The GDPR divides responsibility for such data between two roles: controller and processor. The role you play in a particular order determines what you must do yourself, which contracts you need and who is liable if something goes wrong. Let us take it step by step.
The two roles in brief
The controller is whoever determines the purposes and means of processing personal data (Art. 4(7) GDPR). The controller is responsible for the lawfulness of the processing and must be able to demonstrate it (Art. 5(2), Art. 24 GDPR).
The processor is whoever processes data on the controller's behalf and on its instructions (Art. 4(8) GDPR). The processor's obligations are set by the contract with the controller (Art. 28(3) GDPR).
The role is determined not by the title of the contract or by what you call yourself, but by the facts: who decides why and by what means the data are processed. The same translator can be a controller on Monday and a processor on Tuesday, depending on the order.
When the translator is the controller
A typical situation: a private individual comes to you directly with a document for sworn translation. You decide yourself how to do the work: which tools to use, where to keep the document, when to delete it. Moreover, a sworn translator acts within their own professional duties laid down by the law of their country, not on the client's instructions: the client cannot tell you to translate differently or to leave out the certification statement. In this situation you are the controller.
What this means in practice:
- Legal basis. You need a basis for the processing (Art. 6(1) GDPR) — usually performance of the contract with the client (Art. 6(1)(b)). If the law of your country requires you to keep copies or a register of translations, the basis for that is a legal obligation (Art. 6(1)(c)).
- Special categories. Documents often contain data on health, origin or religion (Art. 9 GDPR) or information on criminal convictions (Art. 10 GDPR). These require additional grounds and stronger protection. The most common ground in our work is that the client needs the data to establish, exercise or defend legal claims, for example before a court or an authority (Art. 9(2)(f)).
- Informing the client. You must tell the client who you are, why you process the data, to whom they are disclosed and how long they are kept (Art. 13 GDPR). A short notice on your website, in your quote or in the contract is enough.
- Security. You must protect the data with measures appropriate to the risk (Art. 32 GDPR). For documents with data on health or criminal convictions, the risk is high by definition.
- Retention period. Data may be kept no longer than the purpose requires (Art. 5(1)(e) GDPR). If national law requires copies to be kept — for as long as the law requires, and no longer.
- The services you use. If you upload a document to an online service for translation, that service is your processor. You need a data processing agreement with it (Art. 28(3) GDPR), and you may only choose a processor that provides sufficient guarantees of protection (Art. 28(1) GDPR). If the service uses your documents for its own purposes — for example, to train models — it is no longer merely a processor, and you will be answerable for that disclosure.
- Incident. If documents are leaked or lost, you as controller have 72 hours to notify the supervisory authority (Art. 33(1) GDPR) and, where the risk is high, must also inform the client (Art. 34 GDPR).
When the translator is the processor
A different situation: you translate for a translation agency or a company that has itself received documents from its clients and decides how to handle them — which documents, by when, where to deliver the result, when to delete them. Here you generally act on its behalf — that is, as a processor.
What this means in practice:
- Agreement with the agency. The agency must conclude a data processing agreement with you (Art. 28(3) GDPR). If you have not been offered one, that is a reason to ask, not a reason to work without it.
- Only on instructions. You process data only on the agency's documented instructions (Art. 28(3)(a)). You may not use the documents for your own purposes.
- Confidentiality. You must ensure that only persons bound by an obligation of confidentiality have access to the documents (Art. 28(3)(b)).
- Your subcontractors. You may engage your own subcontractor — another translator, an editor, an online service — only with the agency's authorisation (Art. 28(2) GDPR). The same data protection obligations pass to the subcontractor, and if it breaches them, you are liable to the agency (Art. 28(4) GDPR).
- Deletion after the work. When the order is completed, you delete or return the data — as the agency decides (Art. 28(3)(g)).
- Incident. You report any leak to the agency without undue delay (Art. 33(2) GDPR); notifying the supervisory authority is then the agency's task as controller.
Borderline cases
- Sworn translation ordered through an agency. Even when working through an agency, a sworn translator certifies the translation personally and is responsible for it under national law. In such a situation the translator is sometimes regarded not as a processor but as an independent controller. The answer depends on who actually determines what happens to the document.
- Translation ordered by a court or an authority. The role is determined in the same way: by who decides why and how the data are processed. The procedure is often laid down directly in your country's law on sworn translators.
- Working together with a colleague. If the two of you decide together how to carry out an order, you may be joint controllers (Art. 26 GDPR), and then you need to agree who is responsible for what.
If in doubt, write down your decision and the reason for it. A documented position is better than none: it is exactly what the supervisory authority will ask for.
Record of processing: do you need one?
Both controllers and processors must keep a record of processing activities (Art. 30 GDPR). There is an exemption for organisations with fewer than 250 employees (Art. 30(5) GDPR), but it does not apply if the processing is not occasional or includes special categories of data or data on criminal convictions. A translator of official documents processes such data regularly, so the exemption generally does not apply — even to someone who works alone.
What to record as controller — the minimum (Art. 30(1) GDPR):
- your name and contact details;
- the purposes of processing (translation and certification of clients' documents);
- categories of data subjects and of data (clients and persons mentioned in the documents; data from the documents, including special categories);
- recipients (for example, an online translation service as processor);
- transfers outside the EU/EEA, if any;
- time limits for erasure;
- a general description of the security measures.
If you are a processor, the record is shorter (Art. 30(2) GDPR): on whose behalf you work, what kinds of processing you carry out, transfers outside the EU/EEA and security measures.
The record does not have to be filed anywhere. You keep it for yourself and show it to the supervisory authority on request (Art. 30(4) GDPR). For a translator who works alone, it is one or two pages.
Where Lingverra fits in
For the translator, Lingverra is a processor. A data processing agreement under Art. 28 GDPR applies automatically to every user; there is no need to request or sign it separately. All companies involved in the processing are listed in the public list of sub-processors — what each one does, where it is located and on what basis (Art. 28(2) and (4) GDPR). Clients' documents are not used to train models.
For your record, this means: under “recipients” you enter Lingverra as processor and attach links to the agreement and to the list of sub-processors. If you yourself work as a processor for an agency, you can show the agency the same list of sub-processors when you ask for authorisation to use the service.
How we protect documents — step by step and with references to the GDPR — is described in the article “Where your client's document goes when you translate with Lingverra”.
In short
- A client came to you directly — you are generally the controller: legal basis, notice to the client, an agreement with your service as processor, a record.
- You work for an agency — you are generally a processor: an agreement with the agency, work only on its instructions and its authorisation for your subcontractors.
- A sworn translation is your personal responsibility under the law, even if the order came through an agency.
- A translator of official documents almost always needs a record under Art. 30.
Data processing agreement (Art. 28 GDPR)
Read also: Where your client's document goes when you translate with Lingverra