What is GDPR?
The EU data protection regulation, which places strict limits on how personal data may be collected and used.
If the data concerns anyone inside the EU, GDPR can apply regardless of where the company is registered.
For speech data the two relevant parts are lawful basis and data subject rights. The first requires you to say why you were allowed to collect it, the second requires you to act on a deletion request.
Where GDPR applies
GDPR follows the person rather than the company. If a dataset contains recordings of people in the EU, the regulation can apply to how that data is processed, wherever the buyer or the supplier is registered. For a cross-border project this is why the source end matters: a delivery can be arranged entirely outside Europe and still be in scope.
Within the regulation, data is graded. Ordinary personal data carries the general rules. Special categories carry stricter conditions, and biometric data used to identify a person is one of them, as is health data. The same audio can fall into either grade depending on what it is used for: a recording of someone reading a script is ordinary data, the same recording processed to identify them by voice is not.
The regulation is built on principles rather than a list of permitted acts: a lawful basis for collecting the data, a purpose that is stated and stayed within, limits on how long it is kept, and rights the person can exercise, including access to their data and deletion of it. For a data purchase, those principles turn into questions the supplier has to be able to answer.
What GDPR means for a data purchase
Ask where the speakers were, not where the supplier is. If anyone in the dataset was in the EU, GDPR questions will come up, and the supplier should be able to say what lawful basis the collection relied on and how that basis covers training use, not just the act of collection. A basis that covers collection but not training is a common gap to find late.
Ask how a deletion request would be handled. GDPR gives people the right to have their data erased, and the practical question for a buyer is whether one person can be found inside a delivered dataset. That requires a speaker manifest tying files to people, and it is far easier to require before collection than to reconstruct afterwards.
If the data crosses a border, ask what covers the transfer; moving personal data out of the EU is itself regulated, and the answer is a document, not a statement of intent. These questions (where the people were, what the lawful basis was, how deletion would work) are the same ones a buyer's legal review will ask, so asking them first saves a round of rework.
Related terms
-
Data Compliance
Where the data came from, whether it may be used that way, and whether there is paper to prove it. That whole chain is compliance.
-
PII
Personally Identifiable Information, anything that can identify a specific individual, directly or indirectly.
Keep reading
-
Full glossary
Every term we explain, in one list.
-
How to buy training data
Where these terms actually show up, and which ones change a quote.
-
Help center
How a project runs, from specification to delivery.
Submit a sourcing request
Tell us the language, the hours, and what the data needs to look like. You will get a real number and a real timeline, not a range. If we cannot source it well, we will tell you that instead.
- Pilot batch before the full run, so problems surface early.
- Consent documentation delivered with the data.
- No medical or clinical data. No recorded telephone calls.
- You send the spec Language, hours, recording conditions, and the deadline.
- We reply within two business days A real number and a real timeline, not a range.
- You approve a pilot batch A small run first, so problems surface before the full order.
- Full run, then delivery with documents Audio, transcripts, and the consent record for every speaker.