Short answer first: a recording of your lecture, the transcript made from it and the notes generated off that transcript are all personal data. GDPR gives you three practical rights over them. You can ask for a copy, you can ask for them to be deleted, and you can ask for them in a format you can take somewhere else. The organisation has one month to reply and cannot charge you for it.
The part most people get wrong is not the rights. It is what the rights do not cover, and what the phrase "EU-based" actually means when you read it in a privacy policy.
Whose data is in a lecture recording?
There are usually three sets of people in one file:
- You. Mostly your account details and how you use the tool.
- The lecturer. Their voice and their teaching material.
- Your classmates. Anyone who asked a question from the floor.
Record for your own study and keep the file to yourself, and the law leaves you alone. The Data Protection Commission describes the household exemption as covering personal data "kept by an individual and is concerned solely with the management of his/her personal, family or household affairs or kept by an individual for recreational purposes".
Read the condition attached to it, because that is the bit that bites. The exemption holds only as long as the data is "not used in connection with a professional or commercial activity or made publicly available". Courts read it narrowly. Post the recording in a class WhatsApp group of two hundred people and you have made it publicly available.
So the rule you can act on is simple. Your own drive, yes. Anyone else's, no.
What do Irish universities require before you press record?
Stricter rules than GDPR, and they differ by university. At University College Cork you must ask first. Students "may request advance permission from teaching staff to record teaching if the recording is to be used solely for the purposes of studying, revising, and exam preparation purposes", and the request "must be made in writing to staff before commencing recording". Covert recording is "strictly prohibited", circulating a recording needs the lecturer's written permission, and breaches go to the Deputy President and Registrar.
Trinity comes at it from the other direction. Its policy governs the recordings staff make available to you through Blackboard Ultra, and says those are not a substitute for attending.
If you record because of a disability, UCD sets out the conditions in a code of practice you sign. A recording device is recommended there as a reasonable accommodation, on these terms:
- Personal use only. Recordings "must only be for personal use and for the purpose of completing the Higher Education course for which you are registered".
- No sharing, at all. They must not be "shared with any third party under any circumstances", and that includes copying, lending or making a recording available to the public.
- Keep them secure. You have to "take necessary precautions to secure any recordings made against unlawful usage by another person".
- Breaches are disciplinary. A breach goes before the Registrar or a nominee under the UCD Student Code.
Check your own institution before the first lecture of term. We go through the policies side by side in can you record lectures in Ireland, and what the university records for you is covered in lecture capture at Irish universities.
What are the three rights worth knowing?
- Access, under Article 15. Ask any organisation for a copy of the personal data it holds about you, plus what it does with that data and who it goes to.
- Erasure, under Article 17. The right people call being forgotten, and it is not absolute. Article 17(3) lists the exceptions, including freedom of expression and information, a legal obligation, archiving in the public interest, scientific or historical research, and legal claims.
- Portability, under Article 20. Narrower than most people assume. It covers data you supplied yourself, processed automatically, on the basis of consent or a contract. Having it sent straight to another provider applies only "where technically feasible".
Name the right you are using when you write. A request that says "Article 15 access request" is harder to lose than one that says "can I have my stuff".
How long do they have to reply, and what does it cost?
Article 12(3) gives the organisation one month from receipt to respond "without undue delay". They can take two further months for genuinely complex requests, but they have to tell you inside the first month and say why. Article 12(5) makes all of it free. They can charge a fee or refuse only where a request is manifestly unfounded or excessive, and it is on them to prove that, not on you. One caveat: Article 15(3) lets them charge administrative costs for further copies, so the first copy is the free one.
To keep the clock on your side:
- Send the request by email, so the date of receipt is not in doubt.
- Say which right you are exercising and which data you mean: the recordings, the transcripts, the notes, the account logs.
- Diary the date one month out.
- If nothing arrives, reply on that thread and ask them to confirm the date they received it.
Can you ask for your exam script?
Yes, and the point was settled through the Irish system. Peter Nowak was a trainee accountant sitting exams set by the Institute of Chartered Accountants in Ireland. He failed one, made an access request, and was refused on the basis that the script was not his personal data. The Irish Data Protection Commissioner did not uphold his complaint. The case went up through the Irish courts to the Court of Justice of the European Union, which held on 20 December 2017 that a candidate's written answers, and the examiner's comments on them, are the candidate's personal data.
Useful to know before you accept a refusal on principle. Useful too to know its limits. Access gives you your data, not the original document in its original form, and it is not a route to changing a mark. If you think a grade is wrong, that is an appeal, and it runs on a much shorter deadline than a data request.
What does "EU" mean in a privacy policy?
Where your files are stored and where they are processed are two different questions. A tool can keep your recordings and notes on servers inside the EU and still send the audio to a speech-to-text provider in the United States, because many of the strongest ones are there. Both sentences can be true at once. "Your data is stored in the EU" is not a promise that your audio never leaves it.
Sending personal data to the US is lawful, by one of two routes:
- The EU-US Data Privacy Framework. An adequacy decision the European Commission adopted in July 2023, covering US companies that certify under it.
- Standard Contractual Clauses. Backed by a documented assessment of the destination country's law.
Neither is a loophole, and neither is permanent. Two earlier arrangements were struck down by the Court of Justice, Safe Harbour in October 2015 and Privacy Shield in July 2020, and both cases came through the Irish courts and the Irish Data Protection Commissioner. The current framework is in force today. It survived a challenge that the General Court dismissed in September 2025, and that ruling is under appeal.
So do not ask whether a tool is European. Ask where the audio goes, and see whether it will tell you. If you are still choosing, we compared the main options on exactly that point in the best note-taking app for students in Ireland.
What to check before you upload a term of lectures
Article 13 requires a controller to tell you certain things when it collects your data. If they are missing from the privacy policy, that is a gap, not a style choice. Look for:
- Who the controller is. A company name and an address, not just a product name.
- Recipients, or categories of recipients. The good version is a named list of sub-processors you can read.
- Transfers outside the EU and the safeguard used. Article 13(1)(f) requires the safeguards and how to get a copy of them.
- How long they keep it. Article 13(2)(a) requires the retention period, or the criteria used to set it.
- Your right to complain to a supervisory authority.
Two more are not legal requirements but tell you a great deal:
- Is there an export button and a delete button in the product? A right you have to send an email about is worth less than a control you can click on a Tuesday night.
- Does it say, provider by provider, whether your content trains models? "We never train on your data" is an easy sentence to write and a hard one to keep, because the audio passes through companies the tool does not own. A policy that names each provider and says what each one is contractually allowed to do is the more honest document, and the one to trust.
What if they ignore you?
The Data Protection Commission expects two steps, in order:
- Raise it with the organisation first, in writing, and keep the correspondence.
- If you are unhappy with the outcome, bring it to the DPC through the form at forms.dataprotection.ie/contact. It costs nothing.
You would not be alone. The DPC's 2025 annual report records 16,160 new cases from individuals, a 45 per cent rise on 2024, with 11,734 concluded during the year. Access requests were the largest complaint category at 42 per cent, ahead of erasure at 17 per cent and fair processing at 16 per cent. Access has topped the list year after year, and a missed deadline is one of the main reasons complaints land there. You are not being awkward by chasing one.
What does your university hold about you?
More than any study app does. Your CAO route in, your continuous assessment marks, your repeats, your attendance, your disability service accommodations, your fees. All of it is personal data. Universities are public bodies, so they have to appoint a data protection officer and publish the contact details. UCD, DCU and University of Galway each do, and so does yours.
Three things to do with that, none of which require you to become a lawyer. Read the transfers section and the retention section of any tool before you trust it with a full term of lectures. Ask your lecturer before you record, because the university rules are stricter than GDPR is. And when a module ends, delete what you no longer need, instead of leaving four years of audio in an account you stopped thinking about in second year.
Where Notibo fits
Notibo is an example of the storage and processing split rather than an exception to it. Your account, recordings and notes are stored in the EU. The audio goes to speech-to-text providers in the United States, the AI notes are generated by a US provider, and the site is hosted in the US, all under the European Commission's Standard Contractual Clauses. Our privacy policy names each provider, so you can run it through the checklist above the same way you would run any other tool through it.