Fact · Voice privacy and security
Under GDPR Article 28(2), a processor cannot engage another processor without the controller's prior written authorization, either specific or general.
Checked against its source on October 17, 2026
In the source's own words
“The processor shall not engage another processor without prior specific or general written authorisation of the controller.”
Article 28 GDPR: Processor, gdpr-info.eu (text of Regulation (EU) 2016/679), 2016, Article 28(2).
Open the original- What it measures
- A dictation vendor that uses a cloud speech service is a processor for its customers' data, so this rule covers the speech provider it hires.
- What it does not show
- Article 28 applies to personal data under EU law. Whether a given vendor is a processor depends on its contract and role.