Compliance

Key Takeaways Every time a business transcribes a meeting, a customer call, an interview, or a training session, it creates a new document full of personal data: names, voices, opinions, job titles, and sometimes health or financial details. Under the EU’s General Data Protection Regulation, that document comes with obligations — and so does the tool that produced it. Enforcement is not theoretical. DLA Piper’s GDPR Fines and Data Breach Survey reports about €1.2 billion in fines during 2025, a cumulative total of €7.1 billion since 2018, and an average of 443 personal data breach notifications a day across Europe, up 22% year on year. Transcription is rarely the headline case, but it is the kind of everyday processing that regulators look at when they ask whether an organisation treated data protection as a design principle. This guide explains what GDPR means for AI transcription in plain terms: what counts as personal data, who is responsible for what, which contracts and transfer rules apply, what to ask a vendor, and how to keep your own use of transcription defensible. It is general information, not legal advice, so involve your data protection officer or counsel for decisions specific to your organisation. Is a Transcript Personal Data Under GDPR? Yes, in almost every business setting. GDPR covers any information relating to an identifiable person. A recording of a sales call captures voices, names, and company details. The transcript adds searchable text that can be stored, copied, and shared far more easily than audio ever was. Both are personal data, and both need handling accordingly. Two nuances matter. First, what people say inside a recording can include special category data, such as health information mentioned in a HR call or union membership mentioned in an interview. Article 9 prohibits processing these categories unless one of a short list of conditions applies, and the ICO’s guidance notes there are ten such conditions, with explicit consent being one. Second, a voice becomes biometric data only when it is processed to uniquely identify someone, such as a voiceprint used for authentication. Ordinary speech-to-text is not that, but it is worth confirming with counsel if a tool advertises voice identification features. Controller vs. Processor: Who Is Responsible for What? GDPR splits responsibility between the party that decides why and how data is used (the controller) and the party that processes it on the controller’s behalf (the processor). When a company uploads meeting recordings to a transcription service, the company is normally the controller and the service is the processor. Responsibility You (Controller) Transcription Vendor (Processor) Lawful basis and purpose Decide why you are recording and transcribing Process only on your documented instructions Telling participants Inform people they are being recorded and transcribed Support you with information about processing Security Choose vendors with sufficient guarantees Implement appropriate technical and organisational measures Sub-processors Authorise them, in writing Flow the same obligations down and stay liable Breach handling Notify the regulator within 72 hours where required Tell you without undue delay Rights requests Respond to access and erasure requests Help you retrieve, correct, or delete data End of contract Decide what happens to your data Delete or return it The GDPR Principles Applied to Transcription Article 5 sets out the principles behind every other rule. Here is what each one looks like in a transcription workflow. Principle What It Means for Transcription Lawfulness, fairness, transparency Have a lawful basis, and tell participants a call is being recorded and transcribed and why. Purpose limitation Use transcripts for the stated purpose, such as meeting minutes, not for unrelated profiling. Data minimisation Transcribe what you need. Do not record or keep entire calls out of habit. Accuracy Correct misheard names and terms, especially before a transcript feeds decisions about a person. Storage limitation Set retention periods for recordings and transcripts and delete them when the purpose ends. Integrity and confidentiality Encrypt files, restrict access, and choose vendors with real security controls. Lawful Basis, Consent, and Telling Participants Article 6 lists six lawful bases, and consent is only one of them. For internal meetings, many organisations rely on legitimate interests or contractual necessity and document their reasoning. For external participants, such as customers, candidates, or research subjects, consent or a clearly explained legitimate interest is more common. Regulators have repeatedly cautioned that employee consent is hard to treat as freely given because of the power imbalance, so employers should not lean on it by default. Whatever basis you choose, be transparent. Say at the start of a call that it is being recorded and transcribed, explain the purpose, and tell people how to raise concerns. If you record calls on platforms like Zoom or Google Meet, the same rule applies when you later upload those recordings for transcription. Where recordings touch special category data, add the Article 9 condition on top of your Article 6 basis, and consider a data protection impact assessment for large-scale or high-risk use. Data Processing Agreements: The Contract You Cannot Skip Article 28 requires a binding written contract whenever a processor handles personal data for you. It must cover the subject matter, duration, purpose, types of data, and the processor’s obligations, including confidentiality, security, assistance with data subject rights, and deletion or return of data at the end. It must also control sub-processors: as the ICO explains, a processor cannot engage another processor without your prior specific or general written authorisation, and must impose the same obligations on that sub-processor. In practice, this means asking any transcription vendor for its Data Processing Agreement and its current list of sub-processors, such as cloud hosting and speech recognition providers, before you upload anything containing personal data. A generic terms-of-service page is not a substitute. International Transfers: Where Does Your Audio Actually Go? If a transcription service processes data outside the European Economic Area, GDPR requires a valid transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. For US-based processing, the usual route has been the EU-US Data Privacy