A researcher with 25 interviews and a blank NVivo project is not lacking a definition of thematic analysis. What they're looking for is what to do next, in what order, and how to know when they're doing it well. That's what this guide covers.

GDPR has issued over €7.1 billion in cumulative fines since 2018, with €1.2 billion issued in 2025 alone, according to the DLA Piper GDPR Fines and Data Breach Survey published in January 2026. Enforcement is active, consistent, and specifically focused on data processing practices that research institutions treat as routine. Using a transcription service without a Data Processing Agreement in place, routing recordings through servers outside the EU without appropriate safeguards, or failing to specify retention and deletion timelines for audio files are all compliance failures that regulators have acted on. For German research teams, this isn't a future risk. It's an active one.

Oral history gives voice to people and communities whose experiences rarely make it into official records. An elder describing a neighborhood before it was demolished. A civil rights witness recounting what she saw. A craftsperson explaining a technique that has never been written down. These recordings are primary sources. How they get transcribed determines whether they survive intact as historical record or get quietly reshaped by someone else's sense of how people should speak on the page. The stakes are different here from market research or academic interview data. A poorly formatted research transcript wastes coding time. A poorly transcribed oral history misrepresents a person's voice to anyone who reads it for the next hundred years.