Cybersecurity Policy Report, Spanish Privacy Regulator Analyzes Data Protection Issues in AI Voice Transcription, (Apr 21, 2026)

By Tony Foley

The Spanish data protection agency, Agencia Española de Protección de Datos (AEPD), has released its analysis of the impact of data protection on voice transcription services using artificial intelligence (AI), including a discussion of responsibilities under the European Union’s General Data Protection Regulation (GDPR).

Noting that the integration of AI into automated transcription services represented a significant advance for operational efficiency, AEPD’s analysis concluded that it also introduced new challenges related to GDPR compliance. Organizations choosing to incorporate AI-based voice transcription services transform these processes into the processing of personal data and they become data controllers under the law.

AEPD said data controllers and processors must exercise due diligence when selecting appropriate AI products, services, and applications for voice transcription, taking into account the risks associated with their use. The selection should be limited to technologies that demonstrate their ability to enable informed decision making and offer guarantees that ensure GDPR compliance via the proper implementation of appropriate technical and organizational measures. The agency clarified that this diligence may not be limited to procurement but must be maintained throughout the entire processing lifecycle. Data protection rights should be considered when developing and designing AI products, services, and applications, assessing risks like systemic errors, linguistic bias, or the potential inference of sensitive information.

The analysis specifies that a transcript produced via an AI service is not neutral text but rather a representation attributed to a specific person within the framework of a processing activity where controllers are obligated to comply with principles contained in GDPR article 5. Citing examples of potential transcription errors, AEPD said they weren’t mere technical errors, instead creating a situation with direct legal relevance. When an incorrect transcription attributes information to a person that does not correspond to what was actually stated, the responsible party has an obligation to ensure its rectification without undue delay, in accordance with the GDPR article 16.

Controllers must anticipate such errors by adopting appropriate measures to prevent, detect, and correct inaccuracies, including through informing data subjects of a system’s potential limitations providing human oversight of transcriptions, and implementing clear and effective review and correction procedures. In addition, GDPR article 15 gives data subjects the right to receive effective knowledge of the personal data concerning the subject, without any restrictions based on technical difficulties or the existence of third-party data. Specifically, AEPD said it was not permitted under the GDPR to generally deny access to video recordings simply because of the presence of third parties, pointing out the technical means to protect the rights of third parties like anonymization or image-blurring technologies. The agency further outlines the requirements controllers must meet to ensure transparency in the context of voice recording, including making data subjects aware that their data in being processed during the recording process.

News: InternationalLegislation DataPrivacy GDPR AINews