--- title: "GDPR-Compliant Speech Data Collection | YPAI" url: https://ypai.ai/speech-data/gdpr-compliant/ description: "GDPR-compliant speech data collection with verifiable consent chains. Art. 6 lawful basis, Art. 9 biometric compliance, full audit trail." source: "src/copy/routes (route /speech-data/gdpr-compliant/)" --- # Voice is personal data, and sometimes biometric. Every second of delivered speech carries its lawful basis. > GDPR-compliant speech data collection with verifiable consent chains. Art. 6 lawful basis, Art. 9 biometric compliance, full audit trail. Speech datasets collected under GDPR Article 6 consent, with Article 7 conditions met, explicit consent where Article 9 applies, and the consent id, timestamp and origin on every file. EU AI Act obligations for high-risk systems are covered on the AI Act risk classification page. The article register, and what each one means for the corpus Art. 6(1)(a) - Consent, obtained as its own affirmative action before recording. The basis is defined per engagement and documented. Art. 7 - Freely given, specific, informed, unambiguous. Recorded with timestamp and version. Withdrawable at any time. Art. 9 - Where voice is processed for identification or verification it is biometric data, and consent is explicit. Arts. 12 to 23 - Access, rectification, erasure, restriction and objection, handled operationally against the recordings a request touches. Art. 28 - The DPA, executed before production collection. Processor for custom collection, independent controller for licensing. ## Three facts hold across every dataset. Consent, EU sourcing, a closed collection model. Every speaker is a contracted, identity-verified contributor recording inside YPAI's own platform. The dataset arrives with the consent chain that makes it usable in production. - Explicit participant consent with documented lawful basis (Art. 6) - EU-based data sourcing, storage, and governance - Closed collection model, contracted contributors recording on YPAI's platform - **GDPR Art. 6 basis**: Consent, Art. 6(1)(a) - **Biometric derogation**: Explicit consent where Art. 9 applies - **Data residency**: EEA by default for European engagements - **Sourcing**: Contracted, identity-verified contributors on the YPAI platform - **Rights**: Access, rectification, erasure, restriction and objection, handled operationally - **Lineage**: Consent id, collection timestamp and origin log per file Every file links to a consent record. ## Provenance is a go or no-go criterion. Three places speech data fails review. art. 6 · art. 9 · lifecycle For enterprise organisations, data provenance is now a go or no-go criterion for model deployment. European regulators review the lawful basis on which training datasets were acquired, under GDPR Article 6. Where the lawful basis of a training set cannot be shown, a model trained on it may face a mandatory deletion order. The consent record is what shows the basis. - **GDPR Art. 6**: Voice is a biological identifier. Even without metadata, speech content and acoustic markers can re-identify individuals. Speech is handled as personal data, with pseudonymisation plus a lawful basis. - **GDPR Art. 9**: Voice data can constitute biometric data when processed for identification or verification. That triggers special-category status, and the legal bar rises from legitimate interest to explicit consent. Scraped data fails here completely. - **Lifecycle**: Liability persists across model versions. If the original dataset provenance cannot be verified years later, the model itself is compromised. Audit traceability has to hold for the full retention period, well past the day of delivery. ## Speech datasets for enterprises, delivered with the consent and provenance records a compliance review asks for. Off-the-shelf corpora and custom scoped collection, each delivered with the compliance artefacts your legal and procurement teams will ask for. - EU-sourced speech corpora for training, evaluation and fine-tuning, delivered as structured, annotated audio with full demographic metadata. - Custom collection against the demographic, acoustic and linguistic requirements you specify. Data is collected within YPAI's controlled platform by contracted contributors. - Every dataset delivery includes lineage records per file: consent ids, collection timestamps and geographic origin logs. - Commercial frameworks designed for procurement: Master Services Agreements, Data Processing Agreements and explicit indemnification clauses. These controls apply to all speech datasets delivered by YPAI. ## Consent, Article 6(1)(a), backed by an affirmative action from every speaker. art. 6 · art. 7 · recital 32 YPAI structures all data collection under defined GDPR Article 6 lawful bases, primarily consent. Controlled collection means every second of speech in a delivered dataset carries an affirmative action from the data subject. Consent must be freely given, specific, informed, and unambiguous indication of the data subject's wishes. - **Disclosure**: Participants are told exactly how their voice data will be used, including AI training. - **Granularity**: Consent is separate from other terms and conditions. - **Revocability**: Participants are informed of their right to withdraw consent at any time. - **Unbundled**: Participation stands on its own; it is never conditional on unrelated data sharing. Detailed consent framework documentation, including exact copies of the participant agreements used for your dataset, is available for legal review during evaluation. ## Rights are handled in operational terms. A request maps to the recordings it touches. Indexed metadata is maintained for all contributors. On an authenticated subject access request, the repository is queried to locate the specific recordings associated with a user id within any delivered dataset. When a valid deletion request is processed, data is purged from active storage. "Do not use" flags propagate to client deliverables where contractually enforceable. Where deletion is not technically reversible in trained models, YPAI documents the withdrawal and enforces non-use in future training and deliveries, consistent with prevailing regulatory guidance. Deletion logs are kept for audit review. This framework governs how YPAI delivers speech data into production AI environments, so the consent documentation holds for the model's lifetime. ## Having data and defending data differ by one thing, provenance. The lineage is built at collection, before delivery: the contributor's identity is verified and the consent record is timestamped. The metadata structure lets a client answer audit questions years after deployment: where did this specific training vector come from, and did we have the right to use it? { "file_id": "ypai_29841", "origin": "EU_FR_PARIS", "consent_id": "c_9928_v2_signed", "lawful_basis": "GDPR_ART_6_1_A", "demographics": { "yob": 1992, "gender": "female" }, "collection_date": "2024-02-14T10:00:00Z" } ## Where the data lives, who controls it, and how it is protected. By default, YPAI processes and stores data within the EEA for European engagements. Cloud region and residency are specified per project in the DPA; transfers are governed by SCCs where applicable. Roles are explicitly defined in the Master Services Agreement and follow the engagement structure: data processor for custom collection, independent controller for licensing. Technical and organisational measures include encryption at rest and in transit, strict role-based access control, and automated retention and deletion policies so data is held only for its defined purpose. Key management and customer-scoped keys are specified per project in the DPA and security annex. - **Cloud regions**: EU jurisdiction by default; region and residency specified per project - **Transfers**: Governed by SCCs where applicable - **Custom collection**: YPAI as data processor - **Licensing**: YPAI as independent controller - **Encryption**: At rest and in transit; key management specified per project - **Retention**: Automated deletion at end of defined purpose ## Contracted contributors under a direct legal relationship. The provenance that open marketplaces cannot reconstruct. YPAI runs a closed-loop collection service. Contributors are contracted and identity-verified, and the legal relationship with each data subject is direct. - Speaker identity cannot be checked, so one person can enrol many times - Farmed or synthetic recordings can enter the pool - Consent is weakly enforceable across jurisdictions - Device fingerprinting and environment checks on every session - A direct legal relationship with every data subject ## Bring the requirement. The compliance documentation for your jurisdiction follows. Tell us the use case, the timeline and the compliance requirement. Our team replies within one business day with the documentation relevant to your case. Our team will be in touch inside one EU business day. ## Basis, biometrics and rights ### Which lawful basis applies to a delivered dataset? Consent under GDPR Article 6(1)(a) is the primary basis. Where voice is processed for identification or verification and Article 9 applies, consent is explicit. The applicable basis is defined per engagement and documented in the participant materials and the DPA. ### How is consent demonstrated during an audit? Every delivered file carries a consent id, a collection timestamp and an origin log. The exact participant agreements used for your dataset are available for legal review during evaluation. ### What happens when a participant withdraws? Data is purged from active storage, "do not use" flags propagate to client deliverables where contractually enforceable, and the withdrawal is documented so non-use holds in future training and deliveries. ### Where is the data processed and stored? Within the EEA by default for European engagements; the region and residency are specified per project in the DPA. Transfers outside the EEA are governed by Standard Contractual Clauses where applicable. ### Is YPAI the controller or the processor? Data processor for custom collection, independent controller for licensing. The role is written into the Master Services Agreement and the DPA for each engagement. Bring the model and the market. The consent chain comes with the corpus. A use case, a timeline and the regulatory context are enough to start. The consent framework, the DPA and the audit package follow from scoping. - [Speech data overview](https://ypai.ai/speech-data/) - [Consent framework](https://ypai.ai/speech-data/consent-framework/) - [DPA overview](https://ypai.ai/speech-data/dpa/) - [Retention and deletion](https://ypai.ai/speech-data/retention-deletion/) - [Data residency and sub-processors](https://ypai.ai/speech-data/data-residency/) - [AI Act risk classification](https://ypai.ai/speech-data/ai-act-risk-classification/)