Is medical speech-to-text GDPR compliant?

Key takeaways

Audio of a consultation and the transcript made from it are health data, a special category under GDPR Article 9.
Care delivery usually relies on Article 9(2)(h), together with an Article 6 basis, and the vendor is normally your processor under Article 28.
A DPIA is required for large-scale processing of health data (Article 35(3)(b)). A single practitioner's own patient records are not treated as large-scale, but check your national authority's list.
Where the speech-to-text runs, how long audio is kept and whether the vendor reuses data for training decide most of the risk.
An AI scribe is speech-to-text plus a language model. Apply the same GDPR checks to both, tell patients before recording and have the clinician review every note.

Can your clinic use medical speech-to-text?

You can use medical speech-to-text under GDPR, but the product name does not establish compliance. Your clinic needs an Article 6 basis, an Article 9 condition, clear patient information and appropriate security. Assess whether a DPIA is required, agree processor terms, and keep clinicians responsible for reviewing notes before they enter the record.

Why consultation audio is special category data

Article 9(1) of the GDPR puts data concerning health in a special category that is prohibited by default. A recording of a consultation contains symptoms, diagnoses, medications and family history spoken aloud, so the audio is health data, and so is the transcript. This holds whichever way the audio is captured, whether the clinician dictates after the visit or a microphone listens during it.

Voice can also be biometric data under Article 9 when it is processed to identify a person uniquely, for example to log in by voiceprint. Separating the clinician's voice from the patient's in a transcript is not the same thing, but do not link voices to identities unless you have a specific reason and a legal basis for it.

What the GDPR requires, in clinic terms

Requirement	GDPR provision	What it means for a clinic
Lawful basis plus a health-data condition	Article 6 and Article 9(2)(h), with 9(3)	Processing for providing care, by or under a professional bound by secrecy. Patient consent is not the usual basis for the care itself.
Tell patients	Articles 13 and 14	Say that AI transcription is used, what is recorded, how long it is kept and who processes it.
Processor contract	Article 28	A written agreement with the vendor covering instructions, security, sub-processors, deletion and audits.
Impact assessment	Article 35	Required for large-scale processing of health data. Group practices, hospitals and platforms usually qualify.
Security	Article 32	Encryption in transit and at rest, access control, logging and a breach process.
Minimisation and storage limits	Article 5(1)(c) and (e)	Collect only what the note needs and delete audio once the note is signed unless there is a reason to keep it.
Accuracy	Article 5(1)(d)	A clinician reviews and signs every note. A wrongly transcribed drug name is a data-quality problem and a patient-safety problem.
Transfers outside the EU	Chapter V	Assess all transfers, including remote support, sub-processors and backups, and use a valid Chapter V mechanism where required.

Recital 91 says patient data processed by an individual physician is not large-scale processing. A solo practice may therefore fall outside the mandatory DPIA trigger, but most supervisory authorities also publish their own list under Article 35(4), so check yours.

Cloud, EU region or on-premises: what changes?

Where it runs	Does audio leave your control?	Main risk	Usually a fit for
Vendor cloud outside the EU	Yes	Transfer rules and foreign-law access to the data	Low-sensitivity use, if at all
Vendor cloud in an EU region	Yes, to the vendor	Vendor access, sub-processors, parent-company jurisdiction	Many clinics, with a solid processor contract
Self-hosted in your own cloud or on-premises	No	You carry the security and the upkeep	Hospitals, public bodies, the most sensitive work

Where can a clinic get a secure, GDPR-compliant AI scribe?

An AI scribe listens to the consultation and drafts the clinical note. It combines speech-to-text with a language model, so the same GDPR rules apply to both steps. You can buy one from a vendor or commission one built to your requirements. In either case, a “GDPR compliant” label proves nothing until the provider answers the eight questions below in writing.

A scribe adds four checks. Tell patients before recording and let them decline (Articles 13 and 14). Treat the draft as a draft, so the clinician reviews and approves every note before it enters the record. Set how long the audio and the draft are kept, and delete the audio once the note is approved if your retention rules allow it. Confirm that the language model that writes the note runs under the same processor contract and in the same location as the transcription.

At ESADEX we build speech-to-text and note-drafting pipelines that run in the EU or on your own servers, and we document the data flows you need for your DPIA.

Eight questions to put to any vendor

Where is audio processed and stored, and in which data centres?
Is any audio or transcript used to train or improve your models, now or later? Is that excluded in the contract?
How long do you keep audio and transcripts, and can we set it to delete after the note is signed?
Who can access our data, and is that access logged?
Which sub-processors do you use, and how do you tell us about changes?
Can you sign an Article 28 agreement and support our DPIA with documentation?
What happens if the model mishears a drug, a dose or a name, and how does the clinician catch it?
Can the whole thing run on our servers if our regulator or our hospital requires it?

Design choices that make compliance easier

Redact names, identifiers and other direct personal details from the transcript before any language model summarises it.
Keep the audio only as long as it takes to produce and sign the note, then delete it by default.
Show the clinician a draft, never a final record. Nothing enters the medical record without a human signature.
Log who dictated, who reviewed and what changed, so the record can be audited.
Turn off vendor training on your data, and get that in writing.
Add features one at a time. A tool that only transcribes is much easier to defend than one that also summarises and suggests next steps.

Where does the AI Act come in?

The AI Act sits on top of the GDPR. A tool that only transcribes is generally not a medical device and not a high-risk system in itself. Once software starts proposing diagnoses, triage or treatment, it can become a medical device under the EU Medical Devices Regulation, which brings the Act's high-risk rules for AI in regulated products, now due from 2 August 2028 under Regulation (EU) 2026/1744. Confirm the classification with your regulatory adviser before you add such features. Under EDPB Opinion 28/2024, personal data used to build AI models also raises its own questions, so ask any vendor how its models were trained.

Describe your clinical workflow, languages and hosting requirements. We can help design transcription with patient-data controls and clinician review.

Discuss clinical transcription

FAQ

Do patients have to consent to AI transcription of their consultation?

Consent is not usually the legal basis for providing care, which normally rests on Article 6 and Article 9(2)(h). Patients must still be told clearly about the recording and the processing, and national rules or the clinic's own policy may add an opt-out.

Can a clinic use a US cloud speech-to-text service?

Assess the service’s actual data flows and access arrangements, not just its parent company’s location. Any transfer outside the EEA needs a valid Chapter V basis and the relevant safeguards. Check current adequacy decisions and the specific recipient before relying on them.

Does a small practice need a DPIA?

A single practitioner's processing of their own patients' data is not considered large-scale under Recital 91, so the mandatory trigger may not apply. Check your national supervisory authority's DPIA list, and write a short assessment anyway if the tool is new to you.

Where can medical providers get a secure, GDPR-compliant AI scribe?

Choose a vendor that signs an Article 28 processor contract, processes audio and transcripts in the EU or on your servers, does not train on your recordings and answers the eight vendor questions in writing, or commission a system built to those terms. Complete a DPIA before the first patient is recorded.

Sources

About the author

Artem Synytskyi · Co-founder · AI

Artem runs AI at ESADEX, building LLM, RAG and speech-to-text systems for regulated environments.

Medical speech-to-text and GDPR: a clinic checklist