EU data residency means that audio, transcripts and related metadata are stored and processed on infrastructure located inside the European Union or European Economic Area. GDPR does not require this outright, but it restricts transfers of personal data to third countries, and speech is almost always personal data. For a speech-to-text service the question is not only where files are stored but where the GPUs that process the audio run, where logs go and who can access the system remotely.
Key takeaways
- GDPR allows transfers outside the EEA only under Chapter V: an adequacy decision, appropriate safeguards such as standard contractual clauses, or narrow derogations.
- For speech AI, processing location matters as much as storage location. Streaming audio sent to a GPU in another jurisdiction is a transfer even if nothing is written to disk.
- Remote access from a third country, for example by support engineers, can itself count as a transfer.
- Residency is not the same as sovereignty. A provider headquartered outside the EU may be subject to foreign disclosure laws for data it holds in an EU region.
- Ask vendors for the region of every component in the data path, including sub-processors, logging and backups.
What data residency means#
Data residency is a contractual and architectural promise about geography. In its weakest form it covers only data at rest: uploaded files and stored transcripts live in an EU region. In its strongest form it covers the entire data path: ingestion, inference, temporary buffers, logs, monitoring, backups and human access all remain inside the EU.
The terms around it are often used loosely. The distinctions matter when reading a vendor's documentation or negotiating a contract.
| Term | What it describes | Typical source |
|---|---|---|
| Data residency | Where data is physically stored and processed | Vendor commitment, contract |
| Data localisation | A legal requirement that certain data stays in a country | National or sector law |
| Transfer compliance | Whether moving data out of the EEA is lawful | GDPR Chapter V |
| Data sovereignty | Which jurisdiction's laws can reach the data | Provider's corporate location, foreign law |
Voice recordings identify, or can identify, the people speaking, and transcripts routinely contain names, addresses and health details. The reasoning is covered in GDPR and voice data. Once speech is personal data, its location falls under GDPR's transfer rules.
GDPR and international transfers#
GDPR (Regulation (EU) 2016/679) sets out the rules for transfers in Chapter V, Articles 44 to 50. Article 44 states the general principle: personal data may be transferred to a third country only if the conditions of the chapter are met. The main routes are:
- Adequacy (Article 45). The Commission has found that the destination provides essentially equivalent protection. Examples include Switzerland, Japan and, since July 2023, US organisations certified under the EU–US Data Privacy Framework.
- Appropriate safeguards (Article 46). Most commonly the standard contractual clauses adopted in Commission Implementing Decision (EU) 2021/914, or binding corporate rules approved under Article 47.
- Derogations (Article 49). Explicit consent, contract necessity and a few other grounds, intended for occasional transfers rather than routine processing.
Schrems II and its aftermath#
In Case C-311/18 (Schrems II, 16 July 2020) the Court of Justice of the EU invalidated the EU–US Privacy Shield. It upheld standard contractual clauses in principle but required exporters to assess, case by case, whether the law of the destination country undermines them, and to add supplementary measures where it does. The European Data Protection Board's Recommendations 01/2020 describe how to run that assessment, now usually called a transfer impact assessment.
The Commission adopted a new adequacy decision for the EU–US Data Privacy Framework on 10 July 2023 (Implementing Decision (EU) 2023/1795), following US Executive Order 14086 on safeguards for signals intelligence. The General Court dismissed a first challenge to it in Latombe v Commission (T-553/23) on 3 September 2025. Mr Latombe appealed to the Court of Justice in October 2025 (C-703/25 P), so the framework's long-term footing is not yet settled, and many organisations treat EU-only processing as a way to avoid depending on the framework's survival.
The speech data path#
A speech-to-text request touches more systems than its storage bucket. Each of them has a location, and a residency promise is only as strong as its weakest component.
Three points are specific to speech workloads:
- Inference is the processing. For streaming recognition, audio exists only briefly in GPU memory. That still counts. A provider that stores data in an EU bucket but routes inference to whichever region has spare GPU capacity does not offer EU residency for processing.
- Batch uploads create copies. Batch transcription often stages files in object storage, sometimes with a separate retention period. Check where that staging happens and how long it lasts; see zero data retention.
- Downstream services widen the path. If transcripts are passed to a summarisation model or an analytics tool, each of those has its own location. Audio intelligence features are frequently hosted separately from the core recogniser.
Residency is not sovereignty#
Keeping data in an EU region controls where it sits, not which governments can compel access to it. The US CLOUD Act of 2018 (18 U.S.C. § 2713) requires US providers to disclose data in their possession, custody or control when served with valid legal process, regardless of where that data is stored. An EU region operated by a US-headquartered provider is therefore in scope of US law as well as EU law.
Whether this matters depends on the data and the risk assessment. For many workloads, standard contractual clauses plus encryption and access controls are judged sufficient. For health records, legal privilege, public sector data or national security contexts, organisations increasingly want providers that are both located and incorporated in the EU. The broader argument is covered in sovereign AI in Europe.
Questions to ask a vendor#
- In which countries do the GPUs that run inference for my requests sit? Can requests ever fail over to another region?
- Where are uploaded files staged, and for how long?
- Where are application logs, error traces and metrics stored, and do they contain audio or transcript fragments?
- Who has remote access to production systems, and from which countries?
- Which sub-processors handle personal data, in which locations, and under which Chapter V mechanism?
- Where is the provider incorporated, and which foreign disclosure laws apply to it?
- Is residency written into the data processing agreement, or only described on a marketing page?
These belong in any vendor evaluation alongside accuracy and latency. A written answer to each one is more useful than a general statement that a service is "GDPR compliant".
How Reson8 approaches this#
Reson8 is built by Resonate Labs B.V., an Amsterdam company, and serves its own model, Resonant-1, on EU GPU infrastructure. All processing happens on EU GPUs, audio is not retained, and customer data is not used for model training. Processing is covered by a GDPR Article 28 data processing agreement. Enterprise plans can also run on-premise or in a customer VPC. Security documentation is published at trust.reson8.dev.
Common questions#
Does GDPR require data to stay in the EU?
No. GDPR permits transfers outside the EEA under the mechanisms in Chapter V. Residency is a way to avoid needing those mechanisms, and the risk assessments that come with them, rather than a legal requirement in itself. Some sector or national rules do impose localisation.
Is the UK or Switzerland "in the EU" for residency purposes?
Neither is in the EU. Switzerland has an adequacy decision, and the UK has been covered by adequacy decisions since 2021; check the current decision on EUR-Lex. Whether a vendor's "EU residency" covers them is a contractual question, so ask for the list of countries.
Is streaming audio a transfer if it is never stored?
Yes. Processing includes any operation on personal data, and making audio available to a system in a third country for inference is a transfer regardless of retention.
Does the EU–US Data Privacy Framework make residency unnecessary?
It provides a lawful basis for transfers to certified US organisations. It does not address the CLOUD Act question, and its predecessors were struck down twice, so many buyers still prefer EU-only processing for sensitive audio.
This article is general information, not legal advice.
References#
- Regulation (EU) 2016/679 (General Data Protection Regulation), Chapter V. EUR-Lex.
- Court of Justice of the EU, Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, 16 July 2020, ECLI:EU:C:2020:559. EUR-Lex.
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries. EUR-Lex.
- Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection under the EU–US Data Privacy Framework. EUR-Lex.
- European Data Protection Board. Recommendations 01/2020 on measures that supplement transfer tools (version 2.0, 2021). EDPB.
- European Data Protection Board. Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR. EDPB.
- Clarifying Lawful Overseas Use of Data (CLOUD) Act, 2018, 18 U.S.C. § 2713.