GDPR and AI Transcription: What Businesses Need to Know

Key Takeaways

Recordings and transcripts of identifiable people are personal data under GDPR, along with the names, opinions, and sometimes health details spoken inside them.
In most setups, your business is the controller and the transcription vendor is the processor. Article 28 requires a written contract between you and controls over any sub-processors.
The most serious GDPR infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. Cumulative fines passed €7.1 billion by January 2026, according to DLA Piper.
Sending recordings outside the EEA needs a valid transfer mechanism. The EU-US Data Privacy Framework is still in force but under legal pressure, so keep Standard Contractual Clauses as a fallback.
A compliant tool helps, but compliance is shared: you still decide the lawful basis, tell participants about the recording, and manage retention and deletion.

Every time a business transcribes a meeting, a customer call, an interview, or a training session, it creates a new document full of personal data: names, voices, opinions, job titles, and sometimes health or financial details. Under the EU’s General Data Protection Regulation, that document comes with obligations — and so does the tool that produced it.

Enforcement is not theoretical. DLA Piper’s GDPR Fines and Data Breach Survey reports about €1.2 billion in fines during 2025, a cumulative total of €7.1 billion since 2018, and an average of 443 personal data breach notifications a day across Europe, up 22% year on year. Transcription is rarely the headline case, but it is the kind of everyday processing that regulators look at when they ask whether an organisation treated data protection as a design principle.

This guide explains what GDPR means for AI transcription in plain terms: what counts as personal data, who is responsible for what, which contracts and transfer rules apply, what to ask a vendor, and how to keep your own use of transcription defensible. It is general information, not legal advice, so involve your data protection officer or counsel for decisions specific to your organisation.

Is a Transcript Personal Data Under GDPR?

Yes, in almost every business setting. GDPR covers any information relating to an identifiable person. A recording of a sales call captures voices, names, and company details. The transcript adds searchable text that can be stored, copied, and shared far more easily than audio ever was. Both are personal data, and both need handling accordingly.

Two nuances matter. First, what people say inside a recording can include special category data, such as health information mentioned in a HR call or union membership mentioned in an interview. Article 9 prohibits processing these categories unless one of a short list of conditions applies, and the ICO’s guidance notes there are ten such conditions, with explicit consent being one. Second, a voice becomes biometric data only when it is processed to uniquely identify someone, such as a voiceprint used for authentication. Ordinary speech-to-text is not that, but it is worth confirming with counsel if a tool advertises voice identification features.

Controller vs. Processor: Who Is Responsible for What?

GDPR splits responsibility between the party that decides why and how data is used (the controller) and the party that processes it on the controller’s behalf (the processor). When a company uploads meeting recordings to a transcription service, the company is normally the controller and the service is the processor.

Responsibility	You (Controller)	Transcription Vendor (Processor)
Lawful basis and purpose	Decide why you are recording and transcribing	Process only on your documented instructions
Telling participants	Inform people they are being recorded and transcribed	Support you with information about processing
Security	Choose vendors with sufficient guarantees	Implement appropriate technical and organisational measures
Sub-processors	Authorise them, in writing	Flow the same obligations down and stay liable
Breach handling	Notify the regulator within 72 hours where required	Tell you without undue delay
Rights requests	Respond to access and erasure requests	Help you retrieve, correct, or delete data
End of contract	Decide what happens to your data	Delete or return it

The GDPR Principles Applied to Transcription

Article 5 sets out the principles behind every other rule. Here is what each one looks like in a transcription workflow.

Principle	What It Means for Transcription
Lawfulness, fairness, transparency	Have a lawful basis, and tell participants a call is being recorded and transcribed and why.
Purpose limitation	Use transcripts for the stated purpose, such as meeting minutes, not for unrelated profiling.
Data minimisation	Transcribe what you need. Do not record or keep entire calls out of habit.
Accuracy	Correct misheard names and terms, especially before a transcript feeds decisions about a person.
Storage limitation	Set retention periods for recordings and transcripts and delete them when the purpose ends.
Integrity and confidentiality	Encrypt files, restrict access, and choose vendors with real security controls.

Lawful Basis, Consent, and Telling Participants

Article 6 lists six lawful bases, and consent is only one of them. For internal meetings, many organisations rely on legitimate interests or contractual necessity and document their reasoning. For external participants, such as customers, candidates, or research subjects, consent or a clearly explained legitimate interest is more common. Regulators have repeatedly cautioned that employee consent is hard to treat as freely given because of the power imbalance, so employers should not lean on it by default.

Whatever basis you choose, be transparent. Say at the start of a call that it is being recorded and transcribed, explain the purpose, and tell people how to raise concerns. If you record calls on platforms like Zoom or Google Meet, the same rule applies when you later upload those recordings for transcription. Where recordings touch special category data, add the Article 9 condition on top of your Article 6 basis, and consider a data protection impact assessment for large-scale or high-risk use.

Data Processing Agreements: The Contract You Cannot Skip

Article 28 requires a binding written contract whenever a processor handles personal data for you. It must cover the subject matter, duration, purpose, types of data, and the processor’s obligations, including confidentiality, security, assistance with data subject rights, and deletion or return of data at the end. It must also control sub-processors: as the ICO explains, a processor cannot engage another processor without your prior specific or general written authorisation, and must impose the same obligations on that sub-processor.

In practice, this means asking any transcription vendor for its Data Processing Agreement and its current list of sub-processors, such as cloud hosting and speech recognition providers, before you upload anything containing personal data. A generic terms-of-service page is not a substitute.

International Transfers: Where Does Your Audio Actually Go?

If a transcription service processes data outside the European Economic Area, GDPR requires a valid transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. For US-based processing, the usual route has been the EU-US Data Privacy Framework.

That framework remains in force, and the EU General Court upheld it in September 2025. But an appeal is pending at the Court of Justice, and after the US Supreme Court’s June 2026 decision in Trump v. Slaughter, privacy group noyb urged the European Commission to withdraw it. The European Data Protection Board has since requested a review. The situation is fluid, so verify the current status before relying on it, and make sure your vendor agreements include Standard Contractual Clauses as a backup rather than depending on the framework alone.

Breach Notification: The 72-Hour Clock

Under Article 33, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals. The processor must tell the controller without undue delay. Your vendor contract should say how quickly the vendor will alert you, because your 72 hours can start running as soon as you know.

Data Subject Rights in a World of Searchable Transcripts

People can ask what data you hold about them, ask for corrections, and in many cases ask for erasure. Transcripts make these requests more likely to matter, because a searchable archive of calls is exactly the kind of place a person’s data can hide. Before you build a large transcript library, make sure you can search it by name, delete a specific transcript and its source recording, and confirm that deletion reaches your vendor’s systems and backups within a stated timeframe. Retention limits are your best defence: data you deleted on schedule cannot be requested or breached.

What Non-Compliance Can Cost

Article 83 sets two fine tiers. Which one applies depends on the provision breached, not the size of the company, and the higher of the two figures in each tier is the ceiling.

Tier	Maximum Fine	Typical Provisions Involved
Higher tier	Up to €20 million or 4% of worldwide annual turnover	Core principles (Art. 5), lawful basis and consent (Arts. 6, 7, 9), data subject rights, international transfers
Lower tier	Up to €10 million or 2% of worldwide annual turnover	Controller and processor obligations (Arts. 25–39), including security, processor contracts, and breach notification

These are ceilings, not typical outcomes. Fines are set case by case and most are far smaller. But the direction of travel is clear: DLA Piper’s survey puts the aggregate at €7.1 billion since May 2018, and the largest single fine remains the €1.2 billion imposed on Meta Platforms Ireland in 2023.

Vendor Due Diligence Checklist

Ask the Vendor	What Good Looks Like	Why It Matters
Do you sign a DPA?	A written Article 28 agreement on request	Required before a processor handles personal data
Who are your sub-processors?	A current list, with notice of changes	You must authorise them and can object to changes
Where is data processed and stored?	Clear regions and a stated transfer mechanism	Transfers outside the EEA need a valid basis
How is data encrypted?	Encryption in transit and at rest	Supports the integrity and confidentiality principle
How long do you keep files?	Defined retention and user-controlled deletion	Supports storage limitation and erasure requests
Is my content used to train models?	A clear no, or an easy opt-out	Affects purpose limitation and your privacy notices
How fast will you tell me about a breach?	A contractual window well inside 72 hours	Your regulator notification clock is short
Who can access my files?	Role-based access, limited staff access	Reduces insider and misuse risk

How TrulyScribe Approaches GDPR

TrulyScribe encrypts files in transit and at rest and states that its processes are GDPR-compliant. Its privacy policy explains that personal data processed within the European Union is handled in accordance with GDPR, that consent can be withdrawn, and that relevant personal data is deleted or removed when consent is withdrawn, subject to legal requirements. You can review, edit, and download transcripts from your dashboard, which makes it straightforward to correct errors and manage your own copies.

Businesses with specific requirements, such as a signed DPA, a sub-processor list, or details on where data is processed, should request them from TrulyScribe directly before onboarding, exactly as they should with any vendor. Our earlier guide on whether AI transcription is secure covers the wider security questions worth asking.

A Practical Compliance Checklist for Your Business

Map where transcription happens: which meetings, calls, and interviews are recorded, by whom, and why.
Choose and document a lawful basis for each use, and add an Article 9 condition where special category data is likely.
Update privacy notices and start-of-call announcements to mention recording and transcription.
Sign a DPA with each transcription vendor and review its sub-processors and transfer mechanism.
Set retention periods for recordings and transcripts, and delete on schedule.
Limit access to transcripts to the people who need them.
Prepare a process for access, correction, and erasure requests, and a breach response plan.
Run a data protection impact assessment for large-scale or sensitive uses such as HR, health, or legal recordings.

Sector-specific uses raise the bar further. If you transcribe legal discovery material or recruitment interviews, the personal data involved is more sensitive and the paper trail matters more.

Frequently Asked Questions (FAQs)

Is AI transcription automatically GDPR-compliant?

No. GDPR compliance depends on how a tool is built and how you use it. A vendor can offer encryption and deletion controls, but you still need a lawful basis, participant transparency, a processor contract, and sensible retention.

Do I need consent from everyone on a call before transcribing it?

Not always. Consent is one of six lawful bases, and many organisations rely on legitimate interests for internal meetings. You do need a lawful basis, and you should tell participants about the recording. Some national laws on recording calls add further rules, so check the jurisdictions involved.

Does GDPR apply if my company is outside the EU?

Yes, if you offer goods or services to people in the EU or monitor their behaviour, or if you process data of people in the EU. Where the vendor or the participants are in the EU, GDPR is likely to be relevant regardless of where your headquarters sit.

Can a transcription vendor use my recordings to train its AI?

Only if the contract and privacy terms allow it and you have a lawful basis for that purpose. Ask for a clear statement on model training and an opt-out, and get it in writing.

What should a data processing agreement include?

It should set out the subject matter, duration, nature and purpose of processing, the types of personal data, security measures, confidentiality, sub-processor rules, help with data subject rights, breach notification, and deletion or return of data at the end of the contract.

How long should we keep transcripts?

Only as long as the purpose requires. Set a retention period for each use, such as meeting minutes versus legal records, and delete on schedule. Storage limitation is one of the core principles in Article 5.

Is it safe to use US-based transcription tools for EU data?

It can be, provided there is a valid transfer mechanism and appropriate safeguards. The EU-US Data Privacy Framework is currently in force but under legal challenge, so keep Standard Contractual Clauses in place as a fallback and review your position as the law develops.

The Bottom Line

AI transcription and GDPR are compatible, but only when the business treats transcripts as the personal data they are. That means a lawful basis, honest notices, a signed processor agreement, controlled transfers, short retention, and a vendor that can answer hard questions clearly. None of it is exotic. It is the same discipline you would apply to any system that stores what people say.

TrulyScribe offers encrypted, GDPR-aligned transcription with transcripts you can review, edit, and manage from your dashboard. Whichever tool you choose, put the vendor questions in this guide to it in writing before your next recording goes up.

Product

Company

Important Links

Alternatives to