The moment AI enters the conversation, data protection becomes the first question in the room. Rightly so. Voice interviews with AI touch several GDPR topics at once: personal data, biometric features, automated processing, and since 2024 also the EU AI Act.
This guide structures the most common questions clients of AI-powered market research typically need to clarify with their own legal or data protection team.
Are voice recordings personal data?
Yes, as a rule. The human voice allows identification and therefore qualifies as personal data under GDPR. If biometric features are additionally processed for unique identification, Art. 9 GDPR applies with significantly stricter requirements.
And this is exactly where a critical methodological lever sits. Whoever does not store audio at all, but transcribes it in real time into pseudonymized text, drastically reduces the risk profile. A biometrically sensitive recording becomes a text document with no voice fingerprint.
Which legal basis applies to AI interviews?
For voluntary market research and employee studies, explicit participant consent under Art. 6 (1) (a) GDPR is the practical standard. It must be voluntary, informed, specific, and revocable at any time. In customer interviews a legitimate interest may additionally be relevant, but it does not replace the transparency obligations.
Processor, controller, or both?
In a typical setup the client is the controller under GDPR. Synfia acts as the processor. A data processing agreement (DPA) under Art. 28 GDPR governs mutual obligations, technical and organizational measures, and the handling of sub-processors.
Third-country transfers: the actual risk field
Many AI tools promise GDPR compliance but route data to US providers in the background. Since the Schrems II ruling, Standard Contractual Clauses alone are no longer sufficient as soon as US authorities could access the data. Whoever wants to avoid third-country transfers needs an architecture that processes and stores data exclusively in the EU.
Synfia processes and stores all data exclusively on servers in Germany. AI partners operate in a closed environment and are contractually excluded from any training use.
EU AI Act: what additionally applies
The EU AI Act classifies AI systems by risk class. AI interviews for market research or voluntary employee feedback typically fall into the low-risk class, provided there is no biometric identification or evaluative personnel decision. Two obligations remain central nonetheless: transparency toward users and clear identification as AI.
Will my data be used to train AI models?
One of the most common questions. At Synfia the answer is clear: no. Neither voice data nor transcripts nor client content is used for training purposes. Sub-processors are contractually excluded from any training use. This clause should be explicitly checked in every contract with an AI provider.
Checklist before your first AI market research project
- Where are audio and transcripts processed and stored? EU only?
- Is audio actually stored, or only transcribed in real time?
- Is there a complete data processing agreement under Art. 28 GDPR?
- Is data used to train AI models? Contractually excluded?
- Is participant information complete: AI notice, purpose, retention, revocation?
- Which sub-processors are involved and where are they located?
- How is a deletion request implemented technically and procedurally?
- Which risk class under the EU AI Act applies and which obligations follow?
Frequently asked questions
Is Synfia GDPR-compliant?
Yes. Synfia is fully GDPR-compliant. All data is processed and stored exclusively in Germany. Audio is transcribed in real time and not stored. Synfia acts as a data processor on behalf of the client.
Are voice recordings stored?
No. Audio is transcribed in real time and discarded immediately after transcription. Only the pseudonymous or anonymous transcript is stored.
Is data transferred to the US?
No. Processing and storage take place exclusively in the EU, specifically on servers in Germany. A third-country transfer is not part of the standard architecture.
Is the data used to train the AI?
No. Neither voice data nor transcripts nor client content is used for training purposes. Our AI partners are contractually excluded from any training use.