The answer to the first question is usually in the service’s own terms of use and privacy policy. It is worth reading them before pasting a client’s document in. The second question is covered below.
An example: what the service itself says
Take one of the most popular translators in Europe — DeepL. Its terms for the free version are written plainly and honestly.
The Terms of Use (version of November 2024) state:
“you may not use the Free Services for processing content containing confidential or personal data of any kind”
— that is, the free services may not be used to process content containing confidential or personal data of any kind. And further:
“The provision of content containing confidential and/or personal data is only allowed within a DeepL Pro subscription”
— providing such content is allowed only within a paid subscription.
The Privacy Policy (version of October 2026, section 3) says of the free translator that uploaded texts and their translations are stored “for a limited period of time” and are used to “train and improve our neural networks and algorithms”. This also applies to corrections the user makes to the suggested translation.
For the paid version the terms are different: according to the same policy (section 4), texts are deleted once the service has been provided and are not used to improve the service.
This is no reproach to the service — it warns you clearly. The problem arises when nobody reads these lines.
The other half of the work: a translation is not yet a document
Suppose you have found a service that can be trusted with personal data. What remains is the part that takes a sworn translator the most time. An online translator returns text. But the client needs a document: with the tables where they are in the original, with every seal and stamp noted in its place, with signatures and handwritten notes, with names in the correct transliteration and with your certification statement. Rebuilding such a layout by hand often takes longer than translating the text itself.
That is why choosing a tool is not only about “can I upload client data there”, but also “how much work will be left after it”.
“But I only paste a snippet”
The most common objection: “I don’t upload the whole document, just a paragraph I can’t make out.” Under the GDPR this changes nothing. Personal data is any information about a person who can be identified directly or indirectly (Art. 4(1) GDPR). A paragraph from a medical report with a diagnosis and a date of birth is already personal data — and of a special category (Art. 9 GDPR).
The same goes for “quick anonymisation”. If you replaced the surname with “X” but the date of birth, the city and the case number remain in the text, the person can still be identified. Such data remains personal (Recital 26 GDPR). True anonymisation means the person cannot be identified by any reasonable means; for a document that then has to be translated and certified in full, that is almost never the case.
Why this concerns you under the GDPR
When you paste a client’s document into an online service, that service processes personal data on your behalf — that is, it must be your processor. The GDPR requires you to:
- choose only a processor that provides sufficient guarantees of data protection (Art. 28(1) GDPR);
- conclude a data processing agreement with it (Art. 28(3) GDPR);
- not process data for purposes incompatible with the original one (Art. 5(1)(b) GDPR — purpose limitation). Training someone else’s model on a client’s documents has nothing to do with the purpose “translate the document”;
- tell the client to whom their data is disclosed (Art. 13(1)(e) GDPR).
If the service’s terms expressly prohibit uploading personal data or provide for training on it, these requirements cannot be met — however convenient the button. And if you work for an agency as a processor, there is one more condition: you may engage your own subcontractor, including an online service, only with the agency’s authorisation (Art. 28(2) GDPR).
Not only translation websites
The same question is worth asking wherever the text of a document goes:
- machine translation built into translation software or a word processor — it often sends the text to the same external service;
- browser extensions that translate a page or a selected passage;
- AI chatbots used to “quickly ask how to translate this”;
- text recognition from a photo via an online service.
For each of them — the same five questions below. A paid version guarantees nothing in itself: some services really do have different paid terms, others do not. What decides is the text of the terms, not the price.
How to check any service in five minutes
Open the terms of use and the privacy policy and find the answers to five questions:
- Is uploading personal data allowed?
- Are texts used to train models?
- How long are texts kept, and can you delete them yourself?
- Is there a data processing agreement under Art. 28 GDPR?
- Where is the data processed — in the EU or outside it?
If there is no clear answer to even one question, a client’s document should not be uploaded there.
If a document has already ended up there
It happens. The main thing is not to pretend nothing happened:
- delete in the service everything you can delete yourself: the history, saved texts, uploaded files;
- write down what exactly ended up where, and when;
- assess whether this is a personal data breach (Art. 4(12) GDPR). If so, the controller has 72 hours to notify the supervisory authority (Art. 33(1) GDPR), unless the risk to the person is unlikely. If you work for an agency, inform the agency without undue delay (Art. 33(2) GDPR);
- for the future — choose a tool that answers all five questions.
What to tell the client if they ask
If a client asks whether you use machine translation, an honest answer is stronger than a denial: “Yes, I do — but only a service that, by contract, processes the data in the EU, does not train models on it and deletes the document after the work. I check and certify every word of the translation personally.” More on such a conversation in the article ““Is my data safe?” — what to tell your client”.
How it works in Lingverra
Lingverra is built for official documents — and therefore for the personal data in them. The answers to all five questions are in its public documents:
- Yes, that is what the service is for.
- No. Translation takes place in the EU on infrastructure that does not store requests and responses and does not pass them to the model developer.
- 72 hours after delivery or manually at any time; deletion is cryptographic.
- Yes, it applies automatically to every account.
- In the EU; all sub-processors are listed publicly.
But above all, the output is not text but a document:
- the translation in the layout of the original: columns, tables and the position of stamps and seals are reproduced in the document — the layout does not have to be rebuilt;
- doubtful passages are highlighted, not guessed — you check exactly those;
- names and Cyrillic are transliterated according to current standards (ISO 9 or the passport spelling);
- original and translation side by side in a two-pane editor, with edits made directly on the preserved layout;
- the certification statement according to the rules of your country and your seal — in the PDF or Word export.
Checking, certification and responsibility remain yours — Lingverra takes over the routine and does it the way the GDPR requires.
In detail and with references to the GDPR — in the article “Where your client’s document goes when you translate with Lingverra”.
In short
- A free translator is for texts without other people’s personal data. Its own terms often say so directly.
- “Only a paragraph” and “the surname was removed” do not make data anonymous.
- Before uploading a document — five questions to the service’s terms. No answer — no upload.
- Ended up there by mistake — delete, write it down, assess it as a possible incident.
- When choosing a tool, look not only at data protection but also at the result: text, or a document ready for certification in the layout of the original.
Data processing agreement (Art. 28 GDPR)
Read also: Where your client's document goes when you translate with Lingverra