Voice Data under GDPR

Who it applies to

GDPR reaches a buyer in two ways. If you or the seller are established in the EU, Article 3(1) applies to processing in the context of that establishment. If neither of you is, Article 3(2) can still reach you where the processing relates to offering goods or services to people in the EU or to monitoring their behavior there. The safest assumption for a dataset containing EU speakers is that GDPR questions attach to the chain, because the collector who recorded them in the EU was subject to it in any event.

In practice the constraint that binds most deals is downstream rather than regulatory. EU enterprise customers will not accept a voice corpus without a documented basis, and a US buyer selling into Europe will be asked to demonstrate the same chain by its own customers. That is true regardless of whether a supervisory authority ever looks at the file.

Two categories need separate handling rather than the same form with a different name. Children's speech requires guardian consent and a stated permitted use, and it is the category most likely to be scrutinised. Data collected from call centers or telephony is usually unusable, because the other party to the call was never asked.

• Recordings made for the purpose of training, with speaker consent: the straightforward case, and the one the checklist below is written for.
• Repurposed archival or broadcast audio: the original consent almost never covers AI training, so the analysis usually fails.
• Call recordings and telephony data: one party is generally missing from the consent chain, which is why we decline these projects.

How to comply when you are buying data

A defensible voice dataset is built as a chain, and every link is a document. The questions below are the ones that decide whether the chain holds when someone else reads it.

On projects involving EU speakers we build consent documentation to these requirements and deliver it with the dataset rather than holding it back, and the transfer mechanism is addressed in the agreement rather than left implicit. We also decline work where the chain cannot be made sound, including call recordings and any dataset where the speakers were not told what the data would be used for.

We are a sourcing company, not a law firm. Nothing here is legal advice, and whether a particular dataset is permissible depends on your use case and your jurisdiction. Our role is to make the facts of the chain accurate and legible so that your counsel can assess it.

• Get the lawful basis in writing, and make it match the use. If the basis is consent, the consent text should name AI or machine learning training as a purpose, not merely recording or research.
• Ask for the Article 13 notice, not just the signature page. A signed form that never told the speaker the purpose is a weak consent, and the notice is the document that shows the purpose was communicated.
• Check the transfer mechanism if the data crosses a border. EU speakers plus non-EU training infrastructure is a restricted transfer and needs its own legal basis on top of the consent.
• Require a speaker identifier on every file. Without it, an access or erasure request cannot be actioned, and the dataset cannot be repaired once it has been distributed.
• Ask whether the dataset is intended for identification or verification. If it is, the Article 9 analysis applies and you need an explicit consent record, not a general one.

How we handle consent and licensing →