A data processing agreement (DPA) is the contract GDPR requires whenever one organisation processes personal data on behalf of another. When you send call recordings or dictations to a speech-to-text API, you are usually the controller and the vendor is your processor, so Article 28 applies. The DPA fixes what the vendor may do with the audio, how it is protected, who else touches it, and what happens to it when the service ends.
Key takeaways
- Article 28(3) lists eight things a DPA must cover, from acting only on documented instructions to deleting data at the end of the service.
- A vendor that uses your audio for its own purposes, such as training, may become a controller for that processing. The DPA should say whether that happens.
- Sub-processors need your prior written authorisation, and the vendor must pass the same obligations down to them.
- A DPA does not by itself make an international transfer lawful. Transfers outside the EEA need a Chapter V mechanism as well.
- For speech, check four clauses carefully: data categories, retention, training use and processing location.
Controllers, processors and speech vendors#
GDPR defines the controller as the party that determines the purposes and means of processing (Article 4(7)), and the processor as the party that processes data on the controller's behalf (Article 4(8)). A hospital that records consultations and sends them to a transcription API decides why the audio is processed and what happens to the text. The API provider only transcribes. That makes the hospital the controller and the provider the processor.
The roles follow what actually happens, not what the contract calls the parties. The EDPB's Guidelines 07/2020 stress this point. Article 28(10) adds that a processor which determines its own purposes becomes a controller for that processing. A speech vendor that keeps customer audio to train its general model is deciding a purpose of its own, so the DPA's position on training is more than a detail.
What Article 28 requires#
Article 28(1) says a controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Article 28(3) then requires a binding contract that sets out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the controller's obligations and rights. It must also require the processor to do the following:
| Art. 28(3) | Obligation | What it means for speech audio |
|---|---|---|
| (a) | Process only on documented instructions, including on transfers | Transcribe as requested; no other use of audio or text |
| (b) | Confidentiality of authorised personnel | Staff who could access audio are bound to confidentiality |
| (c) | Security measures under Article 32 | Encryption, access control, isolation of GPU workloads |
| (d) | Conditions for engaging sub-processors | Authorisation and flow-down for hosting and other providers |
| (e) | Assist with data subject rights | Help answer access or erasure requests about recordings |
| (f) | Assist with Articles 32 to 36 | Security, breach notification, DPIAs and prior consultation |
| (g) | Delete or return data at the end of the service | Audio and transcripts do not outlive the contract |
| (h) | Provide information and allow audits | Evidence of compliance, including audits or inspections |
Article 28(9) says the contract must be in writing, which includes electronic form. Most vendors publish a standard DPA that customers accept alongside the terms of service. Article 28(7) allows the Commission to adopt standard clauses for this purpose, and it did so in Implementing Decision (EU) 2021/915. Some organisations use those clauses directly instead of a vendor's own text.
Sub-processors#
Under Article 28(2), a processor may not engage another processor without the controller's prior specific or general written authorisation. With general authorisation, which is the common model for cloud services, the vendor must tell the controller about intended changes and give it the chance to object. Article 28(4) requires the same data protection obligations to be imposed on each sub-processor by contract, and leaves the original processor fully liable to the controller if a sub-processor fails.
For a speech API, the sub-processor list typically includes infrastructure hosting, and may include email, support tooling or monitoring services that could see content. The location of each one matters for data residency. A DPA that promises EU processing but lists a sub-processor outside the EEA needs a transfer mechanism for that link.
DPAs and international transfers#
A DPA governs the controller–processor relationship. It does not make a transfer outside the EEA lawful. If the vendor or any sub-processor processes data in a third country, GDPR Chapter V applies separately: an adequacy decision, or safeguards such as the standard contractual clauses in Implementing Decision (EU) 2021/914, which include a controller-to-processor module and a processor-to-processor module. After Schrems II, those clauses must be accompanied by an assessment of the destination country's law. Many vendor DPAs incorporate the SCCs as an annex so that one document covers both needs.
Clauses that matter for speech#
A generic SaaS DPA covers the Article 28 basics. Audio has features that deserve specific attention.
- Data categories. The DPA should name audio recordings and transcripts as processed data. If you process health data, such as clinical dictation, or other special categories under Article 9, say so; the security annex should reflect it.
- Retention. How long audio and transcripts are kept, including batch staging and logs. See zero data retention.
- Training. Whether customer content can be used to train, tune or evaluate models. A clear "no" keeps the vendor in the processor role.
- Location. Which countries processing may take place in, including inference and support access.
- Biometric use. Whether the vendor derives voiceprints or speaker embeddings. If so, the processing may involve biometric data; see voice biometrics and consent.
- Security annex. The technical and organisational measures actually in place, ideally tied to an audited framework such as ISO 27001.
How Reson8 approaches this#
Reson8 offers a GDPR Article 28 data processing agreement, published at reson8.dev/dpa. Processing runs on EU GPUs, audio is not retained, and customer data is not used to train models. Resonate Labs B.V. is ISO 27001 certified; further security documentation is at trust.reson8.dev.
Common questions#
Do I need a DPA if I only use a free tier?
If you send personal data, yes. Article 28 applies to the processing, not to the price. Check that the vendor's DPA covers the plan you are on.
Can the vendor change sub-processors without asking?
Under general authorisation it can add or replace sub-processors, but it must inform you in advance and give you the opportunity to object. The DPA should state the notice period and what happens if you object.
Is a DPA the same as standard contractual clauses?
No. The DPA covers the controller–processor relationship under Article 28. SCCs under Article 46 cover transfers to third countries. A vendor may bundle both into one document.
Who is liable if the vendor has a breach?
Both parties can be. The controller remains responsible for choosing a processor with sufficient guarantees, and the processor is liable for breaching its own obligations. The DPA usually also allocates liability contractually.
This article is general information, not legal advice.
References#
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4, 28, 33 and 82. EUR-Lex.
- European Data Protection Board. Guidelines 07/2020 on the concepts of controller and processor in the GDPR (version 2.0, 2021). EDPB.
- Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors under Article 28(7) GDPR. EUR-Lex.
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries. EUR-Lex.
- Court of Justice of the EU, Case C-311/18, Schrems II, 16 July 2020, ECLI:EU:C:2020:559. EUR-Lex.