GDPR
The GDPR, the General Data Protection Regulation, is the European Union law that sets the rules for collecting and using personal data, and gives people rights over how their data is handled.
Definition
The GDPR is a European regulation on the protection of personal data. It applies to organisations that handle the personal data of people in the European Union, including organisations based outside it. Personal data means any information that can identify a person, such as a name, an email address, a CV, a recording of a voice or an interview transcript.
It is built on a few main principles: process data lawfully, fairly and transparently; collect it for a specific purpose and no more than is necessary; keep it accurate; keep it only as long as needed; and protect it with appropriate security. Organisations must be able to show that they comply. People have rights, including to be informed, to access their data, to have it corrected or deleted, and in some cases to object or not to be subject to a purely automated decision with significant effects.
For HR, education and customer teams, this means telling candidates, employees, students or customers what is collected and why, limiting who can see it, setting retention periods and choosing providers carefully. Recordings and AI-generated reports are personal data too. This page is general information, not legal advice: check your obligations with a legal advisor or your data protection officer.
Key points
- It is the European Union regulation on personal data protection.
- Principles include lawfulness, transparency, purpose limitation, data minimisation, accuracy, limited storage and security.
- People have rights such as access, correction, deletion and information.
- Recordings, transcripts and AI reports about identifiable people count as personal data.
- Check specifics with a legal advisor or data protection officer.
Example
A school wants to record short voice check-ins with students. Before starting, it writes a notice explaining the purpose and who can read the reports, decides to delete recordings after a fixed period, and asks its data protection officer to confirm how parents or guardians of minors should be informed.
Frequently asked questions
Does the GDPR apply outside Europe?
It can. It applies to organisations that process the personal data of people in the EU, even when the organisation is established elsewhere.
Is a voice recording personal data?
Yes, when the person can be identified, which is usually the case. The recording and its transcript should be handled with the same care as other personal data.
Does the GDPR forbid using AI on personal data?
No. It requires that the use is lawful, transparent and proportionate, and it gives people specific protections against purely automated decisions. Ask a legal advisor how it applies to your case.
Related terms
AI conversations, human decisions
Passisto holds structured voice conversations with candidates, employees, clients and students, and turns them into reports your team can act on.