Voice Typing and GDPR: Is Your Voice Personal Data?

Every time you use a voice typing tool, you transmit far more than words. Your voice contains unique biometric information: timbre, intonation, rhythm, accent. If stored or exploited, this data can identify you as reliably as a fingerprint. In a professional context, your dictations may also contain confidential information — client names, financial data, internal strategies.

The question is no longer whether voice typing is useful. It undeniably is. The real question is: what happens to your voice once you stop speaking?

In brief

• Your voice is personal data (GDPR, Art. 4); a biometric recording falls under the special categories (Art. 9), subject to reinforced restrictions.
• In cloud mode, audio is sent only for the time needed to transcribe it and is not retained by Ondula.
• The 100% local mode (Windows) goes further: your voice never leaves the PC — no transmission to secure, no server to audit.
• By contrast, several cloud tools (Windows dictation via Azure, Otter.ai) systematically send audio to servers, sometimes outside the EU.

What GDPR Says About Voice Data

Voice Is Personal Data

The General Data Protection Regulation (GDPR) is clear: voice data constitutes personal data under Article 4. When it allows identification of a person — which is the case with voice recordings — it falls under the full scope of the regulation.

This means any service that collects, processes, or stores your voice must:

• Have a legal basis for doing so (consent, legitimate interest...)
• Clearly inform you of how it is used
• Allow you to exercise your rights (access, deletion, portability)
• Guarantee data security

Biometric Data: A Sensitive Category

Article 9 of the GDPR classifies biometric data among "special categories of personal data," subject to reinforced restrictions. If a service uses your voice for identification (voice authentication, profiling), the legal obligations are even stricter.

The Problem with Most Dictation Solutions

Opaque Privacy Policies

Most voice typing tools on the market adopt deliberately vague privacy policies. Behind phrases like "we may use your data to improve our services" often hides a concerning reality: your voice recordings are stored, analysed, and sometimes used to train artificial intelligence models.

Extended Storage: A Major Risk

Some solutions retain your voice recordings for weeks, months, or even indefinitely. The longer your data is stored, the greater the risk of leaks or unauthorised exploitation. Data breaches are not theoretical hypotheses — they regularly make headlines.

Transfers Outside Europe

Many voice typing services are hosted in the United States or Asia. Your voice data then crosses borders, and GDPR protections no longer apply in the same way. The Schrems II ruling by the Court of Justice of the European Union notably invalidated the Privacy Shield, questioning the legality of many data transfers to the United States.

Data Reuse for Training

Several major market players use their users' voice data to improve their speech recognition models. Your voice, your words, your professional conversations then serve as raw material for training algorithms — often without you being clearly informed.

The Ondula Approach: Privacy by Design

In the Cloud, Audio Is Only Processed for the Time It Takes

A fundamental principle of Ondula: in cloud mode, audio is sent only for the time needed to transcribe it. Once transcription is complete, the audio is not retained by Ondula.

In 100% local mode, the guarantee is structural: your voice never leaves your computer, so there is nothing to transmit or retain on the server side.

Where is your voice processed?

Ondula offers two processing modes. In 100% local mode, your voice never leaves your computer: nothing is transmitted. In cloud mode, audio is sent only for the time needed to transcribe it and is not retained by Ondula. Your account data, meanwhile, stays hosted in the European Union (Frankfurt).

For the most sensitive uses, local mode offers the strongest guarantee: no voice data is transmitted. In cloud mode, audio is sent only for the time needed to transcribe it and is not retained by Ondula.

Cloud: Temporary Transmission

Cloud mode sends audio only for the time needed to transcribe it. Once the text has been returned, Ondula does not retain that audio.

Local: Voice Stays on the PC

Local mode processes your voice directly on your computer. It never leaves the PC.

The 100% Local Mode: Your Voice Never Leaves the PC

The single Ondula app installed from the Microsoft Store includes Cloud and a 100% Local mode: transcription runs directly on your computer, with audio never crossing any network. Local includes 1 free hour per machine (3 hours with a free account), followed by a 29.99 EUR excluding tax lifetime unlock completed inside the app.

Comparison: Where Is Your Audio Processed?

The table below summarises, for the main tools, where audio is processed and whether it is sent to the cloud.

Privacy data verified on 11 July 2026 (official pages and vendor documentation). Local processing is the only configuration where audio never leaves the device.

Why Privacy Should Be Your First Criterion

For Professionals

If you dictate medical reports, legal opinions, confidential meeting notes, or strategic communications, the security of your voice data is not a luxury — it is a legal and ethical obligation. A lawyer dictating client case details on a service that stores and reuses data faces major risks.

For Organisations

GDPR provides for fines of up to 20 million euros or 4% of global annual turnover for the most serious violations. Using a voice typing tool that does not comply with European regulations puts the entire organisation at financial and reputational risk.

For Everyone

Even if you only dictate personal messages or informal notes, your voice remains biometric data. You have the right to know what happens to it, and the right to choose a service that respects it.

Best Practices for Protecting Your Voice Data

1. Read Privacy Policies

Before adopting a voice typing tool, carefully read its privacy policy. Look for clear answers to these questions: are recordings stored? For how long? Where are they processed? Are they used for training?

2. Prefer European Solutions

Services hosted in Europe and subject to GDPR offer a higher level of protection. This is an objective and verifiable criterion that protects you legally.

3. Check the Deletion Policy

A reliable service must be able to guarantee immediate deletion of your voice data after transcription. If the deletion policy is vague or non-existent, that is a red flag.

4. Avoid "Free" Solutions with No Clear Business Model

If a voice typing service is entirely free with no apparent business model, there is a strong chance your data is the product. Ondula offers a free tier of 10 transcription minutes every week, refilled automatically with no end date, followed by the Cloud subscription (3.90 EUR/month excluding tax, 50h/month).

What GDPR Guarantees You

As a European user, GDPR grants you fundamental rights:

• Right of access: know what data is collected about you
• Right to erasure: request deletion of your data
• Right to portability: retrieve your data in a usable format
• Right to object: refuse certain processing of your data
• Right to restriction: limit the use of your data

Ondula fully respects these rights. And in 100% local mode, most of these questions don't even arise: since no voice data is transmitted, there is nothing to access, transfer, or delete on the server side.

Privacy Is Not a Trade-Off

For a long time, voice typing users had to choose between performance and privacy. The most accurate solutions were also the most intrusive when it came to data.

This trade-off is no longer necessary. Ondula offers two approaches: in local mode, your voice never leaves the PC; in cloud mode, audio is sent only for the time needed to transcribe it and is not retained by Ondula.

Your voice belongs to you. It should stay that way. Try Ondula and take back control of your voice data.