--- title: "Is Descript GDPR-Compliant? DPA Review for Germany" description: "GDPR compliance review for Descript in Germany: DPA analysis, voice data risks, US transfers, and AI training. Checklist for procurement teams." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/descript/" language: "en" --- ![Descript DPA and GDPR review for companies in Germany](https://compound.law/assets/images/tools/tools_2.webp) tools # Is Descript GDPR-Compliant? DPA Review for Germany 5 April 2026 Can German companies use Descript lawfully? Yes, in some cases, but only after a structured GDPR review. German buyers should verify the Descript DPA, how voice and video data is handled, whether AI features use uploaded content for model training, and what transfer mechanisms cover US-based processing. - Descript offers a DPA, but buyers should confirm processor role, subprocessors, retention, and whether AI transcription and cloning create added risks. - Voice data processed through Descript may become personal data — and in some cases biometric data — depending on the content and how it is used. - German buyers should assess whether uploaded audio and video involves customer, employee, or special-category content before committing to a rollout. **Descript DPA** questions arise when German procurement or legal teams need to know: can we use Descript for podcast editing, video content, or team communications, and what does processing voice and video data in a US-based SaaS platform mean for GDPR compliance? As of **April 5, 2026**, Descript offers a **Data Processing Agreement**, AI-powered transcription, a voice cloning feature called Overdub, and screen recording tools. But the legal assessment is not straightforward. Voice and video data creates specific GDPR exposure that a generic DPA may not fully address, particularly for customer-facing or employee-touching use cases. > **Short answer** > > Descript can work for German companies in the right context, but not on autopilot. > > - Low-risk: scripted marketing video, internal tutorials, and approved narration with synthetic voices. > - Needs review: customer call recordings, employee audio, sales content, or any workflow involving identifiable voice data. > - Usually avoid without deeper assessment: voice cloning of real people, bulk processing of customer audio, or HR-relevant recordings. This page is general information, not legal advice for a specific implementation. For related tools, also review our guides on [ElevenLabs](https://compound.law/en-DE/tools/elevenlabs/), [Otter.ai](https://compound.law/en-DE/tools/otter-ai/), and [Anthropic API GDPR compliance](https://compound.law/en-DE/tools/anthropic-api/), or explore our broader [AI legal expertise](https://compound.law/en-DE/expertise/). ## Is Descript GDPR compliant in Germany? In Germany, the relevant question is not whether Descript is “GDPR compliant” in the abstract. It is whether **your planned Descript deployment** is defensible under the GDPR. For most buyers, the key legal checkpoints are: 1. What types of data are uploaded to Descript: internal scripts, customer call recordings, employee training sessions, or sensitive meeting content? 2. Is Descript acting as a **processor** under **Article 28 GDPR**, or does the service retain independent rights to use your content? 3. What is the **legal basis** under **Article 6 GDPR** for any personal data that enters the platform? 4. How does the platform handle **transfers** to the United States under **Chapter V GDPR**, and what mechanism — SCCs, DPF, or other — governs that? 5. What AI features will you use, and do those features create additional data processing or retention risks? Lower-risk deployments typically look like: - creating marketing or product content from approved, scripted narration - editing internal training videos without customer or employee personal data - using AI transcription for non-sensitive internal meetings with appropriate notice Higher-risk deployments that require closer review include: - uploading recorded customer calls for editing, transcription, or distribution - processing sales calls or support sessions that contain personal data - using Overdub or voice cloning on recordings linked to real people - integrating Descript with CRM or support tools that enrich uploaded content with customer data ## Does Descript offer a DPA and what should legal review? Yes. Descript provides a **Data Processing Agreement (DPA)** for business customers. But buyers should not treat the existence of a DPA as the end of the review. | Issue | Why it matters | What legal should verify | | --------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | | Processor role | Descript’s AI features may give it rights beyond pure instruction-following | Check whether DPA language covers Overdub, AI transcription, and other AI features | | Data use for training | Audio and video are valuable training material | Confirm whether uploaded content is excluded from model training under your plan | | Subprocessors | Cloud infrastructure, AI model providers, and CDN vendors can create transfer chains | Review the subprocessor list and object to additions if needed | | Transfers | Descript is a US-based company | Verify SCCs, DPF references, and any supplementary measures for high-sensitivity content | | Retention | Audio files and transcripts can persist longer than expected | Confirm deletion triggers, export options, and backup schedules | | Biometric risk | Overdub voice cloning can touch biometric data thresholds | Assess whether any Overdub use case triggers Article 9 GDPR obligations | For German buyers, the contract review should also verify whether the DPA applies uniformly to all Descript products and AI features, or whether enterprise and business tiers have separate commitments. ## Data residency and transfer considerations Descript is headquartered in the United States, and most of its infrastructure is US-based. For German companies, that creates a default transfer situation under Chapter V GDPR. Descript’s public DPA references transfer mechanisms including **Standard Contractual Clauses (SCCs)** and other adequacy-based options. That gives a baseline, but procurement teams should also check: - whether the DPA references the current 2021 SCCs approved by the European Commission, not an older version - whether any subprocessors used for storage, transcription processing, or AI compute operate from outside the EEA - whether Descript’s security incident or support access procedures can involve staff outside the EEA - whether there is any supplementary transfer impact assessment available for high-sensitivity audio workflows If your company needs strict data localisation — common in sectors like healthcare, finance, legal services, or regulated HR — Descript’s current infrastructure may not provide a realistic EU-only processing path. Document the known transfer risks and assess whether mitigating controls are sufficient for your risk appetite. ## Voice and video data: what German buyers need to know This is often the most important legal issue for Descript in Germany. Under the GDPR: - **Voice recordings are personal data** if they relate to an identifiable person. - **Video footage is personal data** if it includes identifiable individuals. - **Voice recordings may become biometric data** under **Article 9 GDPR** if processed to uniquely identify a person — which can trigger the prohibition on processing special-category data without explicit consent or another Article 9(2) basis. | Use case | Risk assessment | Why | | ------------------------------------------- | ------------------------------- | ---------------------------------------------------------------------------- | | Scripted voiceover from approved text | Lower risk | Minimal personal data if no real person’s voice is used | | Product demo video with synthetic narration | Lower risk | Usually manageable with basic governance | | Customer support call editing | Needs review | Call recordings typically contain personal data | | Podcasts or interviews with named guests | Needs review | Consent and disclosure obligations apply to identified speakers | | Overdub voice cloning (real person’s voice) | Needs review | Personal data, potential biometric data, and personality rights implications | | Bulk upload of employee meeting recordings | Avoid without deeper assessment | Employment law, DPIA obligations, and works council rights all triggered | If you plan to use **Descript Overdub** or any voice cloning feature on recordings of real, identifiable people — employees, customers, or executives — you need to assess whether that workflow requires a **DPIA** under **Article 35 GDPR**, explicit consent, and a legal basis that goes beyond legitimate interests. ## German law context Beyond the GDPR, German companies should be aware of several additional legal dimensions. **BDSG and employee data.** If Descript is used to process employee recordings — training sessions, all-hands meetings, performance reviews, or call monitoring — **section 26 BDSG** applies. Employee data processing requires a specific legal basis (collective agreement, necessity for the employment relationship, or consent) that is harder to satisfy than standard commercial use. **Works council rights.** If Descript is deployed in a way that enables monitoring or evaluation of employee performance or behavior — for example, by transcribing and analysing meeting contributions or call quality — the **Betriebsrat** has co-determination rights under **section 87(1) no. 6 BetrVG**. Engage early. **DPIA threshold.** Large-scale processing of audio or video data, profiling based on voice characteristics, or systematic monitoring of employee communications all trigger the obligation to conduct a **Data Protection Impact Assessment (DPIA)** under Article 35 GDPR before the processing begins. ## Practical compliance checklist 1. **Classify your content.** Before uploading, separate internal scripts, customer recordings, employee audio, and any content involving special-category data. 2. **Review the Descript DPA.** Check processor role, AI feature coverage, training data exclusions, subprocessors, transfer mechanism, and deletion terms. 3. **Confirm training data status.** Verify in writing whether your uploaded audio and video is excluded from model training under your plan and contract tier. 4. **Assess Overdub separately.** If you plan to use voice cloning, check whether the target voice belongs to an identifiable person and what legal basis applies. 5. **Map transfer risks.** Document that Descript processes in the US, the transfer mechanism, and any supplementary controls for high-sensitivity workflows. 6. **Check employee touchpoints.** If any uploaded content involves employees, assess BDSG obligations and works council co-determination rights. 7. **Set internal upload rules.** Define what content categories may be uploaded to Descript and prohibit unreviewed customer or employee audio. ## FAQ ### Does Descript have a DPA for GDPR? Yes. Descript provides a DPA for business customers. German buyers should verify that it covers AI features including transcription and Overdub, that transfer mechanisms are current, and that training data exclusions apply under the chosen contract tier. ### Is it safe to process customer voice data in Germany using Descript? It depends. Non-sensitive scripted content is generally manageable. Customer call recordings require a careful analysis of legal basis, transfer risk, retention, and disclosure. Do not upload sensitive customer audio without completing a structured GDPR and DPA review first. ### Does Descript use audio for AI training? That depends on the plan and contract. Buyers should review Descript’s data use terms carefully and confirm in writing whether uploaded content is excluded from model training. Do not assume enterprise protections apply to lower-tier plans. ### Do we need a DPIA for Descript? Potentially yes. If you process large volumes of audio or video data, use voice cloning on identifiable people, or systematically analyse employee meetings or calls, a **DPIA** under Article 35 GDPR is likely required before the processing begins. If your team is evaluating Descript or other AI audio and video tools before procurement, Compound Law advises businesses in Germany on **GDPR, AI procurement, DPA reviews, and workplace AI governance**. [Contact us](https://compound.law/en-DE/#booking) if you need a vendor review or rollout checklist for voice or video AI. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Descript offers a Data Processing Agreement for business customers. Buyers should review whether the DPA covers AI transcription, voice cloning, and other AI features, and whether the processor role, subprocessors, and transfer mechanism match their planned deployment. That depends on the workflow. Non-sensitive narration and scripted content are easier to justify. Customer call recordings, employee audio, or voice data linked to identifiable individuals require a more thorough GDPR analysis, legal basis review, and data minimisation approach. Buyers should review Descript data use policies carefully. Enterprise or paid plan commitments sometimes limit training use, but the exact scope varies by contract. Do not assume default settings exclude your data from model improvement; confirm in the DPA or data use addendum. Yes, if it relates to an identifiable person. If voice recordings can identify someone, they are personal data under Article 4 GDPR. If processed specifically to uniquely identify a person, they may qualify as biometric data under Article 9 GDPR, triggering stricter obligations. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is Descript GDPR-Compliant? DPA Review for Germany", "description": "GDPR compliance review for Descript in Germany: DPA analysis, voice data risks, US transfers, and AI training. Checklist for procurement teams.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-05T00:00:00.000Z", "dateModified": "2026-04-05T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/descript/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Is Descript GDPR-Compliant? DPA Review for Germany", "item": "https://compound.law/en-DE/tools/descript/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Descript have a DPA for GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Descript offers a Data Processing Agreement for business customers. Buyers should review whether the DPA covers AI transcription, voice cloning, and other AI features, and whether the processor role, subprocessors, and transfer mechanism match their planned deployment." } }, { "@type": "Question", "name": "Is it safe to process customer voice data in Germany using Descript?", "acceptedAnswer": { "@type": "Answer", "text": "That depends on the workflow. Non-sensitive narration and scripted content are easier to justify. Customer call recordings, employee audio, or voice data linked to identifiable individuals require a more thorough GDPR analysis, legal basis review, and data minimisation approach." } }, { "@type": "Question", "name": "Does Descript use audio for AI training?", "acceptedAnswer": { "@type": "Answer", "text": "Buyers should review Descript data use policies carefully. Enterprise or paid plan commitments sometimes limit training use, but the exact scope varies by contract. Do not assume default settings exclude your data from model improvement; confirm in the DPA or data use addendum." } }, { "@type": "Question", "name": "Is voice data personal data under the GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if it relates to an identifiable person. If voice recordings can identify someone, they are personal data under Article 4 GDPR. If processed specifically to uniquely identify a person, they may qualify as biometric data under Article 9 GDPR, triggering stricter obligations." } } ] } ] ```