GDPR and AI Video Translation: What You Need to Know

If you translate video featuring real people, GDPR applies to you before it applies to your tool. Faces and voices are personal data, and voice cloning is a new processing purpose that whatever consent you originally collected probably didn't cover. Four questions settle most of it: what you're processing, on what legal basis, where it goes, and how long it stays.

What personal data is in a video ad

• The speaker's face and voice — personal data wherever the individual is identifiable
• The voice model — cloning derives a model from a real person's voice; where such data is used to identify someone uniquely it falls under the stricter special-category rules, so it's safest to treat it as sensitive by default
• Everyone else in frame — passers-by, colleagues, customers

Your obligations, in order

1. Legal basis — for creators and talent this normally sits in the contract; for staff or customers appearing in footage, consent is usually the only workable basis
2. Scope the purpose properly — "appears in one US ad" is not "has their voice cloned into eight languages". Name the languages and channels explicitly.
3. Data minimisation — upload the clips you need translated, not the whole raw folder
4. Retention — know how long the tool keeps your videos and voice models
5. Deletion — someone can ask you to erase their data, and you need to be able to actually do it

Who is the controller here

In most setups you are the controller of the footage you upload, and the tool is a processor acting on your instructions. That's the relationship your records of processing should describe — and it's why a vendor's hosting location and retention terms end up in your compliance file, not just theirs.

Where GeckoDub stands

GeckoDub is an EU company and processes content on EU cloud infrastructure, so there's no third-country transfer to paper over with standard contractual clauses. Your content is not used to train public foundational models, and it's retained for a limited period — around three months on an active subscription, about a month after cancellation — rather than indefinitely.

Using a non-EU tool isn't prohibited. It just adds a transfer mechanism and an assessment that you have to maintain.