Speech data · GDPR-compliant speech data

Voice is personal data, and sometimes biometric. Every second of delivered speech carries its lawful basis.

Speech datasets collected under GDPR Article 6 consent, with Article 7 conditions met, explicit consent where Article 9 applies, and the consent id, timestamp and origin on every file.

EU AI Act obligations for high-risk systems are covered on the AI Act risk classification page.

The article register, and what each one means for the corpus
  1. Art. 6(1)(a) Lawful basis Consent, obtained as its own affirmative action before recording. The basis is defined per engagement and documented.
  2. Art. 7 Conditions for consent Freely given, specific, informed, unambiguous. Recorded with timestamp and version. Withdrawable at any time.
  3. Art. 9 Special categories Where voice is processed for identification or verification it is biometric data, and consent is explicit.
  4. Arts. 12 to 23 Data subject rights Access, rectification, erasure, restriction and objection, handled operationally against the recordings a request touches.
  5. Art. 28 Processor The DPA, executed before production collection. Processor for custom collection, independent controller for licensing.

Compliance overview basis · residency · sourcing

Three facts hold across every dataset. Consent, EU sourcing, a closed collection model.

Every speaker is a contracted, identity-verified contributor recording inside YPAI's own platform. The dataset arrives with the consent chain that makes it usable in production.

GDPR Art. 6 basis
Consent, Art. 6(1)(a)
Biometric derogation
Explicit consent where Art. 9 applies
Data residency
EEA by default for European engagements
Sourcing
Contracted, identity-verified contributors on the YPAI platform
Rights
Access, rectification, erasure, restriction and objection, handled operationally
Lineage
Consent id, collection timestamp and origin log per file
Scope a speech data requirement View the consent framework →

Regulatory exposure art. 6 · art. 9 · lifecycle

Provenance is a go or no-go criterion. Three places speech data fails review.

For enterprise organisations, data provenance is now a go or no-go criterion for model deployment.

GDPR Art. 6
Voice is a biological identifier. Even without metadata, speech content and acoustic markers can re-identify individuals. Speech is handled as personal data, with pseudonymisation plus a lawful basis.
GDPR Art. 9
Voice data can constitute biometric data when processed for identification or verification. That triggers special-category status, and the legal bar rises from legitimate interest to explicit consent. Scraped data fails here completely.
Lifecycle
Liability persists across model versions. If the original dataset provenance cannot be verified years later, the model itself is compromised. Audit traceability has to hold for the full retention period, well past the day of delivery.

European regulators review the lawful basis on which training datasets were acquired, under GDPR Article 6.

Deletion risk. Where the lawful basis of a training set cannot be shown, a model trained on it may face a mandatory deletion order. The consent record is what shows the basis.

What YPAI provides datasets · collection · artefacts

Speech datasets for enterprises, delivered with the consent and provenance records a compliance review asks for.

Off-the-shelf corpora and custom scoped collection, each delivered with the compliance artefacts your legal and procurement teams will ask for.

Core deliverables

Off-the-shelf speech datasets.
EU-sourced speech corpora for training, evaluation and fine-tuning, delivered as structured, annotated audio with full demographic metadata.
Custom scoped collection.
Custom collection against the demographic, acoustic and linguistic requirements you specify. Data is collected within YPAI's controlled platform by contracted contributors.

Included compliance artefacts

Audit documentation package.
Every dataset delivery includes lineage records per file: consent ids, collection timestamps and geographic origin logs.
Enterprise engagement models.
Commercial frameworks designed for procurement: Master Services Agreements, Data Processing Agreements and explicit indemnification clauses.

These controls apply to all speech datasets delivered by YPAI.

Lawful basis and consent art. 6 · art. 7 · recital 32

Consent, Article 6(1)(a), backed by an affirmative action from every speaker.

YPAI structures all data collection under defined GDPR Article 6 lawful bases, primarily consent. Controlled collection means every second of speech in a delivered dataset carries an affirmative action from the data subject.

Consent must be freely given, specific, informed, and unambiguous indication of the data subject's wishes.

GDPR Recital 32

  1. Disclosure

    Participants are told exactly how their voice data will be used, including AI training.

  2. Granularity

    Consent is separate from other terms and conditions.

  3. Revocability

    Participants are informed of their right to withdraw consent at any time.

  4. Unbundled

    Participation stands on its own; it is never conditional on unrelated data sharing.

Detailed consent framework documentation, including exact copies of the participant agreements used for your dataset, is available for legal review during evaluation.

Data subject rights articles 12 to 23

Rights are handled in operational terms. A request maps to the recordings it touches.

Right of access.
Indexed metadata is maintained for all contributors. On an authenticated subject access request, the repository is queried to locate the specific recordings associated with a user id within any delivered dataset.
Right to erasure.
When a valid deletion request is processed, data is purged from active storage. "Do not use" flags propagate to client deliverables where contractually enforceable. Where deletion is not technically reversible in trained models, YPAI documents the withdrawal and enforces non-use in future training and deliveries, consistent with prevailing regulatory guidance. Deletion logs are kept for audit review.

This framework governs how YPAI delivers speech data into production AI environments, so the consent documentation holds for the model's lifetime.

Provenance and audit lineage · per file

Having data and defending data differ by one thing, provenance.

The lineage is built at collection, before delivery: the contributor's identity is verified and the consent record is timestamped.

Long-term auditability. The metadata structure lets a client answer audit questions years after deployment: where did this specific training vector come from, and did we have the right to use it?

Example metadata record, JSON-LD compatible
{
  "file_id": "ypai_29841",
  "origin": "EU_FR_PARIS",
  "consent_id": "c_9928_v2_signed",
  "lawful_basis": "GDPR_ART_6_1_A",
  "demographics": {
    "yob": 1992,
    "gender": "female"
  },
  "collection_date": "2024-02-14T10:00:00Z"
}

Residency, roles and security eea · msa · toms

Where the data lives, who controls it, and how it is protected.

Cloud regions
EU jurisdiction by default; region and residency specified per project
Transfers
Governed by SCCs where applicable
Custom collection
YPAI as data processor
Licensing
YPAI as independent controller
Encryption
At rest and in transit; key management specified per project
Retention
Automated deletion at end of defined purpose
Data residency and sovereignty.
By default, YPAI processes and stores data within the EEA for European engagements. Cloud region and residency are specified per project in the DPA; transfers are governed by SCCs where applicable.
Controller and processor.
Roles are explicitly defined in the Master Services Agreement and follow the engagement structure: data processor for custom collection, independent controller for licensing.
Security and retention.
Technical and organisational measures include encryption at rest and in transit, strict role-based access control, and automated retention and deletion policies so data is held only for its defined purpose. Key management and customer-scoped keys are specified per project in the DPA and security annex.

Closed-loop collection contracted · verified · direct

Contracted contributors under a direct legal relationship. The provenance that open marketplaces cannot reconstruct.

YPAI runs a closed-loop collection service. Contributors are contracted and identity-verified, and the legal relationship with each data subject is direct.

In open crowdsourcing

  • Speaker identity cannot be checked, so one person can enrol many times
  • Farmed or synthetic recordings can enter the pool
  • Consent is weakly enforceable across jurisdictions

In the closed loop

  • Contracted contributors with verified identities
  • Device fingerprinting and environment checks on every session
  • A direct legal relationship with every data subject

Request one business day

Bring the requirement. The compliance documentation for your jurisdiction follows.

Tell us the use case, the timeline and the compliance requirement. Our team replies within one business day with the documentation relevant to your case.

Looking for work on AI projects? This form is for companies. Apply as a freelancer

We use the information you provide to assess, respond to and manage your enquiry in accordance with our Privacy Policy.

Legal and procurement

Basis, biometrics and rights

Which lawful basis applies to a delivered dataset?

Consent under GDPR Article 6(1)(a) is the primary basis. Where voice is processed for identification or verification and Article 9 applies, consent is explicit. The applicable basis is defined per engagement and documented in the participant materials and the DPA.

How is consent demonstrated during an audit?

Every delivered file carries a consent id, a collection timestamp and an origin log. The exact participant agreements used for your dataset are available for legal review during evaluation.

What happens when a participant withdraws?

Data is purged from active storage, "do not use" flags propagate to client deliverables where contractually enforceable, and the withdrawal is documented so non-use holds in future training and deliveries.

Where is the data processed and stored?

Within the EEA by default for European engagements; the region and residency are specified per project in the DPA. Transfers outside the EEA are governed by Standard Contractual Clauses where applicable.

Is YPAI the controller or the processor?

Data processor for custom collection, independent controller for licensing. The role is written into the Master Services Agreement and the DPA for each engagement.

Bring the model and the market. The consent chain comes with the corpus.

A use case, a timeline and the regulatory context are enough to start. The consent framework, the DPA and the audit package follow from scoping.

Scope a speech data requirement

Speech data overview Consent framework DPA overview Retention and deletion Data residency and sub-processors AI Act risk classification