Under the GDPR, a recording of an identifiable person's voice is personal data, and so, usually, is its transcript. Voice becomes biometric data, a special category, when it is technically processed to uniquely identify someone, and recordings often contain other special category data such as health information. Anyone recording, transcribing or analysing speech needs a lawful basis, clear information for the people recorded, limits on retention and use, and contracts with every vendor that touches the audio.
Key takeaways
- Audio of an identifiable person is personal data because of the voice, the content and the metadata. Deleting the audio does not make the transcript anonymous.
- Voice is biometric data under Article 9 only when processed for unique identification, as in speaker verification. Ordinary transcription is not biometric processing.
- Content can still be special category data: a medical consultation, a union meeting or a conversation revealing religious belief.
- A speech recognition vendor is normally a processor. If it uses customer audio to train its own models, it becomes a controller for that purpose.
- Where audio is processed matters. Transfers outside the EEA need a Chapter V mechanism; processing inside the EU avoids the question.
When audio is personal data#
Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person. A voice recording relates to a person in three ways:
- The voice itself. People can often be recognised by voice, by those who know them or by technical means.
- The content. Speakers say their names, addresses, account numbers and dates of birth, and talk about other people.
- The metadata. Caller numbers, agent IDs, timestamps and locations are linked to the recording.
A transcript loses the voice but keeps content and metadata, so it is usually still personal data. Recital 26 sets a high bar for anonymisation: data is anonymous only if a person can no longer be identified by any means reasonably likely to be used. Replacing names in a transcript with placeholders is typically pseudonymisation, which reduces risk but leaves the data within the GDPR. See PII redaction in transcripts.
Biometrics and special categories#
Article 4(14) defines biometric data as personal data resulting from specific technical processing of physical, physiological or behavioural characteristics that allows or confirms unique identification. Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a natural person, unless an Article 9(2) exception applies, such as explicit consent. Recital 51 makes the distinction explicit for photographs, and the same logic applies to voice.
| Processing | Biometric under Art. 9? | Notes |
|---|---|---|
| Transcribing a call | No | Personal data; content may still be special category |
| Diarisation into Speaker 1 and Speaker 2 | Generally no | Separates voices within one recording without identifying anyone |
| Voice verification ("my voice is my password") | Yes | Needs an Article 9(2) condition, usually explicit consent |
| Matching voices against a watchlist | Yes | High risk; may also engage the EU AI Act |
Voice biometrics are covered in voice biometrics and consent. Separately from biometrics, the content of speech often falls under Article 9: health in medical calls, trade union membership, religious or political views, sex life. The EDPB's guidelines on virtual voice assistants also note that voice data can allow inferences about a speaker, such as health conditions, that raise the sensitivity of processing. A medical transcription service processes special category data even though it never identifies anyone by voice. See medical speech recognition.
Controllers, processors and sub-processors#
The organisation that decides to record and transcribe, such as a hospital, bank or contact centre, is the controller. A speech recognition provider that processes audio only to return a transcript, on the controller's instructions, is a processor, and Article 28 requires a contract covering the subject matter, duration, purpose, security, sub-processors, assistance with data subject rights and deletion at the end of the service. See data processing agreements.
The line matters in one common case. A vendor that keeps customer audio to train or improve its own models is deciding a purpose of its own, and according to the EDPB's Guidelines 07/2020 on the concepts of controller and processor, a processor that determines its own purposes becomes a controller for that processing. That processing then needs its own lawful basis and transparency. Contracts should say plainly whether audio or transcripts are used for training.
Principles applied to speech systems#
| GDPR requirement | What it means for a speech system |
|---|---|
| Lawful basis (Art. 6) | A basis for each purpose: recording, transcription, analytics, model improvement |
| Transparency (Art. 13, 14) | A recording notice at the start of a call; privacy information naming purposes and recipients |
| Purpose limitation (Art. 5(1)(b)) | Transcripts made for quality review are not automatically available for unrelated profiling |
| Data minimisation (Art. 5(1)(c)) | Pause recording during card capture; redact identifiers not needed downstream |
| Storage limitation (Art. 5(1)(e)) | Delete audio once transcribed where the audio is not itself needed; vendor retention of zero |
| Security (Art. 32) | Encryption in transit and at rest, access control, audited vendors |
| DPIA (Art. 35) | Usually required for large-scale special category data or systematic monitoring |
| Access and erasure (Art. 15, 17) | Be able to find, export and delete a person's recordings and transcripts |
Where the audio goes#
Chapter V of the GDPR restricts transfers of personal data outside the European Economic Area. Transfers need an adequacy decision, appropriate safeguards such as standard contractual clauses, or a narrow derogation. The Court of Justice's Schrems II judgment (Case C-311/18, 2020) invalidated the EU-US Privacy Shield and required exporters using contractual clauses to assess the law of the destination country. The Commission adopted a new adequacy decision for the EU-US Data Privacy Framework in July 2023, covering US organisations that certify under it.
A cloud speech API that processes audio outside the EEA involves a transfer, as does remote access to EU-stored data from a third country. Processing on infrastructure inside the EU, by a provider established in the EU, avoids most of this analysis, which is one reason public bodies and regulated firms often require it. See EU data residency and sovereign AI in Europe.
Voice systems can also fall under the EU AI Act, for example emotion recognition or biometric identification. See the EU AI Act and speech recognition.
How Reson8 approaches this#
Reson8 processes all audio on EU GPU infrastructure, retains no audio, and does not train models on customer data, consistent with acting purely as a processor. Resonate Labs B.V. is based in Amsterdam, is ISO 27001 certified, and provides a GDPR Article 28 data processing agreement. On-premise and VPC deployment are available on enterprise plans for organisations that need audio to stay inside their own perimeter. Security documentation is at trust.reson8.dev.
Common questions#
Is a voice recording always biometric data?
No. It is personal data if the speaker is identifiable, but biometric data under Article 9 only arises when the voice is processed with specific technical means for unique identification, such as voiceprint matching.
Do we need consent to transcribe calls?
Not necessarily. Consent is one of six lawful bases; legal obligation (as with MiFID II recording), contract, legitimate interests or public task may apply. National rules on call recording and on employee monitoring may add requirements.
Is a transcript anonymous if names are removed?
Rarely. Context, voice-derived metadata and linkable identifiers usually allow re-identification, so redacted transcripts are generally pseudonymised, not anonymised.
Does zero retention remove the need for a DPA?
No. Processing a recording for even a few seconds is processing, so Article 28 applies. Zero retention reduces risk; it does not change the roles.
References#
- Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex.
- European Data Protection Board (2021). Guidelines 02/2021 on virtual voice assistants, version 2.0.
- European Data Protection Board (2021). Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.0.
- Court of Justice of the EU. Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, ECLI:EU:C:2020:559. EUR-Lex.
- Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection under the EU-US Data Privacy Framework. EUR-Lex.
- Directive 2002/58/EC (ePrivacy Directive), Article 5. EUR-Lex.