GDPR and Transcription: What EU Users and Companies Must Check

If you record calls, meetings, interviews or lectures in the EU and run them through a speech-to-text tool, the GDPR applies: the recording and the transcript are personal data, often with sensitive content inside. This guide walks through the questions you need to answer before you upload anything: which lawful basis you rely on, what you tell the people being recorded, what the contract with your provider must contain, where the data is hosted, and how long you keep it. It ends with a checklist you can apply to any tool, EchoScribe included.

One thing up front: this is a practical overview written by a product team, not legal advice. Rules differ between EU member states, especially for call recording and employee monitoring, and your situation may need a lawyer or your data protection officer.

Why transcription is a GDPR topic at all

A voice recording identifies a person twice over: by the voice itself and by the content, which usually names people, projects, health conditions, salaries or opinions. Turning audio into text does not make it less personal; it makes it searchable, copyable and easier to leak. Speaker labels tie statements to individuals, and AI summaries condense them into bullet points that can be quoted out of context.

When you use a transcription service you are typically doing three things at once:

• Collecting personal data (the recording): needs a purpose and a lawful basis.
• Sharing it with a processor (the provider): needs a contract and, outside the EU/EEA, a transfer mechanism.
• Storing derived data (transcript, summary, exports): needs a retention period and a deletion routine.

Most compliance problems with transcription come from treating it as a technical convenience instead of a data flow.

Lawful basis: which one applies to recordings and transcripts

Article 6 GDPR lists six lawful bases. In practice three of them matter for transcription.

Consent

Consent is the obvious choice for interviews, research recordings, podcasts with guests and anything involving people who have no business relationship with you. It must be freely given, specific, informed and withdrawable. "By staying on this call you agree to be recorded" is weak consent at best, because leaving may not be a realistic option. A short spoken explanation plus a visible recording indicator, or a written consent form for interviews, is a much stronger position. Keep a record of who consented and when.

Legitimate interest

Internal meetings, sales calls and support calls are often recorded under legitimate interest: the company has a real reason (accurate minutes, training, quality), the impact on participants is limited, and participants would reasonably expect it. You still have to document a balancing test and give people a simple way to object; the European Data Protection Board's guidelines at https://www.edpb.europa.eu/ are the reference. For employees, several member states (Germany, France and the Netherlands among others) add stricter rules via works councils or labour law, so check locally before recording staff by default.

Contract

If transcription is part of the service you deliver, for example a customer orders a transcript of their own recording, the contract itself is the basis. The customer is the controller, you are the processor, and the contract should say so.

Whatever basis you choose, write it down in your records of processing (Article 30); it also drives what your privacy notice must say.

Consent for recordings: what to tell people and when

Even when consent is not your lawful basis, transparency is non-negotiable (Articles 13 and 14). Before or at the start of a recording, participants should learn:

• that the session is being recorded and transcribed, including by an AI tool;
• who the controller is (your company, not the tool vendor);
• the purpose (minutes, research, subtitles, training);
• who will have access to the transcript;
• how long it will be kept;
• which provider processes it and in which region;
• how to object, correct or request deletion.

For recurring meetings, a line in the calendar invite plus a reminder when recording starts is usually enough. For interviews, use a written consent form that names the AI transcription tool explicitly, as many research ethics boards now require; our interview transcription guide has sample wording.

One detail trips teams up: meeting bots that join Google Meet, Zoom or Teams calls are often enabled by one participant without the others realising. If you use one, make sure it announces itself; this overview of meeting transcription tools covers the options.

Data processing agreements with your transcription provider

A cloud transcription service that receives your audio is a processor under Article 28. That means you need a written data processing agreement (DPA) before you upload the first file, and the DPA must cover at least:

• the subject matter, duration, nature and purpose of the processing;
• that the provider acts only on your documented instructions;
• confidentiality obligations for staff;
• the technical and organisational security measures;
• the list of sub-processors (hosting, support tooling, model providers) and how you are notified of changes;
• assistance with data subject requests and breach notification;
• deletion or return of data at the end of the service;
• audit rights.

Most reputable providers publish a standard DPA you can accept online. Read the sub-processor list carefully: a service can be "EU-based" on paper and still send audio to a US speech API or an AI summarisation model elsewhere. Ask specifically whether your audio is used to train models. EchoScribe does not train on customer audio and lists its sub-processors on the privacy page; a provider that cannot answer this in one sentence is a red flag.

If you run an open-source model such as Whisper on your own servers, there is no processor and no DPA, but you take on the security and retention work yourself; see Whisper vs cloud speech APIs for the trade-offs.

EU hosting vs US transfers

Where the audio is physically processed matters because Chapter V GDPR restricts transfers outside the EU/EEA. Three situations are common:

Provider hosts and processes in the EU. No transfer takes place. You still need the DPA and should confirm that support access, backups and sub-processors are also EU-based or covered.

Provider is US-based and certified under the EU-US Data Privacy Framework (DPF). Since 2023 the European Commission's adequacy decision allows transfers to companies on the DPF list without additional safeguards. Verify the certification on the official list at https://www.dataprivacyframework.gov/ rather than trusting a logo, confirm that the specific service (not just the parent company) is covered, and remember that the framework has been challenged in court before and may be again.

Provider is outside the EU and not certified. You need standard contractual clauses (SCCs) plus a transfer impact assessment of the destination country's surveillance laws. This is doable but is real work, and for sensitive recordings many organisations decide it is not worth it.

A fourth category deserves a mention: EU subsidiaries of non-EU companies. Hosting in Frankfurt does not by itself settle whether the parent company can be compelled to hand over data; public bodies and healthcare organisations tend to be stricter about this than marketing teams. If avoiding the whole topic is attractive, an EU-hosted provider with EU-based ownership is the simplest route.

Retention and deletion

The storage limitation principle (Article 5(1)(e)) says you keep personal data no longer than necessary. For transcription that usually means separate rules per artefact:

Whatever periods you choose, check that your provider can actually honour them: can you set an automatic deletion window, does deleting a file also clear backups within a defined time, and is there an API endpoint so you can automate it? EchoScribe lets you delete recordings and transcripts at any time and removes them from backups within a stated window; your provider should state something comparable in its DPA. Think about exports too: a DOCX attached to an email now lives in several mailboxes outside any retention schedule, so prefer access-controlled links for sensitive content.

Special categories: health, legal and HR recordings

Article 9 GDPR gives extra protection to special categories of data: health, sexual orientation, political opinions, religious beliefs, trade union membership, genetic and biometric data, and ethnic origin. Article 10 adds criminal records. Transcripts of medical consultations, therapy sessions, legal consultations, HR grievance meetings and many research interviews will contain this kind of data even if that was not the point of the recording.

For these you need both a lawful basis under Article 6 and an exception under Article 9 (explicit consent, employment law, vital interests, or others). Practically, this also means:

• a data protection impact assessment (DPIA) is likely required before you roll out transcription;
• EU processing and a strict sub-processor list become close to mandatory;
• professional secrecy rules (doctors, lawyers, therapists) may apply on top of GDPR and may forbid cloud processing without specific safeguards;
• AI summaries should be reviewed before anyone acts on them, because a hallucinated sentence about a diagnosis or a dismissal has real consequences;
• names may need pseudonymisation before the transcript is shared more widely.

Our tips for accurate transcripts matter here too: fewer transcript errors mean less sensitive wrong content to correct later.

GDPR transcription checklist

Use this table before approving a transcription tool or a new recording workflow. Every "no" is a task, not necessarily a blocker.

EchoScribe's privacy and data processing page is structured along these same lines, so you can compare it with any other provider's answers item by item.

A final word on proportionality

GDPR is often read as a list of prohibitions, but its core idea is proportionality: collect what you need, tell people what you do, protect it properly, and delete it when you are done. Transcription fits that frame once you treat recordings as the sensitive data they are; the work is mostly documentation and a handful of settings. Once again, this article is general information, not legal advice, so involve your DPO or a lawyer when the stakes are high.