When a data protection officer or IT manager evaluates a new software tool, the standard questions apply: security baseline, vendor certifications, contract terms. With voice AI tools, one extra question cannot be skipped: where does the audio go? Voice is personal data under both the UK GDPR and the Data Protection Act 2018. That makes choosing GDPR compliant dictation software a compliance decision before it is a productivity one — and it requires a different checklist from most software purchases. This guide gives DPOs and IT managers the framework they need, then shows how Genie 007 already meets every point on it.
What UK and EU GDPR Actually Require From Voice AI Tools
Article 5 of the UK GDPR — mirrored in the EU GDPR — sets seven foundational principles for processing personal data: lawfulness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Voice data sits within all of them. A recording of someone dictating a client email contains identifiable speech patterns, names, and potentially sensitive content. When voice processing is used to identify the speaker uniquely, it can also qualify as biometric data under Article 9 — special category data that requires a higher legal threshold to process lawfully.
For most workplace dictation, the applicable lawful basis under Article 6 is legitimate interests. That basis still requires a balancing test: does the processing respect the reasonable expectations of the individual? An employee dictating work communications is not expecting their audio to be retained on a third-party server in an undisclosed jurisdiction. Article 28 adds a further obligation: any third-party tool processing personal data on your behalf requires a signed Data Processing Agreement before processing begins. Many organisations deploy dictation tools without ever confirming whether such an agreement exists.
The ICO’s Guidance on AI and Data Protection confirms that all seven GDPR principles apply to AI systems in full, with penalties for non-compliance reaching up to £17.5 million or 4% of global annual turnover. Deploying a voice AI tool without assessing how it handles personal data is not a grey area.
Built-In Voice Tools: GDPR Profile and Limits
Apple Dictation processes voice on-device by default from macOS Ventura and iOS 17 onwards. Audio does not leave the device for standard dictation, which means no Data Processing Agreement with Apple is required for this mode. Its limits are practical: it produces a literal transcript of what you say, works inside Apple’s ecosystem, and has no ability to interpret intent or handle 140+ languages with live translation.
Windows Voice Access, built into Windows 11, also performs on-device processing. It requires no cloud connectivity and involves no third-party audio processor — a reasonable GDPR profile for basic dictation. Like Apple Dictation, the output is a plain transcript, with no intelligent formatting or tone adjustment for different platforms or audiences.
Google Docs Voice Typing sends audio to Google’s servers. For organisations, this requires confirming that your Google Workspace agreement covers the relevant data processing terms and that the processing sits within your established lawful basis. Using it to dictate content involving client data without that confirmation creates a compliance gap that is easy to miss in practice.
Dictation Data Residency: Why Server Location Matters
EU or UK data residency — audio and transcripts processed on servers physically within the EEA or UK — simplifies GDPR compliance considerably. When data does not leave these jurisdictions, no Chapter V transfer mechanism is required: no Standard Contractual Clauses, no Transfer Impact Assessment, no Binding Corporate Rules. This is why dictation data residency has become a primary factor in enterprise voice AI procurement.
Server location alone is not sufficient, however. A vendor incorporated in the United States is subject to the US CLOUD Act, meaning US authorities can compel disclosure of data held on EU servers — a risk that Standard Contractual Clauses do not fully address. If a vendor also retains audio after transcription, the residency question is only part of a larger retention problem. When assessing voice AI GDPR compliance, four things must be confirmed: where audio is processed, where transcripts are stored, where any analytics layer operates, and where encryption keys are held. A vendor that documents all four in a signed DPA gives your organisation a defensible position. One that cannot is a liability.
For teams handling GDPR speech to text requirements in sensitive professional environments, on-device processing is the structurally cleanest answer: if audio never leaves the device, there is no processor to contract with and no transfer to justify.
Evaluating GDPR compliant Dictation Software: Five Questions to Ask
Use this checklist before deploying any dictation or voice AI tool across a team handling personal data, client information, or regulated content. Each question maps to a specific GDPR obligation.
| Question | What Good Looks Like |
|---|---|
| Does audio leave the device? | On-device processing, or documented EU-only server processing |
| Is audio retained after transcription? | Zero retention, confirmed in writing in the DPA |
| Is a signed Article 28 DPA available before deployment? | Yes, covering data types, purposes, and security measures |
| Is the vendor subject to the US CLOUD Act? | No — EU or UK-incorporated, or on-device only |
| Is AES-256 encryption applied in transit and at rest? | Yes, documented in the DPA |
A Data Protection Impact Assessment is required under Article 35 of the UK GDPR when processing is likely to result in high risk to individuals. Voice AI tools used with sensitive professional content — legal documents, HR communications, financial records — almost always meet this threshold. The DPIA must be completed before deployment, not retrospectively.
This checklist applies at every scale, from a single consultant dictating client notes to a team rolling out enterprise voice typing across multiple locations. For teams with US-linked healthcare obligations, the HIPAA-compliant dictation software guide covers the additional US regulatory layer alongside these GDPR requirements.
How Genie 007 Meets GDPR Requirements
Genie 007 is built around a privacy architecture that directly addresses the checklist above. Processing happens in-browser or on-device: voice commands and content never touch Genie 007’s servers. There is no audio storage, no logging of what is said, and no data retention after a session ends. The product’s own description is plain: your employer cannot see it, and neither can Genie 007 — because the audio never arrives with them.
For professional environments where voice AI GDPR obligations are a genuine concern, this architecture resolves the core risks at source. A legal consultant dictating case notes does not want audio on an external server. An HR manager drafting a sensitive communication should not have that content stored elsewhere. With Genie 007, neither happens: audio stays local, AES-256 encryption applies to any data in transit, and the zero-knowledge model means Genie 007 cannot produce your content in response to an external demand because it does not hold it.
Genie 007 runs on Windows, Mac, mobile, and as a browser extension — inside Gmail, Outlook, Slack, Notion, Teams, and more. For small business teams without dedicated legal resource, the on-device architecture also removes the overhead of negotiating complex vendor agreements: when audio is not transferred to an external processor, Article 28 is not triggered.
Beyond Transcription: Where Compliant Dictation Becomes Think-to-Text
Compliance with GDPR is a threshold, not a destination. Once cleared, the productivity question becomes: what does the tool actually do with your voice?
Built-in tools — Apple Dictation, Windows Voice Access — produce a transcript of what you said. You still need to edit it, reformat it for the right platform, and restructure spoken thoughts into readable prose. For many professionals, that editing step is where the time saved on dictation is lost again in post-processing.
Genie 007’s Genie Mode works differently. It interprets your intent and generates finished output — a polished email, a structured LinkedIn post, a professional Slack message — from rough spoken notes. You speak for thirty seconds in the way you naturally think; you receive platform-appropriate writing that needs no further editing. Genie 007 also supports live translation across 140+ languages: speak in one language, receive polished text in another, with no separate translation step. That combination of privacy-first architecture and genuine writing intelligence is what separates a compliant tool from a useful one.
Explore how Genie 007 fits into broader AI voice assistant workflows for small business teams, or review pricing plans starting from £5 per month — no credit card required to start.
Frequently Asked Questions
Is voice data personal data under GDPR?
Yes — voice recordings qualify as personal data under Article 4 of both the UK GDPR and EU GDPR because they contain information that identifies an individual, including speech patterns, name references, and content. When voice is used to uniquely identify a speaker — as in biometric recognition — it becomes special category data under Article 9, requiring explicit consent or another specific additional legal condition.
Do I need a Data Processing Agreement for dictation software?
Yes, if the tool sends audio or transcripts to a third-party server: Article 28 of the UK GDPR requires a signed Data Processing Agreement with any processor handling personal data on your behalf before processing begins. Tools that process voice entirely on-device do not transfer data to an external processor, so no Article 28 DPA is required — a significant compliance simplification for on-device tools such as Genie 007.
Does server location affect GDPR compliance for voice AI?
Server location matters significantly: when audio stays within the UK or EU/EEA, no Chapter V transfer safeguards are required. When data is processed in a third country such as the United States, Standard Contractual Clauses and a Transfer Impact Assessment are typically needed. Vendor jurisdiction also matters independently — a US-incorporated company is subject to the CLOUD Act regardless of where its servers are located.
What is a DPIA and when is it required for dictation tools?
A Data Protection Impact Assessment is required under Article 35 of the UK GDPR before any processing likely to result in high risk to individuals. Voice AI tools processing sensitive professional content — client data, HR records, financial information, clinical notes — almost always meet this threshold and require a DPIA before deployment, not retrospectively. The assessment should cover audio routing, retention policies, access controls, and the vendor’s incident response process.
Try Genie 007 Free
GDPR compliance starts with knowing where your voice data goes. Genie 007 processes everything on-device — no audio stored, no server transfers, no data retention — so you get privacy-first dictation that sidesteps the compliance overhead of managing a cloud processor agreement.
Download Genie 007 free — available for Windows, Mac, mobile and as a browser extension. No credit card required.
Written by Bill Kiani, founder of Genie 007.
