Starting an internal podcast: who should be at the table before the first recording?

An internal podcast is a great way to reach employees, keep them informed and give them a platform within the organization.

It is only natural that the creative energy starts flowing at the thought of making good content for your colleagues.

Still, it pays to get a few things in order first. In practice, we often hear remarks like “it isn't secret information, so it doesn't matter much if someone outside the organization listens in.”

That is where it goes wrong. Take the guest's personal data alone. As soon as guests mention their name, hobbies and job title, you are dealing with personal data under the law. And you have to protect it.

That is just one of the things you need to get right.

In this article, we walk you through what to arrange before the first recording, including a handy checklist.

Communications: what do you put in writing as owner?

In a conversation with a communications professional, we heard what preparing an internal podcast looks like in practice. The idea for an internal podcast had been around for a while. Besides good recordings, the organization also had to arrange distribution and restricted access. And before the new tool could go live, the internal reviewers needed to receive the right information.

As owner of the channel, you bring the others to the table. Start by putting your own agreements in writing:

• What is the purpose of the podcast, and which colleagues is it for?
• Which topics stay out of the podcast, such as figures that have not been shared yet or client names?
• Who approves an episode before it goes live?
• What do you do if something slips through anyway: cut a segment or take the episode offline for the time being?

Legal: what do you agree with your guest?

If your organization has a data protection officer (DPO), include them in this conversation. Under the General Data Protection Regulation (GDPR), personal data is any information relating to an identified or identifiable natural person. An episode in which a colleague talks about her work, with her name and job title, therefore contains personal data.

At a minimum, discuss these questions with Legal:

• What agreement do you make with each guest in advance, and how do you record it?
• Who may hear the recording: the whole organization, one department or a smaller group?
• How long does an episode stay available?
• What do you do if a guest wants an episode removed?
• What data about listeners do you process, and for what purpose?

That last question concerns your colleagues as an audience. Anyone who logs in to listen leaves data behind, such as an email address. If the vendor processes personal data on your behalf, the GDPR requires a data processing agreement. Have it in place before your first recording.

IT: who can listen, and does it stay that way?

A single episode may not be secret. But a public podcast feed or a forwarded link can quickly turn an internal message into an external one. IT therefore wants to know how employees get access and how that access ends.

Take these questions to IT:

• How do employees get access, even if they have no company email?
• Can they sign in with single sign-on (SSO) through your own identity provider?
• What happens to access when someone leaves the company or loses a phone?
• Where is the data stored, and what certification does the vendor hold?

Also expect a security questionnaire that IT sends to the vendor. Plan time for it.

HR: what does the podcast mean for colleagues?

Colleagues are both your guests and your listeners. Discuss with HR:

• Which personnel matters stay out of the podcast?
• How do you invite colleagues as guests, so they are free to choose whether to take part?
• Who reports an employee's departure, so IT can revoke access and you know which episodes to review?
• Do you also use the podcast to onboard new colleagues?

Checklist per function

Take this checklist to your conversations. For each function, you see which points to tick off before the first recording.

What you bring to the table with Springcast

With Springcast Mobile you distribute your internal podcast through a restricted-access app. The app works by invitation only. Employees sign in with their email address, which can also be a personal address. That gives colleagues without a company email access too.

This answers the questions IT asks you:

• With the SSO option, employees sign in through your identity provider, without a separate password.
• Through groups, you decide which employee sees which show. In the app, you apply what you agreed with Legal about who may hear a show.
• With SCIM, you manage users and their group membership from your identity provider, and you revoke access there. This works for SSO in the mobile app, with Microsoft as the implementation basis.
• If you remove a device from a profile, that device loses access the next time the app starts.

For Legal and IT, here are the facts:

• Our applications run in the Netherlands, Germany and Finland.
• Video hosting: EU infrastructure.
• ISO/IEC 27001:2022, independently certified by Brand Compliance under RvA accreditation (C 548).
• On request, a compliance officer takes your team through the security questionnaires.

Springcast is the right fit if your internal podcast should reach invited colleagues only, even if they have no company email. That also holds if IT wants to link access to your identity provider: through the SSO option, and through SCIM with Microsoft as the implementation basis.