Is a voice recording personal data under GDPR?

Yes. A recording of your voice is personal data under the GDPR because it relates to a person who can be identified. The sound does not become special category data by default. It moves into that stricter group only when the processing is done to identify the speaker, and that is a separate question from whether the recording is personal.

The definition is broad, so a voice recording qualifies

The GDPR defines personal data as "any information relating to an identified or identifiable natural person" ¹. A voice carries information about who is speaking. The UK regulator states the same logic for biometric data: "All biometric data is personal data, as it relates to an identified or identifiable individual" ². A voice memo, a dictated email or a recorded call all fit, because a person can be picked out from them directly or by combining them with other information.

The transcript counts too. Microsoft says that audio of people speaking and "the related text transcripts may be considered personal data and/or sensitive data under various privacy regulations and laws" ³. A transcript that is about a named or identifiable person is personal data even though it contains no sound.

Special category status depends on what the processing does

Article 9 prohibits processing "biometric data for the purpose of uniquely identifying a natural person" among the special categories ⁴. The UK regulator puts the trigger in the purpose: biometric data is special category data "whenever you process it 'for the purpose of uniquely identifying a natural person'" ⁵. The same audio can be ordinary personal data when it is transcribed and special category data when it is used to recognize the speaker.

Not every voice product falls in that category. Only processing that identifies or verifies a person does.

Ordinary personal data still carries duties

Personal data brings duties even without Article 9. Under Article 13(2)(a), a controller must tell the person "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period" ⁶. A service that keeps your recordings owes you a retention statement even if it never identifies you.

It depends: anonymous and pseudonymous recordings

A recording stripped of every identifier can fall outside the GDPR, but removing a name is often not enough. Pseudonymised data, where a key links it back to a person, still counts. The GDPR says that personal data which has been pseudonymised "could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" ⁷. A recording kept with an account number or a user ID is therefore still personal data.

Whether a recording is truly anonymous is a question of whether anyone can still link it to a person, not whether a name appears in the file. The more the provider keeps linked data, the less the audio is anonymous.

What to do

1. Ask the provider who is the controller and what lawful basis it relies on for the recordings.
2. Ask how long the audio and transcripts are kept, and how to delete them. Retention is the duty the GDPR puts on the provider from the start.
3. Ask whether any recording is used to identify a speaker. If it is, the special category rules apply, and one exception the GDPR lists is explicit consent for a stated purpose ⁸.
4. If you are a business collecting recordings from people, record each purpose in writing before you start.

Related questions

• Does speech to text collect biometric data?
• Does Illinois BIPA cover voiceprints?
• Is voice data sensitive personal information under the CCPA?

For the wider comparison of GDPR, Illinois and California, read the guide to whether your voice is biometric data. For the definitions, see the biometric data and voiceprint terms.