GDPR and voice recordings: the rules in plain language

GDPR Art. 4 defines personal data broadly: anything that identifies a natural person, directly or indirectly. A voice recording usually does both - the speaker is identifiable by voice, the people they name are identifiable directly. So default treatment is: this is personal data, the recipient has rights, you (the controller) have duties.

Recording a private conversation in Germany requires the informed consent of all participants (BGB §823 + StGB §201). The bar for 'informed' is real: the participants have to know they're being recorded, what for, and how long the audio will be kept. A blanket 'we sometimes record meetings' line buried in a Terms of Service does not clear it.

GDPR Art. 5(1)(e) requires personal data to be kept no longer than necessary. For most voice notes that means: as long as you need them, then they go. Sprachmemo lets you delete a note (and its recordings) in one click, plus account-level export-and-delete for the GDPR-formal version. We don't artificially retain anything after a delete.

Press freedom in Germany (Art. 5 GG) trumps a lot of generic data-protection logic. But the practical mechanism for source protection is not having the data leave the jurisdiction in the first place. The strongest position you can be in when a court asks for your source's audio is: 'it never crossed a border, the only copy is here, we delete it on request, here's the audit log'. The guide to recording a meeting without a US cloud shows the exact consent-and-capture workflow that supports this position.

Article 30 of GDPR requires controllers to keep records of processing. Most consumer tools don't expose this; Sprachmemo does. Every create / read / update / delete of a note or recording is captured in the per-account audit log. If you ever need to show 'this transcript was last modified at 14:32 on April 5 by user X', you can.