Fully Local Transcribe › Guides
Transcribing confidential recordings under GDPR and HIPAA
Key takeaways
- Uploading a recording to a transcription service makes that service part of your data flow — with contracts, transfer rules and retention questions attached.
- Under the GDPR, a cloud transcription provider is usually a processor: you need an Article 28 contract, and a valid transfer mechanism for any transfer outside the EEA.
- Under HIPAA, a vendor that receives PHI on your behalf is usually a business associate: you need a BAA.
- On-device transcription keeps the recording on your PC, so the software maker never receives it.
- It doesn't make you compliant by itself: device security, access and retention are still your job.
This guide explains general principles. It isn't legal advice — check your own situation with your data protection officer, privacy officer or counsel.
What happens when you upload a recording
Interviews, consultations and meetings are full of personal data: names, voices, and often health, legal or employment details. When you upload one to a cloud service, a copy now lives on someone else's infrastructure. That raises questions you'll have to answer for every vendor:
- Who can access the audio and the transcript, and under what contract?
- Which countries are the servers in?
- How long are files kept, and is the content used to train models?
- What happens to the data if you stop using the service?
Under the GDPR
A provider that transcribes recordings on your instructions is normally a processor, and you're the controller. Article 28 requires a written contract — a data processing agreement — that sets out what the processor may do with the data. If the provider processes data outside the EEA, Chapter V applies: you need an adequacy decision or another transfer tool, such as standard contractual clauses. Recordings from clinics, therapists or HR often include special-category data such as health information (Article 9), which raises the bar further and may call for a data protection impact assessment.
Under HIPAA
For U.S. covered entities, a vendor that creates, receives, maintains or transmits protected health information on your behalf is generally a business associate. Before sharing PHI with it, you need a business associate agreement (BAA), and the vendor takes on its own obligations under the Security Rule. Many consumer transcription tools don't sign BAAs at all, which rules them out for patient recordings.
What on-device transcription changes
With on-device transcription, the speech model runs on your own PC. The recording is read from your disk, transcribed in memory and saved back to your disk. The software maker is never sent the audio or the text.
| Cloud transcription | On-device transcription | |
|---|---|---|
| Who receives the recording | The provider (and often its sub-processors) | Nobody outside your organization |
| GDPR processor contract for the recordings | Required | Not needed for the recordings — the vendor doesn't process them |
| International transfer of the recordings | Depends on server location | None — the file doesn't move |
| HIPAA BAA for the recordings | Required if PHI is shared | Generally not, as the vendor never receives PHI |
| Retention of copies | Set by the provider's policy | Set by you |
The vendor isn't completely out of the picture: to run a paid license, some account data still changes hands. With Fully Local Transcribe, a license check sends your email address, license key, app version and a random device ID — never audio or text — and an update check sends nothing that identifies you. If you can't allow even that, an offline license activates without any network connection.
What stays your responsibility
Keeping data on the PC moves the security question to the PC. Before you put sensitive recordings through any local tool, check that:
- The PC's disk is encrypted (for example with BitLocker) and the device locks automatically.
- Only the people who need the recordings can sign in to the PC or open the folders they're stored in.
- You have a rule for how long recordings and transcripts are kept, and someone actually deletes them.
- Backups of those folders are protected to the same standard as the originals.
- Optional features that send data — such as emailing transcripts or sending them to Notion — are turned on only where your policy allows it, because they create a new recipient of the data.
- Your record of processing activities or risk assessment describes the tool and where the data lives.
FAQ
Is Fully Local Transcribe HIPAA compliant?
No software is HIPAA compliant on its own — compliance depends on how your organization uses it. What the app does is keep recordings and transcripts on your PC: they are not sent to us, so we don't receive your PHI. Your own safeguards for the PC still apply.
Do I need a data processing agreement or a BAA with you?
Not for the recordings themselves, because we never receive them. We do process a small amount of account data to run your license — your email address, license key, app version and a random device ID during license checks. If your organization's policy requires paperwork for that, contact us.
Does anything leave the PC?
Only what you choose. The app checks your license and, when you ask it to, looks for updates — neither sends audio or text. If you turn on optional email or Notion delivery, the transcript goes to the address or workspace you set, and the audio only if you also choose to attach it.
Keep recordings where they belong
Fully Local Transcribe runs entirely on Windows PCs. Try it free for 14 days.