States, and support tickets. We couldn’t independently verify which plans and services the India region covers, so ask Zoom before you rely on it.
Zoom’s help pages say account owners and admins can change the storage location of cloud recordings and other communications content. For deletion, admins and users can set cloud recordings to move to the trash automatically after a set number of days, and recordings in the trash are permanently deleted after 30 days. Zoom also has a recording consent dialogue: participants who don’t accept it aren’t included in the recording.
Microsoft Teams
Teams keeps an India-provisioned account’s chats in India, and saves meeting recordings to OneDrive and SharePoint, which Microsoft also stores in India for those accounts
Microsoft commits to storing Teams chat messages, SharePoint site content and OneDrive files at rest in India if your Microsoft 365 account was provisioned there. Meeting recordings are saved to the organiser’s OneDrive, or for channel meetings to the channel’s SharePoint site, where the same Purview policies and permissions apply as to any other file. Microsoft’s Teams pages note that India data residency for Teams applies to new accounts, and that existing Indian accounts keep Teams data in the Asia Pacific region. The Data location page in the Microsoft 365 admin center shows where yours is.
Admins can turn on a meeting policy that requires participants to give explicit consent before they’re recorded or transcribed. Because recordings live in OneDrive and SharePoint, the retention policies in Microsoft Purview can keep or delete them after a set period along with your other files. Those policies for OneDrive and SharePoint come with Business Premium and the E3 and E5 plans; Business Basic and Business Standard can set retention policies for Teams chats.
Google Meet
Google Meet saves recordings to the organiser’s Google Drive, so they follow Google Workspace’s data regions, which offer the US or Europe
Recordings go to a “Google Meet” folder in the meeting organiser’s Drive. Recording is available on Business Standard, Business Plus, the Enterprise plans and some others, and a Workspace administrator has to allow it first. Google Workspace’s data regions setting offers the United States or Europe, with no India option.
Google says participants get a notification when a recording starts or stops, including people outside your organisation and those who join from a phone. Because recordings are ordinary Drive files, Google Vault’s retention rules, on the plans that include Vault, can keep or delete them after a set period.
How to set up any meeting tool for the DPDP Act
The steps are the same whichever tool you use; only the setting names change
- Find out where your recordings are storedUse the table above, then confirm in your own admin console.
- Decide which meetings get recordedRecord only when there’s a reason, and switch off automatic recording for meetings that don’t need it.
- Tell people before you recordSay in the invite and at the start of the call that the meeting is recorded, why, and for how long.
- Set an expiry for recordingsUse your tool’s retention or expiry settings so recordings, transcripts and chat logs are deleted once their purpose is over. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your meeting tool’s privacy settings, release notes and announcements to see what has changed.
- Limit who can open recordingsKeep recordings shared only with the people who need them, and turn off public or “anyone with the link” sharing.
- Protect client meetingsUse passcodes or waiting rooms, and close other windows before you share your screen.
- Have a process for rights requestsKnow how to find, share and delete one person’s recordings, and who on your team does it.
FAQ
Is Zoom, Microsoft Teams or Google Meet DPDP-compliant?
None of them is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the tool changes is where your data is stored and how much help it gives you with recording notices, retention and access.
Do I need consent to record a meeting with a client?
You need to tell them it’s being recorded and why. If you plan to use the recording for anything beyond the purpose of the meeting, such as training or marketing, ask for their consent to that purpose separately.
Is a meeting recording personal data?
Yes. A recording carries people’s faces, voices and names, and often whatever was on screen. Treat it like any other customer file: protect it, use it only for its purpose, and delete it when that purpose is over.
Do I need a contract with my meeting provider under the DPDP Act?
Yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement with the provider covers processing on your behalf, and keep a copy with your compliance records.
Will my meeting tool add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your meeting tool’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
