GDPR and voice recordings: the rules in plain language

GDPR Art. 4 defines personal data broadly: anything that identifies a natural person, directly or indirectly. A voice recording usually does both - the speaker is identifiable by voice, the people they name are identifiable directly. So default treatment is: this is personal data, the recipient has rights, you (the controller) have duties.

Recording a private conversation in Germany requires the informed consent of all participants (BGB §823 + StGB §201). The bar for 'informed' is real: the participants have to know they're being recorded, what for, and how long the audio will be kept. A blanket 'we sometimes record meetings' line buried in a Terms of Service does not clear it.

GDPR Art. 5(1)(e) requires personal data to be kept no longer than necessary. For most voice notes that means: as long as you need them, then they go. Sprachmemo lets you delete a note (and its recordings) in one click, plus account-level export-and-delete for the GDPR-formal version. We don't artificially retain anything after a delete.

Press freedom in Germany (Art. 5 GG) trumps a lot of generic data-protection logic. But the practical mechanism for source protection is not having the data leave the jurisdiction in the first place. The strongest position you can be in when a court asks for your source's audio is: 'it never crossed a border, the only copy is here, we delete it on request, here's the audit log'.

Article 30 of GDPR requires controllers to keep records of processing. Most consumer tools don't expose this; Sprachmemo does. Every create / read / update / delete of a note or recording is captured in the per-account audit log. If you ever need to show 'this transcript was last modified at 14:32 on April 5 by user X', you can.