Speech data

DPA Overview

Last updated: July 2026

Data processing governance for enterprise speech data collection. The DPA is executed before production collection begins.

1. Executive summary

This page is an overview for internal review. The signed DPA and role definitions are finalized during scoping.

Execution: DPA executed before production collection begins
GDPR: Processing aligned with GDPR principles; Article 28 addressed in contract documentation
Roles: Processor or Independent Controller, defined per engagement
Consent: Consent and provenance verifiable for all collected data
Sub-processors: Governance and disclosure included in DPA terms
Audit: Documentation available for legal and compliance review
Retention: Retention and deletion terms defined contractually during scoping

2. Roles and responsibilities

Role designation between Controller and Processor is determined per engagement based on the nature of the data processing activities and contractual requirements.

Processor engagements: YPAI processes personal data on behalf of the client organization according to documented instructions. The client remains the Controller.

Independent Controller engagements: In certain arrangements, YPAI may act as an Independent Controller for specific processing activities. This is documented in the engagement agreement.

Role definitions and responsibilities are specified in the DPA and reviewed during scoping. Specific obligations are defined contractually.

3. Processing scope and data categories

Speech data collection workflows involve processing of audio recordings and associated metadata. Data categories processed include:

Voice recordings (audio files)
Transcripts and annotations
Speaker metadata (anonymized identifiers, demographic categories as defined per project)
Consent records and provenance documentation
Technical metadata (sample rate, format, duration)

Purpose limitation: Data is processed for the purposes of collection, validation, quality assurance, and delivery as defined in the engagement agreement. Specific data categories and processing purposes are documented in the DPA Annex and defined during scoping.

5. Sub-processors and third parties

Sub-processors engaged in data processing activities are disclosed as part of the DPA terms.

Sub-processor list or categories provided during scoping
Sub-processor governance procedures defined in the DPA
Update notification and approval mechanisms agreed contractually

6. Retention and deletion

Retention periods and deletion procedures are defined contractually during scoping.

Retention windows vary by engagement and are specified in the DPA
Deletion procedures aligned with GDPR requirements
Ability to support enterprise retention policies as defined per project

Post-engagement: Data handling after engagement completion is documented in the DPA, including return or deletion options. Specific retention periods and deletion timelines are provided for internal review during scoping.

7. Security, access control, and audit readiness

Internal controls and security measures are implemented to protect data during collection, processing, and delivery.

Access control: Access to data is limited to authorized personnel. Access control policies are documented and available for review.

Audit readiness: Full audit documentation is available for legal and compliance review. We can provide documentation of security practices upon request during scoping.

8. Procurement and legal FAQ

When is the DPA signed?

The DPA is executed before production collection begins. During scoping, we provide draft DPA terms for internal review. The signed agreement is finalized before any data processing activities commence.

Is YPAI a Controller or Processor?

Role designation depends on the engagement model. YPAI may act as Data Processor or Independent Controller depending on the contractual arrangement. Role definitions are specified in the DPA and reviewed during scoping.

Can we review sub-processors before signing?

Sub-processors are disclosed as part of the DPA terms. A list of sub-processors or categories of sub-processors is provided during scoping for internal review.

How is consent demonstrated?

Consent is obtained through our controlled platform and is verifiable. Provenance records are maintained for audit purposes. Details of consent mechanisms are documented in the DPA and available for compliance review.

What audit artifacts can you provide?

Full audit documentation is available for legal and compliance review. This includes provenance records, consent documentation, and processing logs. Specific audit requirements can be addressed during scoping.

What happens if requirements change after pilot?

Requirement changes are handled through contract amendment procedures defined in the engagement agreement. We work with your legal and procurement teams to document changes appropriately.

How do you handle deletion requests?

Deletion and retention terms are defined contractually during scoping. Procedures for handling deletion requests are documented in the DPA and aligned with GDPR requirements.

Do you support regulated environments?

Yes. Our approach is designed for organizations in regulated environments including healthcare, finance, and automotive. Specific regulatory requirements are addressed during technical and compliance scoping.

Can we use our own DPA template?

We are able to review and work with client-provided DPA templates. Template review and negotiation occur during the scoping phase.

How are sub-processor changes communicated?

Sub-processor update procedures are defined in the DPA. Notification mechanisms and approval workflows are agreed upon during contract negotiation.

Request an enterprise consultation

If you need a formal appendix for internal review, ask and we will provide it during scoping.