Key takeaways
- No transcription service is compliant by default. A "GDPR compliant" label is a vendor's claim, and compliance depends on the contract and on how you use the service.
- Five things decide it: a processor contract (Article 28), where the audio is processed (Chapter V), whether the vendor trains on your recordings, how long audio and transcripts are kept, and security (Article 32).
- The more sensitive the audio, the more it pays to choose EU hosting or a speech model on your own servers. Health data is special category data under Article 9.
What makes transcription GDPR compliant?
A transcription service supports GDPR compliance when its contracts and settings fit your lawful purpose. Check the Article 28 processor agreement, training policy, retention, access and transfers before sending recordings. EU hosting helps with location requirements, but it does not replace those checks or your responsibility for the recording.
Six questions to ask any transcription service
| Question | What a good answer looks like | GDPR basis |
|---|---|---|
| Will you sign a data processing agreement? | Yes, covering instructions, sub-processors, security, deletion and audits. | Article 28(3) |
| Where is the audio processed and stored? | In the EU or EEA, or a transfer with a legal mechanism: an adequacy decision, certification under the EU–US Data Privacy Framework, or standard contractual clauses. | Chapter V, Articles 44 to 46 |
| Do you use our recordings to train models? | No, or only with our explicit opt-in. | Article 5(1)(b), Article 28(3)(a) |
| How long do you keep audio and transcripts, and can we delete on demand? | Short, configurable retention and a deletion mechanism, confirmed in writing. | Article 5(1)(e), Article 17 |
| Who are your sub-processors? | A published list, with notice before it changes. | Article 28(2) and 28(4) |
| How is the data secured? | Encryption in transit and at rest, access controls and logging. | Article 32 |
Which type of service fits which case
| Type of service | Where it fits | Main thing to check |
|---|---|---|
| EU-hosted transcription service | Everyday business recordings | The contract, the sub-processors and any training use |
| Global service with an EU region | Teams already using the vendor | That the EU setting covers storage and processing, and who has support access |
| Service outside the EU | Low-sensitivity audio only | The transfer mechanism and whether the vendor's certification is current |
| Speech model on your own servers or in your EU cloud account | Health, legal, HR or confidential recordings, and high volumes | Who runs, patches and monitors it |
For the most sensitive audio, running the speech model on your own infrastructure removes the transfer and sub-processor questions, at the cost of operating it. Our guides on on-prem versus cloud speech-to-text and on medical speech-to-text go deeper on both options.
What you still owe, whichever service you pick
- Tell the people being recorded that a service transcribes the audio, who runs it and how long it is kept (Articles 13 and 14).
- Choose and document a lawful basis for the recording (Article 6), and an Article 9 condition if it contains health data.
- Run a data protection impact assessment where you record at scale or process special category data (Article 35).
- Sign the processor agreement before the first upload, not after.
Tell us your recording volume, languages and data requirements. We can scope EU-hosted or on-premises transcription with retention and review controls.
Scope your transcription pipelineFAQ
Is there a GDPR certificate for transcription services?
The GDPR provides for certification (Article 42), but a vendor's "GDPR compliant" badge is usually self-declared. Treat it as a claim and check the contract, hosting and retention terms yourself.
Can I use a US transcription service under the GDPR?
Yes, if the transfer has a legal mechanism: the vendor is certified under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), or you rely on standard contractual clauses. Check that the certification is current and that the framework remains in force, and for sensitive audio consider EU hosting.
Is a recording of a call personal data?
Yes. A person's voice and what they say relate to an identifiable person, so the GDPR applies to both the audio and the transcript.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 5, 6, 9, 13, 14, 17, 28, 32, 35, 42 and 44 to 46, Official Journal of the EU
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU–US Data Privacy Framework
- European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR
About the author
Erik Salo Akimov · Co-founder · Engineering
Erik runs engineering at ESADEX. He designs the platforms, infrastructure and security controls that sit behind client systems.
