Fact · Voice privacy and security
Under Article 28(1) of the GDPR, processing by a processor must be governed by a contract or other legal act that binds the processor to the controller.
Checked against its source on October 17, 2026
In the source's own words
“Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller”
Article 28 GDPR: Processor, gdpr-info.eu (text of Regulation (EU) 2016/679), 2016, Article 28(1).
Open the original- What it measures
- A cloud speech service that processes audio for a business is usually a processor for that business. The contract, often called a data processing agreement, sets out the subject matter, duration, purpose, data types and the processor's obligations.
- What it does not show
- The text is an English reproduction on a reference site. Consumer apps that process audio for their own purposes may be controllers rather than processors, which changes the rules that apply.