--- title: "OpenAI Whisper GDPR Compliance in Germany: DPA, Speech Data, and AVV Guide" description: "OpenAI Whisper processes voice data. German businesses must have a DPA with OpenAI and assess lawful basis for processing speech data under GDPR." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/whisper/" language: "en" --- ![OpenAI Whisper GDPR compliance and data processing agreement for German businesses](https://compound.law/assets/images/tools/tools_3.webp) tools # OpenAI Whisper GDPR Compliance in Germany: DPA, Speech Data, and AVV Guide 6 April 2026 **OpenAI Whisper processes audio recordings and produces transcripts. German businesses using Whisper via the OpenAI API must have a Data Processing Agreement (DPA) with OpenAI and establish a lawful basis for processing voice data under GDPR.** Because voice recordings can constitute personal data — and in some contexts biometric data — deploying Whisper for meeting transcription, call recording, or customer service use cases requires careful compliance preparation. Businesses running Whisper locally (self-hosted) on their own infrastructure avoid sending audio to OpenAI but retain full GDPR responsibility as data controller. ## Does OpenAI Whisper Have a Data Processing Agreement (DPA)? OpenAI offers a **Data Processing Addendum (DPA)** that covers use of the OpenAI API, including Whisper API endpoints. The DPA is available to API customers and governs OpenAI’s processing of personal data on your behalf when you send audio files to the Whisper transcription endpoint. Key features of the OpenAI DPA: - **Processor designation:** OpenAI acts as a data processor when you use the API, and you act as the data controller responsible for your employees’, customers’, or meeting participants’ personal data. - **Standard Contractual Clauses:** The DPA incorporates EU Standard Contractual Clauses (SCCs) for transfers of personal data from the EU/EEA to OpenAI’s US infrastructure. - **Data retention limits:** OpenAI’s API terms state that API inputs and outputs are not used for model training by default, and data is retained only for the period required to deliver the service. - **Sub-processor list:** OpenAI publishes a list of sub-processors used to deliver API services, including cloud infrastructure providers. The DPA must be executed **before** you begin processing personal data through the Whisper API. Sending audio files containing identifiable voice data to the Whisper API without a valid DPA constitutes a violation of Article 28 DSGVO. If you are using Whisper as a **self-hosted open-source model** on your own servers, no DPA with OpenAI is required — but you remain fully responsible as a data controller and all GDPR obligations apply to your own infrastructure. ## Whisper and Voice Data Under GDPR — What Counts as Personal Data? Voice data is almost always **personal data** under GDPR (Article 4(1)). A voice recording identifies — or allows identification of — the speaker. This applies whether you are recording: - **Internal meetings:** Employee voices are personal data. Even if you only retain the transcript, the audio file itself must be handled as personal data during processing. - **Customer service calls:** Audio of customer conversations is personal data relating to both the customer and any employee on the call. - **Voice commands or dictation:** Single-speaker audio used for voice-to-text dictation is personal data of the speaker. In certain use cases, voice recordings may qualify as **biometric data** under Article 9 GDPR (special categories). Biometric data processed for the purpose of uniquely identifying a natural person — for example, speaker identification or voice authentication — requires explicit consent or another Art. 9(2) basis, with significantly higher compliance obligations. For standard transcription use cases (converting speech to text without speaker identification), voice recordings are personal data under Art. 4(1) but not special category data, provided the system does not attempt to identify individuals from their voice characteristics. ## Running Whisper Locally vs. via API — Compliance Implications This distinction is central to your GDPR compliance approach for Whisper: | Aspect | Whisper API (OpenAI-hosted) | Self-hosted Whisper | | ------------------------------------ | ------------------------------- | ---------------------------- | | DPA with OpenAI required | Yes (Article 28 DSGVO) | No | | Data leaves your infrastructure | Yes — audio sent to US servers | No | | EU-US data transfer mechanism needed | Yes — SCCs via OpenAI DPA | No | | Data controller | You | You | | GDPR obligations | Full — plus transfer compliance | Full | | Cost and complexity | Lower operational effort | Higher infrastructure effort | | AI Act obligations | Apply to your use case | Apply to your use case | **Key compliance advantage of self-hosted Whisper:** Audio files never leave your infrastructure. This eliminates the EU-US transfer risk, avoids reliance on OpenAI’s DPA, and makes data localization straightforward. For organizations processing highly sensitive speech data — patient consultations, legal proceedings, HR interviews — self-hosted Whisper significantly reduces GDPR risk. **Key compliance consideration for API use:** Every audio file you send to the Whisper API is transferred to OpenAI’s US servers. The DPA and SCCs must be in place and up to date, and your privacy notices must disclose this international transfer. ## AVV for OpenAI Whisper in Germany The OpenAI DPA functions as the **Auftragsverarbeitungsvertrag (AVV)** required under Article 28 DSGVO when German businesses use the Whisper API. Steps to establish a compliant AVV relationship: 1. **Accept the OpenAI Data Processing Addendum** through your API account settings or by signing the DPA directly with your OpenAI account manager for enterprise contracts. 2. **Verify SCCs are incorporated:** Confirm that EU Standard Contractual Clauses (Commission Decision 2021/914) are included in the DPA for the EU-US audio data transfer. 3. **Update your processing register:** Add OpenAI / Whisper API to your Verzeichnis von Verarbeitungstätigkeiten (Article 30 DSGVO) as a processor for voice and transcript data. 4. **Review sub-processors:** Check OpenAI’s published sub-processor list and assess whether any sub-processor raises additional transfer or risk concerns. 5. **Update privacy notices:** Employee and customer-facing privacy notices must disclose that audio may be processed by OpenAI as a sub-processor, including the international transfer. ## Whisper Use Cases and GDPR Risk Levels: Meetings, Calls, Customer Service Different Whisper use cases carry different GDPR risk profiles: **Internal meeting transcription (medium risk)** Audio of internal meetings contains employee personal data. The legal basis is typically Art. 6(1)(b) DSGVO (performance of the employment contract) or Art. 6(1)(f) (legitimate interests). Employees must be informed in advance that meetings are being recorded and transcribed — a simple “this meeting is being transcribed” notice is generally sufficient. Transcripts should be stored only as long as needed and access should be restricted. **Customer service call transcription (high risk)** Customer calls are personal data of the customer. The legal basis requires careful analysis: legitimate interest under Art. 6(1)(f) often applies, but customers must be informed (“this call may be recorded and transcribed for quality purposes”) before the call proceeds. For outbound calls, prior notification is required. A DPIA is recommended for systematic call center transcription. **Employee dictation and voice-to-text (lower risk)** Individual dictation tools used by employees for their own productivity are lower risk, but still require a legal basis and disclosure in the employee privacy notice. **Speaker identification or voice analytics (high risk — potential special category data)** Any use case that attempts to identify individuals from their voice, analyze emotional state, or build voice profiles triggers the special category provisions of Art. 9 GDPR. Explicit consent is typically the only viable legal basis, and a DPIA is mandatory. ## Works Council Requirements for Audio Recording and Transcription **Recording and transcribing employees triggers co-determination rights under German labor law.** The Betriebsrat has mandatory participation rights under **§87(1) No. 6 BetrVG** for any technical system that monitors employee behavior or performance — and transcription tools clearly qualify. Beyond BetrVG, German employers must also consider: - **BDSG §26:** Employee monitoring must be proportionate and may require works council involvement. Systematic recording of employee communications requires documented justification. - **Fernmeldegeheimnis (telecommunications secrecy):** Recording phone calls in Germany is subject to strict legal requirements. Both parties must consent to a call being recorded. Silent recording is a criminal offence under §201 StGB (violation of confidentiality of the spoken word). This applies equally to transcription: recording a call and running Whisper on it without consent is unlawful. Before deploying Whisper for any employee use case, you must: 1. **Notify the Betriebsrat** of the planned use of Whisper, including which audio sources will be transcribed, how transcripts will be stored, and who will have access. 2. **Negotiate a Betriebsvereinbarung** governing permissible recording scenarios, transcript retention periods, and access controls. 3. **Implement a consent mechanism** for call recording if calls involving external parties will be transcribed. 4. **Document everything** — legal basis, notification procedures, and the Betriebsvereinbarung — before going live. Deploying Whisper for employee meeting transcription without works council involvement can result in an injunction against use of the tool. For call recording, the legal exposure is greater: unauthorized recording is a criminal offence under §201 StGB. ## Compliance Checklist for German Businesses Using Whisper - [ ] **Deployment model decided:** API or self-hosted — determine which compliance path applies - [ ] **DPA/AVV executed:** OpenAI Data Processing Addendum accepted or signed (API use only) - [ ] **SCCs confirmed:** Standard Contractual Clauses incorporated in OpenAI DPA for EU-US audio transfers - [ ] **Sub-processor list reviewed:** OpenAI’s sub-processor list reviewed, privacy notices updated - [ ] **Processing register updated:** Whisper / OpenAI API added to Article 30 DSGVO register - [ ] **Legal basis documented:** Identified and documented for each use case (meetings, calls, dictation) - [ ] **Privacy notices updated:** Employee and customer notices disclose audio processing and OpenAI as processor - [ ] **Participant notification:** Mechanism in place to inform meeting participants and call parties before recording - [ ] **Consent mechanism for calls:** Consent obtained for any call recording (Fernmeldegeheimnis compliance) - [ ] **DPIA conducted:** Required for systematic recording of employee communications or customer calls at scale - [ ] **Betriebsrat informed:** Works council notified before deployment if employees will be recorded - [ ] **Betriebsvereinbarung concluded:** Works agreement governing recording and transcription use cases signed - [ ] **Retention policy defined:** Transcripts and audio files deleted once purpose is fulfilled; retention limits documented Compound Law advises German businesses on Whisper deployments: DPA review, DPIA preparation, Betriebsrat negotiations, and lawful basis analysis for speech data processing. See our [compliance services](https://compound.law/en-DE/compliance/) for details. For comparison, see our guides on [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/) and [OpenAI API GDPR compliance](https://compound.law/en-DE/tools/openai-api/). *** ## Frequently Asked Questions ### Is OpenAI Whisper GDPR compliant? OpenAI Whisper can be used in a GDPR-compliant manner, but compliance depends on how you deploy it. Using the Whisper API requires a Data Processing Agreement with OpenAI, Standard Contractual Clauses for EU-US data transfers, an established legal basis for processing voice data, and disclosure to data subjects. Self-hosted Whisper avoids the OpenAI data transfer but places full GDPR compliance responsibility on your organization. Neither deployment method is “automatically compliant” — the controller’s preparation determines whether the use is lawful. ### Does OpenAI Whisper have an AVV (Auftragsverarbeitungsvertrag)? Yes — for API users. OpenAI offers a Data Processing Addendum that functions as the AVV required under Article 28 DSGVO. It must be accepted through your OpenAI account settings or signed directly with OpenAI for enterprise API contracts. The DPA includes Standard Contractual Clauses for EU-US transfers of audio data. Self-hosted Whisper users do not need a DPA with OpenAI, but they act as the data controller and must comply with all GDPR obligations on their own infrastructure. ### Can I record employee calls with Whisper? Recording employee calls (or any calls involving identifiable parties) requires the consent of all participants under German law. Silent recording is a criminal offence under §201 StGB (violation of confidentiality of the spoken word), regardless of whether you use Whisper or any other transcription tool. Before recording and transcribing calls, implement a consent mechanism (e.g., an automated voice announcement at the start of the call), and consult with your Betriebsrat if the recording affects employees. ### Is local Whisper deployment more GDPR-friendly? Yes, in several important ways. Self-hosted Whisper means audio files are processed entirely on your own servers and never leave your infrastructure. This eliminates the EU-US data transfer risk, removes the need for an OpenAI DPA, and makes data localization straightforward. For organizations processing sensitive audio data — in healthcare, legal, or financial contexts — self-hosted Whisper is generally the lower-risk option. The trade-off is higher infrastructure and maintenance costs. ### Does recording meetings with Whisper require informing employees? Yes. Employees must be informed before their voices are recorded, as their voice recordings are personal data under GDPR. This disclosure typically belongs in the employee privacy notice and should be reinforced with a runtime notification at the start of any recorded meeting. Additionally, if your organization has a Betriebsrat, works council involvement is required before deploying any systematic meeting transcription system under §87(1) No. 6 BetrVG. ### What is the legal basis for transcribing customer calls with Whisper? For customer call transcription, the most common legal bases are **Article 6(1)(f) DSGVO** (legitimate interest, e.g., quality assurance) or **Article 6(1)(a) DSGVO** (consent). Whichever basis you use, customers must be informed before the call is recorded — usually via a verbal or automated notice at the start of the call. For inbound calls, a recorded announcement suffices. For outbound calls, prior written notification may be required. Document your legal basis assessment and implement a process for handling objections or withdrawal of consent. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions OpenAI Whisper can be used in a GDPR-compliant manner, but compliance depends on how you deploy it. Using the Whisper API requires a Data Processing Agreement with OpenAI, Standard Contractual Clauses for EU-US data transfers, an established legal basis for processing voice data, and disclosure to data subjects. Self-hosted Whisper avoids the OpenAI data transfer but places full GDPR compliance responsibility on your organization. Neither deployment method is "automatically compliant" — the controller's preparation determines whether the use is lawful. Yes — for API users. OpenAI offers a Data Processing Addendum that functions as the AVV required under Article 28 DSGVO. It must be accepted through your OpenAI account settings or signed directly with OpenAI for enterprise API contracts. The DPA includes Standard Contractual Clauses for EU-US transfers of audio data. Self-hosted Whisper users do not need a DPA with OpenAI, but they act as the data controller and must comply with all GDPR obligations on their own infrastructure. Recording employee calls (or any calls involving identifiable parties) requires the consent of all participants under German law. Silent recording is a criminal offence under §201 StGB (violation of confidentiality of the spoken word), regardless of whether you use Whisper or any other transcription tool. Before recording and transcribing calls, implement a consent mechanism (e.g., an automated voice announcement at the start of the call), and consult with your Betriebsrat if the recording affects employees. Yes, in several important ways. Self-hosted Whisper means audio files are processed entirely on your own servers and never leave your infrastructure. This eliminates the EU-US data transfer risk, removes the need for an OpenAI DPA, and makes data localization straightforward. For organizations processing sensitive audio data — in healthcare, legal, or financial contexts — self-hosted Whisper is generally the lower-risk option. The trade-off is higher infrastructure and maintenance costs. Yes. Employees must be informed before their voices are recorded, as their voice recordings are personal data under GDPR. This disclosure typically belongs in the employee privacy notice and should be reinforced with a runtime notification at the start of any recorded meeting. Additionally, if your organization has a Betriebsrat, works council involvement is required before deploying any systematic meeting transcription system under §87(1) No. 6 BetrVG. For customer call transcription, the most common legal bases are \*\*Article 6(1)(f) DSGVO\*\* (legitimate interest, e.g., quality assurance) or \*\*Article 6(1)(a) DSGVO\*\* (consent). Whichever basis you use, customers must be informed before the call is recorded — usually via a verbal or automated notice at the start of the call. For inbound calls, a recorded announcement suffices. For outbound calls, prior written notification may be required. Document your legal basis assessment and implement a process for handling objections or withdrawal of consent. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "OpenAI Whisper GDPR Compliance in Germany: DPA, Speech Data, and AVV Guide", "description": "OpenAI Whisper processes voice data. German businesses must have a DPA with OpenAI and assess lawful basis for processing speech data under GDPR.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-04-06T00:00:00.000Z", "dateModified": "2026-04-06T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/whisper/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "OpenAI Whisper GDPR Compliance in Germany: DPA, Speech Data, and AVV Guide", "item": "https://compound.law/en-DE/tools/whisper/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is OpenAI Whisper GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "OpenAI Whisper can be used in a GDPR-compliant manner, but compliance depends on how you deploy it. Using the Whisper API requires a Data Processing Agreement with OpenAI, Standard Contractual Clauses for EU-US data transfers, an established legal basis for processing voice data, and disclosure to data subjects. Self-hosted Whisper avoids the OpenAI data transfer but places full GDPR compliance responsibility on your organization. Neither deployment method is \"automatically compliant\" — the controller's preparation determines whether the use is lawful." } }, { "@type": "Question", "name": "Does OpenAI Whisper have an AVV (Auftragsverarbeitungsvertrag)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes — for API users. OpenAI offers a Data Processing Addendum that functions as the AVV required under Article 28 DSGVO. It must be accepted through your OpenAI account settings or signed directly with OpenAI for enterprise API contracts. The DPA includes Standard Contractual Clauses for EU-US transfers of audio data. Self-hosted Whisper users do not need a DPA with OpenAI, but they act as the data controller and must comply with all GDPR obligations on their own infrastructure." } }, { "@type": "Question", "name": "Can I record employee calls with Whisper?", "acceptedAnswer": { "@type": "Answer", "text": "Recording employee calls (or any calls involving identifiable parties) requires the consent of all participants under German law. Silent recording is a criminal offence under §201 StGB (violation of confidentiality of the spoken word), regardless of whether you use Whisper or any other transcription tool. Before recording and transcribing calls, implement a consent mechanism (e.g., an automated voice announcement at the start of the call), and consult with your Betriebsrat if the recording affects employees." } }, { "@type": "Question", "name": "Is local Whisper deployment more GDPR-friendly?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, in several important ways. Self-hosted Whisper means audio files are processed entirely on your own servers and never leave your infrastructure. This eliminates the EU-US data transfer risk, removes the need for an OpenAI DPA, and makes data localization straightforward. For organizations processing sensitive audio data — in healthcare, legal, or financial contexts — self-hosted Whisper is generally the lower-risk option. The trade-off is higher infrastructure and maintenance costs." } }, { "@type": "Question", "name": "Does recording meetings with Whisper require informing employees?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Employees must be informed before their voices are recorded, as their voice recordings are personal data under GDPR. This disclosure typically belongs in the employee privacy notice and should be reinforced with a runtime notification at the start of any recorded meeting. Additionally, if your organization has a Betriebsrat, works council involvement is required before deploying any systematic meeting transcription system under §87(1) No. 6 BetrVG." } }, { "@type": "Question", "name": "What is the legal basis for transcribing customer calls with Whisper?", "acceptedAnswer": { "@type": "Answer", "text": "For customer call transcription, the most common legal bases are **Article 6(1)(f) DSGVO** (legitimate interest, e.g., quality assurance) or **Article 6(1)(a) DSGVO** (consent). Whichever basis you use, customers must be informed before the call is recorded — usually via a verbal or automated notice at the start of the call. For inbound calls, a recorded announcement suffices. For outbound calls, prior written notification may be required. Document your legal basis assessment and implement a process for handling objections or withdrawal of consent." } } ] } ] ```