The GDPR checklist for transcription: cloud vs local
| Requirement | Cloud transcription service | Local software (Scrieb) |
|---|---|---|
| Lawful basis and consent (Art. 6, 9) | Needed | Needed |
| Inform participants (Art. 13, 14) | Needed; list the vendor as a recipient | Needed; no vendor to list for the content |
| Signed DPA (Art. 28) | Required with the vendor and its sub-processors | Not for the content: no one else processes it |
| Transfer outside the EU (Art. 44 ff.) | Check where audio is processed; SCCs or adequacy | None for the content |
| EU servers | Ask; sub-processors may still be outside the EU | Not applicable: the computer is the server |
| Security of processing (Art. 32) | Vendor’s measures plus yours | Yours: disk encryption, screen lock, optional database encryption |
| Data breach (Art. 33, 34) | Vendor must notify you; you notify the authority | Scope is your device and your backups |
| Retention and deletion | Vendor’s retention; check training use | You delete the recording in the app |
| Access requests (Art. 15) | Data may sit with you and the vendor | Everything is in one place |
Three rows disappear with local processing: the DPA, the transfer and the vendor's security and retention. The duties that come from recording people at all, a lawful basis, informing them and deleting on time, stay with you either way.
Three GDPR questions every cloud transcription tool raises
Who is the processor? (Art. 28)
Uploading a recording makes the service a processor. You need a signed DPA covering the service and its sub-processors, often including a speech-recognition provider you have never heard of.
Where does the audio go? (Art. 44 ff.)
If audio is processed outside the EU, the transfer needs a legal basis such as an adequacy decision or standard contractual clauses, plus a check of the recipient country.
What happens to it afterwards? (Art. 5, 32)
How long recordings and transcripts are kept, whether they train models, who at the vendor can access them, and how a breach would be reported.
What Scrieb processes, and where
- On your computer: the recording, the transcript, speaker labels, summaries and the AI chat. Transcription runs on OpenAI's Whisper model, locally.
- On Scrieb's server: your sign-in email, a random device ID, the app version and a usage counter in seconds, for licensing. Never audio or text.
- Optional: usage statistics can be switched off, and subscribers can turn on an offline mode in which the app makes no connections on its own.
- Your side: keep recordings on an encrypted disk, lock the computer, and delete recordings in Scrieb when you no longer need them. Scrieb can also encrypt its database, with the key in the system keychain.
Full details, including sub-processors for billing and email: data protection and security.
Who needs this most
Lawyers and law firms
Client conversations under professional secrecy, where every additional recipient has to be justified.
Doctors and therapists
Health data is special category data under Art. 9; keeping it on one controlled device keeps the chain short.
Researchers
Consent forms and data management plans that rule out third parties for interview recordings.
HR teams
Interviews and employee conversations, without adding a new processor for each tool.
Pricing
Free plan: 1 hour of recording per day. Pro: no minute limits, one licence for Mac and Windows.
Try it on your own recordings
Frequently asked questions
- What does GDPR-compliant transcription mean?
- That the transcription is done in a way that meets GDPR for the personal data in the recording: a lawful basis for recording, informed participants, a data processing agreement with any service that processes the audio, safeguards for transfers outside the EU, appropriate security, and deletion when the data is no longer needed. No tool is compliant on its own; tools make some of these steps easier or unnecessary.
- Do I need a DPA to use Scrieb?
- Not for the content. Scrieb processes the recording and the transcript on your computer and never receives them, so it is not a processor of that data. Scrieb’s server only handles account data: your sign-in email, a device ID, the app version and a usage counter.
- Do I still have to inform the people I record?
- Yes. Articles 13 and 14 apply to you as the controller, wherever the processing happens. Tell participants that you record, why, and how long you keep it. Local processing means you have fewer recipients to list, not none of the duties.
- Is an EU-hosted cloud service enough?
- It removes the transfer question, but not the processor: you still need a DPA, must check sub-processors (often US-owned), retention and whether audio is used to train models. Local software removes the processor for the content altogether.
- What is the difference between Scrieb and the OpenAI Whisper API?
- The API sends audio to OpenAI’s servers for processing. Scrieb runs the same Whisper model on your own computer, so the audio is never sent anywhere.
- Can Scrieb be used for health data or client confidential recordings?
- Yes, and that is the main reason people choose it: special category data and privileged conversations stay on a device you control. You remain responsible for the device: disk encryption, access control and deletion.