GDPR-compliant AI translation: What businesses need to know about privacy, security, and customer data

The General Data Protection Regulation governs how organizations process personal data relating to people in the European Union.

Personal data is much broader than a name or email address. A support conversation can contain account details, IP addresses, location information, payment information, health information, customer IDs, or combinations of data that can identify someone.

When that conversation is sent to an AI translation provider, processing has occurred.

The European Commission identifies seven core GDPR principles, including lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

For translation teams, those principles turn into practical questions.

Do we need to send all of this data to get the translation?

What will the provider do with it?

How long will it remain there?

Who else receives it?

Can we prove the answers?

Yes, when the organization has an appropriate lawful basis for processing the data and the rest of its GDPR obligations are met.

The GDPR does not create a blanket ban on using AI with personal data. The European Data Protection Board has specifically addressed the use of personal data in the development and deployment of AI models and says the appropriate legal basis must be assessed for the processing involved.

That does not mean employees should paste customer conversations into any AI tool they find online.

The organization needs to know the service terms and the actual data flow before personal information enters the system.

The use of personal data for AI training is a separate processing purpose that needs its own GDPR analysis.

The European Data Protection Board’s 2024 opinion on AI models addresses how personal data may be used in AI development, including the legal basis for that processing and whether AI models containing or exposing personal data can truly be treated as anonymous.

This creates a simple purchasing question for an AI translation service:

Is the content we send for translation used to train or improve an AI model?

Language IO never uses customer translation data to train models or improve AI performance.

That separates the purpose of the processing clearly. The content is sent to produce a translation, not to become future model-training material.

GDPR does not prescribe a universal deletion period for translation data. It does require storage limitations.

The European Commission says personal data should be kept for the shortest time necessary for the purpose for which it was collected.

That makes retention a major question when evaluating an AI translation provider.

A provider might retain:

• The original text
• The translated output
• Prompts
• Logs
• Conversation histories
• Quality data
• Backup copies

Every retained copy needs a reason, a retention period, and appropriate protection.

Language IO takes a different approach in that customer-generated content sent for translation is not persisted in its database, logs, or other storage. Once the translation is returned, the source content and translated content are scrubbed from Language IO and its translation subprocessor systems.

That is the basis of Language IO’s Zero Data Retention model.

GDPR’s data minimization principle says organizations should process only the personal data needed for the intended purpose.

For translation, that means the provider should not need access to an entire customer record simply to translate one support message.

Language IO’s CRM integrations do not pull information from associated customer contact or agent profile records. The platform receives the information required to perform the translation and return it to the requesting CRM.

That approach maps closely to the idea of minimizing the data involved in the translation process.

When a company processes personal data on behalf of another organization, GDPR Article 28 can require a contract governing that processing.

This is commonly handled through a Data Processing Agreement, or DPA.

A DPA generally defines issues such as the purpose and scope of the processing, security obligations, subprocessors, deletion, and the responsibilities of the controller and processor.

This is one reason a public AI tool and an enterprise AI service should not automatically be treated as interchangeable.

An enterprise buyer should ask whether the translation provider can support the contractual requirements that apply to its processor relationship.

The company providing the translation interface may not be the only company processing the content.

An AI translation workflow can include:

Your CRM → translation provider → AI or machine translation engine → translation provider → CRM

The underlying model provider may therefore be a subprocessor.

Language IO leverages the best model for translating each language pair and therefore leverages third-party translation subprocessors. Personal data is scanned, encrypted, and anonymized before being passed to the translation service. The content is then removed from both Language IO and subprocessor systems after translation.

Language IO only works with machine translation engines or large language models that contractually agree not to store customer data or leverage any data in training models.

It can, but GDPR protections continue to apply when personal data is transferred outside the EU or EEA.

The European Commission says GDPR protections travel with the data. Transfers to countries outside the EU may rely on mechanisms such as an adequacy decision or appropriate safeguards such as Standard Contractual Clauses.

This makes data location only part of the question.

Businesses should ask:

• Where is the translation processed?
• Where are the AI providers located?
• Are any subprocessors outside the EEA?
• What transfer mechanism applies?
• Are Standard Contractual Clauses required?
• Does the provider maintain an up-to-date subprocessor list?

A provider saying that it is “GDPR compliant” does not remove the need to understand these transfers.

There is no single answer that applies to every version, account type, contract, or implementation of a general-purpose AI service.

Organizations should review the exact service they plan to use.

For translation involving personal data, the more useful questions are:

Does the service retain prompts?

Can submitted content be used for model training?

Which subprocessors receive it?

What contractual relationship applies?

Where is the information processed?

Can the organization meet data-subject and deletion obligations?

This is why copy-and-paste translation through unapproved AI tools creates problems for security and privacy teams. The employee sees a translation box. The organization sees a new data-processing relationship.

DeepL offers enterprise privacy and security controls and markets GDPR-compliant services. The terms and data practices differ between products and service levels, so organizations should evaluate the specific version they intend to use.

The same rule applies to any translation engine.

Language IO can connect to multiple translation engines rather than forcing an organization to manage each engine as a separate employee workflow. Language IO applies its own processing, security, pseudonymization, retention, and model-selection controls around those translation requests.

---

The exact practices of any provider should be checked against its current contract and product documentation.

Language IOhas complied with GDPR since the regulation took effect in May 2018 and has completed Data Protection Impact Assessments for its products.

Our current security approach includes several controls that map directly to common GDPR concerns.

Data minimization

Our integrations send only the data required to perform the translation and return it to the requesting system.

Zero Data Retention

User-generated translation content is not persisted in Language IO databases or log files. Source content and translated output are removed after processing.

No AI training

At Language IO, customer content is never used to train models or improve AI performance.

Personal data protection

Incoming translation content is scanned for personal information. When detected, personal data is encrypted and pseudonymized before being sent to a translation subprocessor.

Secure transmission

Data moving between the CRM, Language IO, and translation services uses encrypted and authenticated connections. Language IO’s security documentation specifies TLS 1.2 for these connections.

Subprocessor controls

With Language IO, translated content is removed from both its own systems and subprocessor systems after processing and that machine translation providers must contractually agree not to store customer data.

Security and AI governance

Language IO’s security program includes ISO 27001:2022, ISO 42001, SOC 2 Type II controls, quarterly penetration testing, weekly vulnerability scans, and ongoing intrusion detection and prevention.

Start with what happens to one customer message.

1. What personal data receives processing?
2. What is the purpose of that processing?
3. Do you store the original message or translation?
4. Does any of our content enter logs?
5. Is customer data used to train AI models?
6. Which AI models and subprocessors receive the content?
7. Where is each subprocessor located?
8. Are international transfers involved?
9. What transfer safeguards are used?
10. Can you provide the appropriate DPA?
11. How do you support deletion and other data-subject rights?
12. How do you minimize the amount of data processed?
13. How is information encrypted?
14. What independent security audits or certifications can we review?

A provider should be able to answer those questions without hiding behind the phrase “enterprise-grade security.”