--- id: CP-505 slug: speech-to-text-text-to-speech-privacy lang: en title: Speech synthesis and voice recognition at work description: "Transcribing a meeting or call with AI: what the tool does with your voice, what to check beforehand, and what the GDPR and the CNIL say." canonical_url: https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/ markdown_url: https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Speech synthesis and voice recognition at work", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/ (CC BY 4.0) wing: 4 theme: protect_data reflex: air-024 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/ fr: https://startbrain.io/cyberpedia/fr/articles/synthese-reconnaissance-vocale-confidentialite/ de: https://startbrain.io/cyberpedia/de/articles/sprachsynthese-spracherkennung-datenschutz/ es: https://startbrain.io/cyberpedia/es/articles/sintesis-reconocimiento-voz-privacidad/ sources: - "n": 1 title: Robust Speech Recognition via Large-Scale Weak Supervision publisher: arXiv url: https://arxiv.org/abs/2212.04356 published: "2022-12-06" accessed: "2026-11-03" - "n": 2 title: Donnée biométrique publisher: CNIL url: https://www.cnil.fr/fr/definition/donnee-biometrique accessed: "2026-11-03" - "n": 3 title: Le règlement général sur la protection des données - RGPD publisher: CNIL url: https://www.cnil.fr/fr/reglement-europeen-protection-donnees published: "2016-05-24" accessed: "2026-11-03" - "n": 4 title: "IA et RGPD : la CNIL publie ses nouvelles recommandations pour accompagner une innovation responsable" publisher: CNIL url: https://www.cnil.fr/fr/ia-et-rgpd-la-cnil-publie-ses-nouvelles-recommandations-pour-accompagner-une-innovation-responsable published: "2025-02-07" accessed: "2026-11-03" - "n": 5 title: Les fiches pratiques IA publisher: CNIL url: https://www.cnil.fr/fr/les-fiches-pratiques-ia accessed: "2026-11-03" - "n": 6 title: Guidelines for secure AI system development publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development published: "2023-11-27" accessed: "2026-11-03" - "n": 7 title: OWASP Top 10 for Large Language Model Applications | OWASP Foundation publisher: OWASP url: https://owasp.org/projects/top-10-for-large-language-model-applications accessed: "2026-11-03" - "n": 8 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" - "n": 9 title: Intelligence artificielle | CNIL publisher: CNIL url: https://www.cnil.fr/fr/intelligence-artificielle accessed: "2026-11-03" --- # Speech synthesis and voice recognition at work A speech recognition tool listens to a recording and turns it into text. This is what produces the automatic minutes of a meeting or the transcript of a call. The reverse process, speech synthesis, produces a spoken voice from a text: it is the voice of a voice assistant. For an employee, the useful question is less technical than practical: where the recording goes, who can listen to it again, how long it stays stored, and whether the resulting text is reliable. This page gives the benchmarks that the sources in the file make it possible to establish. It does not cover the European AI regulation or voice cloning, for lack of a source on either point in the drafting file. ## In 30 seconds - Where it happens: automatic meeting minutes, call transcription, voice assistants, dictation. - What is at stake: a recorded voice contains statements, sometimes confidential, and personal data about the participants. - The reflex: send a recording only to a tool approved by the company, tell participants before recording, and proofread the transcript before sharing it. - If it is already done: tell the person who handles security or data protection in the company, without waiting. ## Straight answers ### How does a voice become text? A research paper was published on arXiv on 6 December 2022 [1]. It describes models trained to predict large quantities of transcripts of audio found on the internet, at a scale of 680,000 hours of multilingual data [1]. Its authors write that, compared with humans, these models « approach their accuracy and robustness » [1]. In other words, their level comes close to that of a person, without equalling it according to this wording [1]. ### And from text to voice? No source in the file describes how speech synthesis works. As a precaution, it is better not to enter into such a tool a text that you would not entrust to an outside service. ### Is my voice biometric data? The CNIL defines biometric data as a « Caractéristique physique ou biologique permettant d'identifier une personne (ADN, contour de la main, empreintes digitales...) » [2]. The voice is not mentioned in this definition [2]. The file therefore does not allow a conclusion. The GDPR also places particularly sensitive data in a category with specific protection, and biometric data belong to it when they are used to identify a person [3]. If in doubt about a tool that recognises or authenticates voices, the question goes to the person in charge of data protection before any use. ### Does the GDPR apply to a transcript? The CNIL reminds that, when the GDPR applies, data must be protected in training databases, in the models that may have memorised them, and in the use of models through prompts [4]. The file does not say whether a transcript falls within this framework: the question goes to the person in charge of data protection. ### Must participants be told? The GDPR provides for informing the people whose data are collected (articles 13 and 14, in the contents of the CNIL page) [3]. CNIL sheet 9 deals with informing people: the CNIL states that organisations that process personal data to develop AI models or systems must inform the people concerned [5]. This information obligation appears in the CNIL's practical AI sheets [5]. The file does not specify the rule for a simple meeting recording. The prudent practice is to announce the recording and the tool used at the start of the meeting, and to let everyone refuse. ## How it works A transcription tool receives audio, passes it to a model and returns text. At each of these steps, two practical questions arise: where the data is, and how long it stays there. The UK National Cyber Security Centre (NCSC) addresses providers of AI systems, whether they created the system themselves or built it on tools and services provided by others [6]. Its guidelines were published on 27 November 2023 [6]. Their aim is to build systems that work as intended and « work without revealing sensitive data to unauthorised parties » [6]. An employee is not their addressee, but the idea translates simply: an AI tool must be able to say who has access to the data entrusted to it. On the GDPR side, the text asks the controller and the processor to assess risks and to implement measures to mitigate them, for example encryption, in order to ensure an appropriate level of security, including confidentiality [3]. It lists among the risks the unauthorised disclosure of data transmitted, stored or processed [3]. In a company, it is the company that chooses the tool and signs the contract. This is why the employee goes through the approved tool. ## What you do Before recording or transcribing, four checks are useful. - Check that the tool is approved. A personal account opened on a free service has not been reviewed by the company. If no tool is approved, do not transcribe a sensitive conversation. - Know where the audio goes and how long it stays. This information is in the tool's terms of use or in the internal documentation. If it cannot be found, ask for it before using the tool. - Keep confidential conversations out. A one-to-one interview, a health matter, a commercial negotiation or a security incident do not go into a tool that is not approved. - Tell the participants. Say at the start of the meeting that it is being recorded and transcribed, and by which tool. After transcription, proofreading before sharing is recommended. It covers proper names, figures, decisions and commitments, because the text then travels on into emails and files. If a passage looks odd, it is checked against the recording rather than corrected from memory. ## Pitfalls The first pitfall is trust in the text. According to the research paper cited above, a system can approach human accuracy [1]. A sentence can nonetheless be misunderstood. The file does not quantify the error rate or describe invented transcripts, but OWASP lists the security risks of applications based on large language models [7]. Its presentation cites in particular the « dissemination of sensitive information » and the « compromised decision-making » [7]. A transcript shared without proofreading can produce effects of this kind. The second pitfall is the automatic summary. NIST published on 26 July 2024 a profile devoted to generative AI [8]. This profile is intended to help organisations identify the risks specific to this technology [8]. A meeting summary produced by a model belongs to this family of tools, which justifies proofreading it like a transcript. The third pitfall is the reuse of data. The CNIL notes that models such as language models may contain personal data, and that the rights of access, rectification, objection and erasure may be particularly difficult to implement in an AI model [4]. The fourth pitfall is recording without informing people. The GDPR provides for informing the people concerned (articles 13 and 14) [3]. The CNIL has also published, with the South Korean authority PIPC, a poster « IA générative et vie privée » [9]. It was published on 27 May 2026 [9]. It explains how to protect one's personal data when using an AI [9]. Finally, fraud using an imitated voice, often called CEO fraud, cannot be detailed here: no source in the file documents it. Remembering that a familiar voice on the phone is not enough to approve a request for a transfer or a password is a prudent reflex, not a fact established by this file. ## Sources 1. arXiv, "Robust Speech Recognition via Large-Scale Weak Supervision", 6 December 2022. https://arxiv.org/abs/2212.04356 (accessed 3 November 2026) 2. CNIL, "Donnée biométrique". https://www.cnil.fr/fr/definition/donnee-biometrique (accessed 3 November 2026) 3. CNIL, "Le règlement général sur la protection des données - RGPD", 24 May 2016. https://www.cnil.fr/fr/reglement-europeen-protection-donnees (accessed 3 November 2026) 4. CNIL, "IA et RGPD : la CNIL publie ses nouvelles recommandations pour accompagner une innovation responsable", 7 February 2025. https://www.cnil.fr/fr/ia-et-rgpd-la-cnil-publie-ses-nouvelles-recommandations-pour-accompagner-une-innovation-responsable (accessed 3 November 2026) 5. CNIL, "Les fiches pratiques IA". https://www.cnil.fr/fr/les-fiches-pratiques-ia (accessed 3 November 2026) 6. NCSC (UK), "Guidelines for secure AI system development", 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026) 7. OWASP, "OWASP Top 10 for Large Language Model Applications | OWASP Foundation". https://owasp.org/projects/top-10-for-large-language-model-applications (accessed 3 November 2026) 8. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) 9. CNIL, "Intelligence artificielle | CNIL". https://www.cnil.fr/fr/intelligence-artificielle (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.