Best GDPR-Compliant Transcription Software in Europe (2026): 8 Tools Checked

Vendor facts were checked against each vendor's own pages on 9 November 2026. Prices and policies change, so follow the links before you buy.

A recording of an interview, a lecture or a client call is personal data. When you upload it to a transcription service, that service becomes your processor, and you, the controller, are responsible for choosing it carefully. "GDPR-compliant" badges on landing pages don't tell you much. The documents behind them do.

Short answer:

• For the strictest EU-only setup with published paperwork: Good Tape (Denmark) — EU-only subprocessors, a DPA in your account, ISO 27001.
• For subtitles, translation and transcription in one EU-hosted tool on a small budget: BlaBlaScribe (Poland, servers in Germany).
• For academic and public-sector teams that need ISO certificates and human transcription: Amberscript (Netherlands).
• For full control, if you have engineers: self-hosted Whisper.

Disclosure: BlaBlaScribe is our product. To keep this comparison fair, we judged every tool, including ours, against the same nine checks, linked each claim to the vendor's own documents, and listed our own gaps.

Quick answer: GDPR-compliant transcription software at a glance

"Not published" or "not stated" means we couldn't find it on the vendor's public pages. It doesn't mean the vendor lacks it. Ask before you buy.

What "GDPR-compliant" actually means for a transcription tool

No tool is "GDPR-compliant" by itself. Compliance is about how you use it. A tool can make that easy or hard. Here is what matters legally.

You are the controller, the tool is your processor (Art. 28)

Under Article 28 GDPR, you may only use a processor that gives "sufficient guarantees", and there must be a contract, the data processing agreement (DPA), covering what the processor may do with the data, its security measures, its subprocessors and deletion at the end of the service. The EDPB's Guidelines 07/2020 on controllers and processors explain this in detail.

In practice: if you transcribe other people's voices for work (interviewees, candidates, clients, research participants), you need a DPA with your transcription provider. The easiest providers to work with publish it or let you accept it in your account.

Is EU hosting required? No, but it removes a whole layer of work

The GDPR does not require data to stay in the EU. Transfers outside the EEA are allowed if there is an adequacy decision (the UK has one, renewed in December 2025 until 2031), certification under the EU–US Data Privacy Framework, or Standard Contractual Clauses (SCCs) plus a transfer risk assessment.

The DPF is in force, but a challenge against it is on appeal at the EU Court of Justice (case C-703/25 P), and several European regulators have advised companies to keep an exit plan. An EU-hosted tool with EU-only subprocessors avoids that question entirely.

One more nuance: "EU-hosted" is about where data sits, not who can be compelled to hand it over. A provider with a US parent company may still be subject to US law (such as the CLOUD Act) for data it stores in Frankfurt. If that matters to you, check the corporate structure, not just the data centre.

Is a voice recording "biometric data"?

Some articles say every voice recording is biometric data under the GDPR. That overstates it. Article 4(14) defines biometric data as personal data resulting from specific technical processing that allows or confirms the unique identification of a person, and Article 9 restricts it when processed for the purpose of uniquely identifying someone.

Turning speech into text does not do that. A recording is still personal data, and its content can contain special-category data (health, political opinions, religion). But plain transcription doesn't make it biometric. Voice cloning is different: a voice model built from a sample can identify a person, which is why tools that offer cloning should ask for explicit consent first.

Where the EU AI Act comes in

Speech-to-text is not a high-risk system under the EU AI Act. But Article 5(1)(f) has prohibited inferring emotions in the workplace and in education since 2 February 2025, except for medical or safety reasons. If your meeting or interview tool offers "sentiment" or "emotion" scores on candidates or employees, switch that feature off.

How we evaluated the tools: a 9-point checklist

We only used what each vendor publishes: privacy policy, security page, DPA, subprocessor list and pricing. We did not ask sales teams, because your DPO will also start from public documents.

1. Public DPA (Art. 28). Can you download it or accept it in your account, or do you have to ask?
2. Named hosting provider and region. "EU servers" is a claim; "AWS eu-central-1" is checkable.
3. Published subprocessor list. Who else touches your audio or text?
4. Transfer mechanism for any non-EU processor: adequacy, DPF or SCCs.
5. Does your audio go to a third-party AI provider? Many tools resell another company's speech model.
6. No training on customer data, stated in the privacy policy or DPA, not only on a marketing page.
7. Default retention and deletion, including backups.
8. Independent certification (ISO 27001, SOC 2) and its scope.
9. EU legal entity and lead supervisory authority, so you know who to complain to.

We also note price, free tier and language count. For accuracy, test on your own recordings; see our guide to how transcription accuracy is measured (WER).

The 8 tools, checked

The tools below aren't ranked. They're grouped by what they're best for.

1. BlaBlaScribe — best for transcription, subtitles and translation in one EU-hosted tool

• Who's behind it: Vindrose sp. z o.o., Wrocław, Poland. EU entity; lead authority is Poland's UODO. (Privacy policy)
• Where your audio goes: transcription, subtitle generation and speech/music separation run on BlaBlaScribe's own servers, hosted by Hetzner Online GmbH in Germany. Audio is not sent to third-party AI providers. Two optional features send text: translation and AI summaries send the transcript text to the Google Gemini API, and AI dubbing sends the voice-over script to ElevenLabs (plus a voice sample only if you create a voice clone, with explicit consent). (Security page)
• GDPR paperwork: a public Data Processing Agreement applies automatically when you accept the Terms, no signature needed. A subprocessor list shows what each provider receives and where; changes are announced on that page. Non-EU transfers rely on SCCs or the DPF. Breach notice within 48 hours; data is deleted when you delete your account, and backups roll over within 30 days.
• Encryption: in transit (HTTPS). Files are stored on BlaBlaScribe's own servers in Germany; the storage disks are not encrypted.
• No training: files are "never used to train AI", by BlaBlaScribe or its providers.
• Retention: transcripts, subtitles and translations stay until you delete them. Original media is kept 30 days on the free plan; on paid plans, while the subscription is active and then 60 days (Creator), 9 months (Pro) or 12 months (Business) after cancellation, with email reminders before deletion. You can delete files any time.
• Certifications: none yet.
• Price: 30 free minutes once, no card. Creator $14/month (600 min), Pro $43/month, Business $99/month; about 20% cheaper billed annually. 120+ languages, translation into 50+, dubbing into 27. (Pricing)
• Watch out for: no ISO 27001 or SOC 2 yet, and no encryption at rest. If you use translation or AI summaries, transcript text goes to a US-based processor (Google), so keep those features off for sensitive material if you want an EU-only path. No public API.

2. Happy Scribe — best for subtitle teams who also want human proofreading

• Who's behind it: Happy Scribe Limited, Dublin, Ireland. (Privacy)
• Where your audio goes: AWS and Heroku, with the data centre "in the European Union"; no region named. OpenAI and Anthropic are named in the privacy policy for the AI assistant and connector features. The core transcription engine isn't named. (Security, Privacy)
• GDPR paperwork: the privacy policy refers to a DPA but doesn't say how to get one; the security page says to contact them. Subprocessors are listed on a trust portal with change notifications. Transfers rely on SCCs, the DPF or other Art. 45/46 mechanisms.
• Training: this is the key caveat. The privacy policy describes opt-in consent at signup; with consent, de-identified content may be licensed or shared with third parties for model training. Make sure that box stays unticked on work accounts.
• Retention: deleted files are recoverable for 10 days, then permanently deleted. Backup handling not stated.
• Certifications: SOC 2 Type 2 (scope not stated). ISO 27001 refers to the data-centre provider, not Happy Scribe itself.
• Price: free tier with 10 one-time minutes. Basic from $17/month, or $8.50/month billed annually. 150+ languages. (Pricing)
• Watch out for: the training opt-in, and the DPA not being self-serve.

3. Amberscript — best for universities and public bodies that need ISO certificates

• Who's behind it: Amberscript Global B.V., Amsterdam, with a Berlin GmbH. (Privacy)
• Where your audio goes: Google Cloud Platform in Frankfurt; the security page says data is never stored outside Europe. Unnamed "third parties" transcribe and process audio. (Data security)
• GDPR paperwork: DPA on request via a form (you get a pre-filled PDF). No public subprocessor list. The privacy policy says some partners are outside the EEA but doesn't state the transfer mechanism, which contradicts "never stored outside Europe" on the security page. Ask them to clarify.
• Training: the privacy policy says audio and transcripts are never used to train the language models in use.
• Retention: files are auto-deleted 6 months after upload by default (with reminders); you can switch this off. Backups not stated.
• Certifications: ISO 27001 and ISO 9001 (scope not stated).
• Price: no free tier mentioned. Starter €19/month (5 hours), pay-per-use €10/hour, human transcription from €1.85/min. 90+ languages (machine), 18+ (human). (Pricing)
• Watch out for: unnamed AI partners and an unclear non-EU transfer story.

4. Good Tape — best for the strictest EU-only setup

• Who's behind it: Good Tape ApS, Copenhagen, Denmark. (Security)
• Where your audio goes: a published list of EU-only subprocessors: Google (EU) and Azure (EU, overflow) for transcription, Scaleway for file storage, Supabase and MongoDB for app data. (Subprocessors)
• GDPR paperwork: a standard DPA on Pro and a tailored one on Business, available in account settings; an example is public. (DPA) All vendors are in the EU, so no transfer mechanism is needed.
• Training: "we do not ever train on any data from our users", stated in the policy and DPA.
• Retention: deletion, including backups, within 12 hours. The default is described differently across pages (deleted after processing vs kept as long as you choose), so check your settings.
• Certifications: ISO/IEC 27001:2022, issued 30 January 2026, valid to January 2029 (scope not stated).
• Price: free trial with 1 hour of transcription, no card. Pro €16/month billed yearly (20 hours a month); Business on request. 100+ languages. (Pricing)
• Watch out for: the security page talks about "our own infrastructure", but the subprocessor list shows transcription on Google and Azure (EU regions). It's transcription only: no subtitle styling, translation or dubbing.

5. Trint — best for newsrooms (UK-based, EU tenant available)

• Who's behind it: Trint Limited, London. Transfers from the EU to the UK are covered by the renewed adequacy decision. (Privacy)
• Where your audio goes: separate EU (AWS Frankfurt/Ireland, MongoDB Atlas Ireland) and US tenants. Anthropic is listed as a subprocessor "for internal use". The transcription engine isn't named.
• GDPR paperwork: subprocessors are listed inside the privacy policy. Transfers use SCCs and UK adequacy. A customer DPA isn't mentioned publicly.
• Training: the security page says recordings aren't used to train its algorithms; the privacy policy is silent.
• Retention: content kept until you delete it or close the account; wording differs between the privacy policy and the security page.
• Certifications: ISO 27001:2022 and Cyber Essentials.
• Price: free trial, no free plan. Pro from €69 per seat per month. 50+ languages. (Plans)
• Watch out for: the pricing page lists a "dedicated EU-based server" only on the custom Business plan, so confirm which tenant self-serve accounts land in.

6. Gladia — best for developers who need an EU speech-to-text API

• Who's behind it: Gladia SAS, Roubaix, France. A US affiliate (Gladia Inc.) is a subprocessor. (DPA)
• Where your audio goes: OVHcloud in France by default; some AWS services in the EU and US. The DPA lists data location as "Europe, USA". Single-region processing is by written agreement. Add-ons use OpenAI Ireland, Google Cloud, DeepL and others.
• GDPR paperwork: the DPA is a public web page, with subprocessors in an annex. Transfers rely on SCCs or the DPF.
• Training: on the Self-serve plan (the one with the €50 free credits) your audio may be used for training by default; opting out is free. Enterprise is opted out. (Pricing)
• Retention: not stated for Self-serve on the pricing page; zero data retention is listed for Enterprise.
• Certifications: SOC 2 Type 1 and Type 2. ISO 27001 is listed as "in progress" on the security page, although the homepage claims it.
• Price: €50 free credits; €0.16 per audio hour, down to €0.12 with volume. 100+ languages on Solaria-1.
• Watch out for: opt out of training before you send real data, and set retention yourself.

7. Sonix — strong paperwork, but a US company

• Who's behind it: Sonix, Inc., San Francisco. (Privacy)
• Where your audio goes: AWS in the USA. Enterprise customers can arrange data residency with Sonix's team. Third-party AI providers not disclosed. (Security)
• GDPR paperwork: DPA available in your account on request; transfers via SCCs; no public subprocessor list; not found on the DPF list.
• Training: customer content is never used to train its models.
• Retention: kept until you delete it; backups may persist up to 90 days.
• Certifications: SOC 2 Type 2; HIPAA via a BAA.
• Price: 30-minute free trial; $10/hour pay-as-you-go or $25/month. 54+ languages. (Pricing)
• Watch out for: non-Enterprise data is processed in the US, so you need SCCs and a transfer assessment.

8. Whisper, self-hosted — best for full control (if you have engineers)

• What it is: OpenAI's speech model, released as open source under the MIT licence. Run it on your own servers or an EU cloud and no third party touches your audio.
• GDPR paperwork: you are the controller and the infrastructure owner. Security, access control, deletion and documentation are all on you.
• If you use OpenAI's hosted API instead: API data isn't used for training by default, the transcription endpoint is eligible for zero data retention, and EU data residency is available for eligible projects. OpenAI is a US company and was not found on the DPF list when we checked. (OpenAI: your data)
• Watch out for: no editor, speaker labels or subtitle export out of the box, and accuracy varies by language and model size. Compare the effort in Whisper vs paid transcription tools.

What about Otter.ai, Fireflies and Rev?

These are popular US services. Each can be used under the GDPR, but with more paperwork and less control:

• Is Otter.ai GDPR compliant? Otter.ai, Inc. is certified under the EU–US DPF and publishes a DPA (in its Terms) and a subprocessor list. Its privacy policy says it trains its own AI on de-identified audio and transcripts, and hosting is AWS with no EU residency stated. Supports 6 languages. (Privacy, Subprocessors)
• Fireflies.ai is DPF-certified, with a published DPA and subprocessor list, but processing is in the US and transcription is done by a third party (AssemblyAI). (DPA)
• Rev publishes a self-executing DPA with SCCs; processing is in the US, with human transcription partly in India. It says it doesn't train external models on your content, but its help centre describes an opt-out from training Rev's own speech models, so ask support to opt you out. (DPA, Help centre)

For meeting recordings, also check consent rules: see is it legal to record a meeting in the EU and US.

Which GDPR-compliant transcription tool should you choose?

• Academic interviews with ethics approval: Amberscript or Good Tape if the ethics board wants ISO 27001; BlaBlaScribe if budget matters and you keep translation off for sensitive data. See transcription for researchers.
• Journalism and source protection: Good Tape (EU-only, fast deletion), or self-hosted Whisper for the most sensitive sources. See transcription for journalists.
• HR interviews and recruiting: any EU-hosted tool with a DPA; switch off sentiment and emotion features (AI Act), and tell candidates in advance.
• Agency or consultancy client calls: Good Tape or BlaBlaScribe for EU processing; Trint if your team is UK-based.
• Subtitles and translation for EU video: BlaBlaScribe (transcription in Germany; translation sends text only) or Happy Scribe (keep the training opt-in off).
• Developers building a product: Gladia (opt out of training, set retention), or the OpenAI API with EU residency.
• Zero trust or air-gapped: self-hosted Whisper.

GDPR checklist before you upload your first recording

1. Sign or accept the DPA and save a dated copy of the subprocessor list.
2. Add the processing to your record of processing activities (Art. 30).
3. Decide whether you need a DPIA (Art. 35): likely if recordings include health data, children, vulnerable people or large-scale monitoring.
4. Inform participants or get consent before you record, and tell them which service will transcribe it. See how to transcribe an interview.
5. Turn off optional AI features that send data to extra processors if you don't need them, and opt out of training wherever there's a toggle.
6. Pseudonymise: replace names in the transcript, then delete the original audio once you've checked it.
7. Set a retention period and delete originals on schedule.
8. Talk to your works council (Germany, Netherlands, France and others) before recording employees.
9. Re-check the vendor yearly: subprocessors and transfer mechanisms change.

FAQ

Is AI transcription GDPR compliant?

It can be. AI transcription is lawful under the GDPR if you have a legal basis for recording, a data processing agreement with the provider, and the provider protects the data and transfers it lawfully. The tool alone doesn't make you compliant; your setup does.

Do I need a DPA with my transcription provider?

Yes, if you transcribe other people's personal data on behalf of your organisation. Article 28 GDPR requires a written contract between controller and processor. Prefer providers that publish their DPA or let you accept it in your account.

Does GDPR require transcription data to be stored in the EU?

No. Transfers outside the EEA are allowed with an adequacy decision, EU–US Data Privacy Framework certification, or Standard Contractual Clauses. EU hosting with EU-only subprocessors simply avoids the extra transfer assessment and the legal uncertainty around the DPF.

Is Otter.ai GDPR compliant?

Otter.ai can be used under the GDPR: it is certified under the EU–US Data Privacy Framework and offers a DPA. But it processes data in the US, and its privacy policy says it trains its own AI on de-identified recordings and transcripts. Many EU organisations prefer an EU-hosted alternative for that reason.

Is OpenAI Whisper GDPR compliant?

Self-hosted Whisper is as compliant as your own infrastructure, because no third party receives the audio. OpenAI's hosted API doesn't train on API data by default, offers zero data retention for transcription and EU data residency for eligible projects, but OpenAI remains a US processor.

Do I need consent to transcribe an interview?

Not always. Consent is one legal basis; legitimate interest, contract or public-interest research may apply instead. You always have to inform people that they're being recorded and transcribed, and many ethics boards require written consent anyway.

Is a voice recording biometric data under GDPR?

Usually not. A voice becomes biometric data only when it's processed with specific technology to uniquely identify a person. Plain transcription doesn't do that. Voice cloning or speaker identification can, so those features need extra care and explicit consent.

Can a transcription service use my files to train its AI?

Only if its terms allow it. Some providers never train on customer data (Good Tape, Sonix, BlaBlaScribe), some do so on de-identified data (Otter.ai), and some offer opt-in or opt-out toggles (Happy Scribe, Gladia, Rev). Check the privacy policy, not just the marketing page.

Conclusion

Three takeaways:

1. Check the paperwork, not the badge. A public DPA, a named host and a subprocessor list tell you more than "GDPR-compliant" on a landing page.
2. EU hosting makes life easier, but it doesn't replace a DPA. And a US parent company can matter even when the servers are in Frankfurt.
3. Know where your audio and your text go. Many tools keep audio in the EU but send transcripts to a US AI model for summaries or translation.

If you want EU-hosted transcription, subtitles and translation in one place, try BlaBlaScribe free: 30 minutes, no card, transcribed on our own servers in Germany. Read exactly how we handle your recordings before you upload anything.