Understanding GDPR Compliance in Transcription Services

Transcription is not a passive administrative step. A transcriptionist is processing personal data. In most cases, identifiable personal data, including voice recordings, names mentioned by participants, health disclosures, and location details, all of which are explicitly covered by GDPR. The transcription provider is a data processor under GDPR, and the obligations that creates are specific and enforceable.

This guide covers what GDPR actually requires in a transcription context, how to verify compliance before you send files, and what Qualtranscribe does to meet these requirements for EU research projects.

Who GDPR Applies To

GDPR applies to any organization that processes personal data of individuals located in the European Union, regardless of where the organization itself is based. A US-based transcription company processing recordings of German focus group participants is subject to GDPR. A UK-based research team processing interviews with French participants is subject to GDPR. Post-Brexit, the UK operates under UK GDPR, which mirrors the EU regulation closely.

The territorial scope is broader than many researchers initially assume. If your participants are in the EU, GDPR applies to how their data is handled throughout the entire research workflow, including by every third-party service you engage.

For transcription specifically, this means:

The research team is the data controller. They determine the purpose and means of processing.

The transcription provider is a data processor. They process personal data on behalf of the controller.

This relationship must be governed by a written Data Processing Agreement before any data is transferred. Not after. Before.

What Counts as Personal Data in Research Transcription

GDPR's definition of personal data is broad. It covers any information that relates to an identified or identifiable natural person. In a transcription context, this includes:

Voice recordings, which are biometric data when used for identification purposes and are classified as special category data under Article 9 when combined with health, ethnic origin, or other sensitive information.

Names, locations, and contact details mentioned in recordings or transcripts.

Indirect identifiers that in combination could identify a participant: a specific hospital unit, a rare professional role, a distinctive combination of characteristics.

Health information disclosed during interviews, which is special category data attracting the highest level of GDPR protection.

Opinions, beliefs, and experiences shared in qualitative interviews, which are personal data when attributable to an identifiable individual.

The practical implication is that almost everything in a qualitative research recording is personal data under GDPR. The transcript produced from that recording is also personal data. Both need to be handled accordingly.

The Six GDPR Principles Applied to Transcription

The six data protection principles in Article 5 of GDPR are not abstract compliance checkboxes. They have direct practical implications for how transcription is handled.

Lawfulness, fairness, and transparency. Processing must have a lawful basis. For research, this is typically informed consent or legitimate interests. Participants should know their recordings will be transcribed, who will do the transcribing, and how their data will be handled. This needs to be in your consent documentation before data collection, not added afterward.

Purpose limitation. Data collected for transcription cannot be repurposed without additional authorization. This is directly relevant to AI transcription tools that train language models on uploaded audio. Using your participants' recordings to improve a commercial AI product is a purpose they did not consent to and that your original processing basis does not cover.

Data minimisation. Only data necessary for the transcription purpose should be shared. If your research design allows for de-identification before transcription, that removes significant GDPR exposure. Qualtranscribe's participant de-identification service handles this as part of the transcription workflow rather than as a separate manual step.

Accuracy. Transcription must accurately represent what was said. This sounds obvious but is worth stating: inaccurate transcription of personal data is itself a GDPR concern, not just an analytical problem.

Storage limitation. Data should not be retained longer than necessary. Your transcription provider needs a clear retention policy and the ability to delete files on your timeline. Qualtranscribe retains files for 30 days from upload by default and deletes on request.

Integrity and confidentiality. Appropriate technical and organisational security measures must be in place. Encrypted file transfer, access controls, staff confidentiality agreements, and documented breach procedures are the minimum standard.

The Data Processing Agreement

The DPA is the foundational document governing the relationship between you (the data controller) and your transcription provider (the data processor). Article 28 of GDPR requires it. Without a signed DPA, your use of a transcription provider for EU participant data is non-compliant regardless of how secure the provider's systems are.

A GDPR-compliant DPA for transcription services should cover:

The subject matter, duration, and nature of the processing. What files are being processed, for how long, and what the transcription involves.

The type of personal data and categories of data subjects. Voice recordings of research participants, which may include special category data if health or other sensitive information is involved.

The obligations and rights of the data controller. Including the right to audit the processor's compliance, the right to instruct deletion, and the right to receive breach notifications.

The processor's obligations. Including processing data only on documented instructions from the controller, ensuring staff confidentiality, implementing appropriate security measures, assisting the controller with data subject rights requests, and deleting or returning all data after the contract ends.

Sub-processor agreements. If the transcription provider uses any sub-processors (cloud storage providers, quality review services), these must be disclosed and must operate under equivalent data protection obligations.

Qualtranscribe provides DPAs for all projects involving EU participant data. Contact support@qualtranscribe.com before submitting files to initiate the DPA process.

International Data Transfers

This is the area where most research teams have the least visibility and the most exposure.

GDPR restricts the transfer of personal data outside the European Economic Area unless appropriate safeguards are in place. The EEA comprises the 27 EU member states plus Iceland, Liechtenstein, and Norway.

For research teams using a US-based transcription provider, this creates a transfer requirement. Several mechanisms exist for lawful transfer:

Adequacy decisions. The European Commission has issued adequacy decisions for a number of countries, recognising them as providing equivalent data protection to the EU. The UK has a current adequacy decision. The US does not have a blanket adequacy decision. US-based processors must rely on other mechanisms.

Standard Contractual Clauses. The most commonly used transfer mechanism for research teams working with US-based service providers. The European Commission updated SCCs in 2021 (replacing the previous versions, which were invalidated by the Schrems II ruling). A valid SCC arrangement between you and your transcription provider covers the transfer requirement.

Binding Corporate Rules. Used by multinational organisations for intra-group transfers. Not relevant for most research transcription contexts.

The simplest approach for research transcription is to use a provider that stores EU participant data within the EEA. This eliminates the transfer issue entirely. Qualtranscribe stores EU participant data in eu-central-2 Frankfurt, Germany, within the EEA. No international transfer mechanism required for EU research data processed through Qualtranscribe.

The AI Training Problem Under GDPR

Several popular transcription platforms, including some marketed to research and academic users, include terms permitting the use of uploaded audio to train or improve their AI models. Under GDPR, this creates a direct compliance problem.

The purpose limitation principle prohibits processing personal data for purposes incompatible with the original purpose for which it was collected. Your participants consented to have their recordings used for your specific research. They did not consent to have their personal data used to train a commercial AI language model. That is an incompatible secondary purpose.

The data minimisation principle further restricts this: processing should be limited to what is necessary for the specified purpose. Using personal data for AI training is not necessary for transcription.

Before uploading any EU participant recordings to a transcription platform, verify explicitly whether the platform uses uploaded data for AI training. Check the terms of service, not just the marketing materials. These are different documents.

Qualtranscribe does not use recordings for AI training on any plan, including the free tier. This is documented in the service terms and available in writing for ethics committee submissions and data management plans.

What to Verify Before Sending EU Research Recordings

Use this checklist before submitting any EU participant data to a transcription provider:

A provider who cannot answer these questions clearly before you submit your first file is not a provider you should be submitting EU participant data to.

How Qualtranscribe Handles GDPR-Governed Research

Qualtranscribe's GDPR compliance for EU research projects covers the specific requirements that research ethics committees and institutional compliance teams ask about.

EU data stored in Frankfurt within the EEA. EU participant data is processed and stored in eu-central-2 Frankfurt, Germany. No international transfer mechanism required.

Data Processing Agreements available on request. Contact support@qualtranscribe.com before submitting EU participant files to initiate the DPA process. Article 28-compliant DPAs covering all required obligations.

Encrypted file handling throughout. All uploads and downloads occur through a secure encrypted portal. Files are never transmitted via standard email.

Zero AI training policy across all plans. Your recordings are never used for AI training or model improvement. Documented in service terms and available in writing for ethics submissions.

Signed NDAs on every project. Every team member who accesses your files works under a confidentiality agreement.

30-day default retention with deletion on request. Files are retained for 30 days from upload by default. Deletion on your timeline on request, with confirmation provided.

Participant de-identification available on request. Built into the transcription workflow with a full de-identification log for ethics committee audit purposes.

Access controls and audit trails. Access to project files is limited to the assigned team. Access logs are maintained and available for audit purposes.

Frequently Asked Questions

Does GDPR apply to my research if I am based outside the EU?
Yes. GDPR applies wherever your participants are located, not where you are based. If you are a US-based researcher conducting interviews with participants in France, Germany, or any other EU member state, GDPR applies to how their personal data is handled throughout your research workflow, including during transcription.

Do I need a DPA with my transcription provider for EU research?
Yes. Article 28 of GDPR requires a written DPA between the data controller (you) and any data processor (your transcription provider) before personal data is shared. Operating without a signed DPA is non-compliant regardless of how secure the provider's systems are. Qualtranscribe provides DPAs on request before any files are submitted.

Can I use a US-based transcription provider for EU participant data?
Yes, with appropriate safeguards. Either the provider stores EU data within the EEA (which eliminates the transfer issue), or an appropriate transfer mechanism such as Standard Contractual Clauses must be in place. Qualtranscribe stores EU participant data in Frankfurt within the EEA, making no transfer mechanism necessary.

What happens if my transcription provider uses my recordings to train AI?
This is a purpose limitation violation under GDPR. Your participants consented to have their data used for your research, not for commercial AI training. Using a platform that does this without specific participant consent and a compatible lawful basis creates direct GDPR exposure. Verify the terms of service of any platform before uploading EU participant data.

Does my consent form need to mention the transcription provider?
Your consent form should describe the transcription process, indicate that a third-party transcription service will be used, and confirm the data protection measures in place. It does not need to name the specific provider, but participants should understand their recordings will be processed by an external service under confidentiality agreement.

What is the difference between a DPA and an NDA for transcription?
A DPA is a GDPR-specific legal agreement covering the data controller and processor relationship, required by Article 28. An NDA is a confidentiality agreement preventing disclosure of information. Both serve different purposes. For GDPR-compliant transcription you need both: a DPA governing the legal processing relationship and an NDA binding the transcriptionist to confidentiality. Qualtranscribe provides both as standard.

How long does Qualtranscribe retain EU participant data?
30 days from upload by default. Deletion on your timeline on request, with confirmation provided. If your ethics committee protocol commits to a specific deletion timeline, communicate this when you submit and Qualtranscribe will confirm deletion within that window.

Is Qualtranscribe suitable for multilingual EU research?
Yes. Human transcription is available in 25 languages including all major European languages, with native speaker matching by regional variety. AI transcription via Instant Draft covers 99+ languages. All EU participant data stored in Frankfurt within the EEA regardless of language.