Speech data · Data processing agreement
Executed before the first recording. The DPA, and what it puts on paper.
Roles, processing scope, consent and provenance, sub-processors, retention and audit access, fixed in the agreement before production collection begins. Draft terms come to your legal team during scoping.
Structure of the agreement
Data Processing Agreement
Speech data collection and processing
- Roles and responsibilities
- Processing scope and data categories
- Consent, provenance and audit trail
- Sub-processors
- Retention and deletion
- Security, access and audit
Executed before production collection begins
Clause · Roles controller · processor
Who is the controller is decided per engagement, and written down.
The role follows from the nature of the processing and the contractual requirements.
- Processor engagements
- YPAI processes personal data on behalf of the client organisation according to documented instructions. The client remains the Controller.
- Independent controller engagements
- In certain arrangements, YPAI acts as an Independent Controller for specific processing activities. This is documented in the engagement agreement.
Role definitions, responsibilities and obligations are specified in the DPA and reviewed during scoping.
Clause · Scope five categories, each with its purpose
What is processed, and for which purposes.
Speech data collection workflows involve processing of audio recordings and associated metadata. The DPA Annex lists the categories and the purposes each one serves.
| Data category | Held as | Purpose |
|---|---|---|
| Voice recordings | Audio files, per recording | Collection, validation, quality assurance, delivery |
| Transcripts and annotations | Text, linked to the recording | Validation, quality assurance, delivery |
| Speaker metadata | Anonymised identifiers, demographic categories as defined per project | Quota reporting, delivery record |
| Consent records and provenance | Consent id, timestamp, version, scope | Lawful basis, audit trail |
| Technical metadata | Sample rate, format, duration | Validation, delivery record |
Purpose limitation: Data is processed for the purposes of collection, validation, quality assurance, and delivery as defined in the engagement agreement.
Clause · Consent and provenance per recording
Every recording carries its consent. The audit trail is the platform's own record.
Data collection runs on the YPAI platform, so the consent and provenance of each recording can be traced.
-
Consent
Obtained from the contributor before recording begins. Records are kept and can be produced for your compliance review.
-
Recording
Captured on the platform, under the specified conditions, against the consent record.
-
Provenance
Each recording is associated with contributor identifier, timestamp and consent reference.
-
Audit trail
Provenance records, consent documentation and processing logs. Provenance stays traceable in long-term production use.
Audit trail requirements and access procedures are defined contractually.
Clause · Sub-processors disclosed · governed · notified
Who else touches the data is in the agreement, with the change procedure.
Sub-processors engaged in data processing activities are disclosed as part of the DPA terms.
-
Disclosed
Sub-processor list or categories provided during scoping.
-
Governed
Sub-processor governance procedures defined in the DPA.
-
Notified
Update notification and approval mechanisms agreed contractually.
Clause · Retention and deletion windows · deletion · return
How long the data lives, and what happens when the engagement ends.
Retention periods and deletion procedures are defined contractually during scoping.
-
During the engagement
Retention windows vary by engagement and are specified in the DPA. Your own retention policy can be written in, per project.
-
Deletion
Deletion procedures aligned with GDPR requirements, with timelines provided for your review during scoping.
-
After the engagement
Return or deletion, as documented in the DPA. Post-engagement handling is written into the agreement before signature.
Clause · Security and audit access · documentation
Access is limited and documented. The documentation is yours to review.
Internal controls and security measures are implemented to protect data during collection, processing, and delivery.
- Access control
- Access to data is limited to authorised personnel. Access control policies are documented and available for review.
- Audit documentation
- Available for your legal and compliance review. Documentation of security practices is provided on request during scoping.
The review asks
Signing, roles and sub-processors
When is the DPA signed?
The DPA is executed before production collection begins. During scoping, YPAI provides draft DPA terms for your legal review. The signed agreement is finalised before any data processing starts.
Is YPAI a Controller or Processor?
Role designation depends on the engagement model. YPAI may act as Data Processor or Independent Controller depending on the contractual arrangement. Role definitions are specified in the DPA and reviewed during scoping.
Can we review sub-processors before signing?
Sub-processors are disclosed as part of the DPA terms. A list of sub-processors or categories of sub-processors is provided during scoping for your review.
How is consent demonstrated?
Consent is obtained on the YPAI platform and recorded per recording. Provenance records are kept for audit purposes. Details of consent mechanisms are documented in the DPA and available for compliance review.
What audit artefacts can you provide?
Provenance records, consent documentation and processing logs, for your legal and compliance review. Specific audit requirements can be addressed during scoping.
What happens if requirements change after pilot?
Requirement changes are handled through contract amendment procedures defined in the engagement agreement. YPAI works with your legal and procurement teams to document changes appropriately.
How are deletion requests handled?
Deletion and retention terms are defined contractually during scoping. Procedures for handling deletion requests are documented in the DPA and aligned with GDPR requirements.
Do you support regulated environments?
Yes. Healthcare, finance and automotive engagements are scoped with the sector's own regulatory requirements, in technical and compliance scoping.
Can we use our own DPA template?
Yes. YPAI reviews and works with client-provided DPA templates. Template review and negotiation occur during the scoping phase.
How are sub-processor changes communicated?
Sub-processor update procedures are defined in the DPA. Notification mechanisms and approval workflows are agreed upon during contract negotiation.
Bring the requirement. The draft DPA comes back with the scoping brief.
A formal appendix for your legal review is part of scoping. Your own DPA template is reviewed in the same step.
Speech data overview Technical specifications Data residency and sub-processors How YPAI processes customer and project data