GDPR and voice data

Under GDPR, a voice recording of an identifiable person is personal data. A voiceprint produced by technical processing to identify someone is special-category biometric data under Article 9, which requires explicit consent or another narrow legal basis.

Why it matters to a buyer

Copyright clearance does not answer the privacy question. Any dataset containing EU speakers triggers GDPR obligations on top of the licence, and AI systems face a dual burden where the EU AI Act applies alongside it. Diligence should ask where the speakers are, not just who owns the recording.

Why it matters to a data owner

If your audio includes EU speakers, documented consent is part of what you are licensing. Without it, the dataset is harder to sell to any buyer with EU exposure.

Current legal status

Voice recordings of identifiable people are personal data under the GDPR. Voiceprints generated by technical processing for identification purposes are special-category biometric data under Article 9, lawful only with explicit consent or another narrow basis — the analysis the EDPB applies to voice in its virtual-voice-assistant guidelines. Where the EU AI Act applies alongside the GDPR, providers of general-purpose models also carry training-data transparency duties, including a public summary of training content required for new models from August 2, 2025.

What fiund does about it

Where speakers are identifiable, fiund requires separate, documented consent alongside the licence, and the consent artifacts sit in the provenance record available in diligence.

Sources

← All rights & provenance guides