GDPR and Translation: How to Protect Your Confidential Documents?

Sending confidential documents for translation involves sharing personal data with a third party - which triggers GDPR obligations. Understanding what Article 28 requires, what a data processing agreement (DPA) should contain, and why EU server location matters will help you choose a translation partner that protects your clients' data as robustly as you do.

Why translation is a GDPR data processing activity

Under the General Data Protection Regulation (GDPR), any organisation that handles personal data on behalf of another is a data processor, and the organisation that determines the purpose and means of processing is the data controller. When you send a document containing personal information - a medical record, a legal contract, a HR file, a sworn declaration - to a translation agency, you are sharing personal data with a third-party processor. GDPR Article 28 requires that this relationship be governed by a Data Processing Agreement (DPA), also known as a Data Processing Addendum. Without a valid DPA, the transfer of personal data to a translation agency constitutes a GDPR violation - even if the data never leaves the EU.

What a Data Processing Agreement must contain

A GDPR-compliant DPA between a translation client (controller) and a translation agency (processor) must specify, at minimum:

• The subject matter, nature, purpose, and duration of the processing
• The types of personal data involved and the categories of data subjects
• The controller's instructions to the processor, including deletion requirements
• The processor's obligations - confidentiality, data security measures, sub-processor controls
• The processor's assistance obligations (data subject rights, breach notification)
• Deletion or return of data at the end of the contract

TranslateBE provides a pre-signed GDPR-compliant DPA to every client who requests one. All professional translation assignments are governed by this agreement as standard.

Why EU server location matters

GDPR restricts the transfer of personal data outside the European Economic Area (EEA) to countries that have not been granted an adequacy decision by the European Commission or where appropriate safeguards (such as Standard Contractual Clauses) are not in place. Many translation tools - including popular machine translation APIs - process data on servers located in the United States or other non-EEA countries. Using these tools without proper data transfer safeguards constitutes a GDPR violation.

TranslateBE stores and processes all client documents exclusively on EU-based servers (Frankfurt, EU-West-1) that are subject to European data protection law. We do not use machine translation tools that transfer data outside the EEA for professional confidential assignments. Where we use assisted translation tools, these are configured to process data within the EU only.

Document retention and deletion

Good data hygiene requires that translation agencies do not retain client documents longer than necessary. TranslateBE's data retention policy provides that client documents are deleted from our systems 30 days after delivery of the completed translation. For ongoing clients, documents may be retained for longer with explicit written consent - for example, to maintain a translation memory that speeds up future projects. Clients may request immediate deletion of their documents at any time by contacting our data protection contact. All deletion requests are confirmed in writing within 72 hours.