Contents8
In short
A text translated online goes to a provider. A product page raises no issue there; a customer email, a CV or a contract does.
As soon as a text contains personal data, the translation provider processes that data on your behalf: the GDPR requires a contract and guarantees.
Terms change from one plan to another, not only from one provider to another: a tool’s consumer version and its business offering do not promise the same thing.
A simple grid, by sensitivity of the text, tells you which tool can translate what.
Translating has become a routine gesture: paste a paragraph, get the translation back. Yet that gesture sends the text to a third-party company, on servers you cannot see, under terms you have rarely read. For a product page or a blog article, little is at stake. For the reply to a complaint, a job application or a contract, it is a compliance question.
This article helps you sort things out, from the point of view of the company commissioning the translation. It does not replace the opinion of your data protection officer or your lawyer, who remain the ones who decide. It extends our articles on website translation.
When a translation becomes personal data processing
It all depends on what the text contains. A product description, an offer page, an article: nothing personal, and the GDPR stays out of it. A customer email, a support ticket, a CV, an employment contract, named meeting minutes: the text contains personal data, and sending it to a translation tool is processing within the meaning of the GDPR.
Definition
Processor
Under the GDPR, the organisation that processes personal data on behalf of a company, called the controller. The provider of a translation tool that receives your customer emails is one.
Article 28 of the regulation then requires two things: only use processors that provide sufficient guarantees, and govern the processing by a contract (often called a DPA, a Data Processing Agreement). The business offerings of the major providers offer one; consumer versions, used with a personal account or without an account, generally do not give the company that framework.
Where a text goes when you translate it
The journey of a text entrusted to a translation tool
- Sending
The text leaves your computer or your software.
- Processing
It is translated on the provider’s servers, in a given country.
- Retention
It is deleted at once, or kept a few days, or longer.
- Training
It is used, or not, to improve the provider’s models.
Each step has its question, and the answer is in the terms of the plan you actually use. A few examples, checked on 19 October 2026, show how much it varies.
DeepL. The privacy policy for the translator without a subscription states that submitted texts and their translations are processed for a limited period to train and improve its neural networks. For the Pro plans, the data security page states that texts are never stored or used for training without consent.
Google. For the Cloud Translation API, Google says it does not use the content you send to train its translation features, and holds it briefly in memory while translating. For the Gemini API, its pricing page distinguishes the paid tier, whose content is not used to improve its products, from the unpaid tier, whose content is.
General-purpose model APIs. OpenAI states that data sent to its API has not been used to train its models since 1 March 2023, but keeps abuse monitoring logs for up to 30 days by default, and offers processing in Europe subject to approval. Anthropic states that it deletes API inputs and outputs within 30 days, with exceptions. Every other provider, European ones included, publishes its own rules, to be read plan by plan.
Consumer version
Personal account or no account
Texts sometimes used to improve models
No processing agreement with the company
Business plan or API
Company account, written terms
Training excluded by default at the main providers
Processing agreement and stated retention period
These terms change: reread them when you switch plans, and at least once a year.
What if the text leaves the European Union?
A provider whose servers are outside the European Union or the European Economic Area takes the data out. The GDPR allows it, the CNIL points out, provided a sufficient level of protection is ensured: a European Commission adequacy decision for the country, or safeguards such as the standard contractual clauses, updated by the Commission on 4 June 2021.
For the United States, the Commission adopted an adequacy decision on 10 July 2023: transfers to US organisations listed under the EU-US Data Privacy Framework can take place without specific safeguards. Check that your provider is listed, or that it offers processing within the Union. For other countries, the question arises provider by provider, and the answer is for your data protection officer.
Sorting texts by sensitivity
The simplest approach is not to look for one perfect tool for everything, but to sort the texts, then assign suitable tools to each category.
From the field
Our data governance grid, written into each client’s contract, has three levels. Public content (product pages, articles, property descriptions) goes through any provider in our routing table, at the best price. Internal content with no personal data goes through providers that commit not to retain it or use it for training, checked at the time of choice. Personal or regulated data (HR, health, legal, named customers) only goes to a self-hosted model, on our server or the client’s, or to a European provider bound by contract, and never to a consumer offering.
The most sensitive level has a technical answer: a model installed on a server the company controls, from which no data leaves. The different degrees of control, from cloud provider to in-house server, are detailed in private AI in business: the four levels of control, and the general obligations in AI Act and GDPR: what an SME using AI must do.
Five questions to ask before choosing a tool
- What do the texts contain?
Public, internal or personal: the answer says which plans are possible.
- Which plan exactly?
Consumer version, business plan or API: read the terms of the one you use.
- Where is the text processed?
In the Union, or elsewhere with which safeguards.
- How long is it kept, and for what?
Retention period, model training, monitoring logs.
- Which contract?
A processing agreement signed by the company, not terms accepted by an employee with a personal account.
These questions come on top of those about quality, covered in DeepL, Google or an LLM: which translates your trade best and measuring translation quality. A compliant plan that translates badly is useless; an excellent plan that offers no framework is not suitable for personal texts.
The texts that need the most attention
Customer support. This is the most common case: every message contains a name, an address, an order number. The full workflow is in translating customer support emails without hiring.
Contracts and legal documents. They combine personal data and business secrets, and their translation commits the company: see translating a contract with AI: where it stops.
An application’s data. Interface strings raise no issue, content entered by users does: translating software covers the technical side.
New markets. Opening a country outside the Union often means working with local tools and providers: the data question arises from the start, as selling in China or Southeast Asia shows.
The rest of the website generally contains no personal data: pages, product pages and articles are translated with the tool chosen for its quality and cost, following automatic or reviewed translation, translating product pages for export and translating a whole blog, with a brand glossary and a translation memory that stay with you. The budget for each option is in website translation cost: per word, per page, per market, and the market choices in keywords abroad, localize, don’t just translate, opening an English-speaking market and which European market to open first.
Where to start
Take stock of the translation tools actually used in the company, including those teams adopted on their own, and note for each the plan, the account (personal or company) and the texts that go through it. Personal texts going through a consumer version are the first job.
To set up translation that sends each text to the right place, from a self-hosted model to the best-priced API, tell us about your texts and current tools: we start from your inventory, your data protection officer keeps the decision.
Frequently asked questions
Is DeepL GDPR compliant?
The question is answered plan by plan. The version without a subscription may use texts to improve its models, according to its privacy policy; the Pro plans state that texts are never stored or used for training without consent. For personal data, use a business plan with a processing agreement.
Can you translate customer emails with ChatGPT?
Not with a personal account or a consumer version: the company has neither a processing agreement nor control over retention. With a business plan or an API covered by contract, it is possible, after checking where the data is processed and how long it is kept. The same reasoning applies to any model provider.
Is a US provider forbidden?
No. Since the adequacy decision of 10 July 2023, transfers to US organisations listed under the EU-US Data Privacy Framework are allowed without specific safeguards. Check that the provider is listed, or choose processing within the Union when it is offered.
Do you need a self-hosted model to translate sensitive documents?
It is the option that keeps the most control: no data leaves your server. A European provider bound by contract is the other option. For public texts, it is not necessary: an online service, chosen for its quality and cost, is suitable.
Sources
- Regulation (EU) 2016/679, official text on EUR-Lex (new tab)eur-lex.europa.eu
- DeepL, privacy policy (new tab)deepl.com
- DeepL, Pro data security (new tab)deepl.com
- Google Cloud Translation, data usage (new tab)docs.cloud.google.com
- Google, Gemini API pricing (new tab)ai.google.dev
- OpenAI, data sent to the API (new tab)developers.openai.com
- Anthropic, privacy center (new tab)privacy.claude.com
- CNIL, data transfers outside the EU (new tab)cnil.fr
- CNIL, new adequacy decision for the United States (new tab)cnil.fr
Jim · founder of Brain Plus AI
Also in translation and new markets
Understand9 min
Translating a contract with AI: where it stops
AI translates a contract, terms of sale or a privacy policy quickly, and helps you understand a text you received. It stops where the text commits you: the binding version, concepts with no equivalent and official documents stay with lawyers and certified translators.
Understand7 min
Translating customer support emails without hiring
Answering every customer in their language does not take one person per language. The support tool translates both ways, canned replies are translated once, and the messages that commit you go through someone who reads the language.
Choose and price7 min
DeepL, Google or an LLM: which translates your trade best
Every provider publishes a test it wins, and independent evaluations crown a different winner from one year to the next. For a specialised text, the only reliable answer comes from a trial on your own texts, language by language, judged by someone who reads the language.