The question often catches a translator off guard: “don’t worry” is not enough, and retelling the data processing agreement takes too long. The good news: if the tool is chosen well, the answer takes thirty seconds. Below — a short answer, answers to common follow-up questions and what is better left unsaid.
The short answer — for a conversation or an email
“Your document is processed in the European Union and encrypted with a separate key. It is not used to train artificial intelligence and is irreversibly deleted after 72 hours or manually at any time. I have a GDPR data processing agreement with the service I use.”
That is enough in most cases. If the client wants more detail, move on to the five points.
If the client wants more detail
Five points that cover almost every question:
- Where the document is processed. In the EU; it is not transferred outside it.
- Who sees it. The document is available only in the translator's account. The service does not use it for anything other than the translation.
- Is AI trained on it. No. The translation runs on infrastructure that does not store requests and responses and does not pass them to the model developer.
- How long it is kept. The original and the translation are deleted 72 hours after delivery or manually at any time. Deletion is cryptographic: the document's key is destroyed together with the file, and after that the document cannot be read — not even from backups.
- Who is responsible. There is a data processing agreement with the service under Art. 28 GDPR, and all companies involved in the processing are listed publicly.
Common follow-up questions — and how to answer them
“But where exactly — in which country?”
In the EU. The companies involved in the processing and their locations are listed in the public list of sub-processors. The service provides the specific current processing location within the EU/EEA on request.
“What if the service gets hacked?”
A stolen file, database or backup cannot be read. Each document is encrypted with its own key, and the document keys are in turn encrypted with a master key. The master key is kept not on the service's servers but in a separate key management system in the EU, and never leaves it; document keys are not in the backups at all. Without the master key, stolen data is a set of random bytes. A document can be decrypted only through the key management system itself — and every such access is recorded in a log that the service cannot alter. An unusual access raises an alarm immediately.
“Can you delete my document right now?”
Yes. The client has the right to have their data erased (Art. 17 GDPR), and this can be done right away, without waiting for the automatic deadline. Delete the document in your account and let the client know it has been done.
“What exactly do you keep about me?”
The client has the right to know (Art. 15 GDPR). The answer is usually short: the document — until it is deleted, and after that only what you yourself are required to keep: for example, an invoice or an entry in a register of translations, if the law of your country requires one.
“Won’t the AI later show my passport to someone else?”
No. The model is not trained on your documents, and the infrastructure it runs on stores neither the request nor the response. The document does not become part of the model and cannot “surface” for another user.
Which documents to keep at hand
- The data processing agreement with your service — confirms that the processor is bound by obligations under Art. 28 GDPR.
- The list of sub-processors — shows who else takes part in the processing, and where.
- Your record of processing (Art. 30 GDPR) — in case a client or an inspector asks how you handle data.
You can simply forward the links to the first two documents to the client. The record does not need to be sent to the client — it is your internal document, which you show to the supervisory authority on request.
A ready-made paragraph for an email or a quote
Many clients ask about this in advance — it is easier to answer before the question comes. You can add the paragraph to your quote, your email signature or your website:
“I translate your documents using a service that processes them in the European Union. Each document is encrypted with a separate key, is not used to train artificial intelligence and is deleted no later than 72 hours after the translation is delivered — or earlier, at your request. A data processing agreement under Art. 28 GDPR is in place with the service.”
If you are the controller (the client came to you directly), this paragraph is also part of the information you must give the client under Art. 13 GDPR: who processes their data and with what help, and how long it is kept.
What is better left unsaid
- “It’s a standard service, everyone does it” — the client cares about specific conditions, not popularity.
- “Nothing is stored” — if the document is stored even for a few hours, this is not true. Better to name the period honestly.
- “It can’t be hacked” — nobody can promise that. More honest and stronger: “the document is encrypted, the key is kept separately, every access to it is recorded”.
- “It’s not my responsibility” — under the GDPR, you are responsible for choosing a reliable processor (Art. 28(1) GDPR). It sounds stronger to say: “I use a service that guarantees this by contract”.
When the client has asked you not to use online services
This happens — especially with medical or court documents. You may agree, or explain why your tool is safe by showing the agreement and the list of sub-processors. The decision is the client’s: it is their data. If the client insists, note it on the order so that there is no disagreement later.
If you work with Lingverra
The short answer above matches exactly how Lingverra works: processing in the EU, a separate key for each document, no model training, cryptographic deletion after 72 hours or manually at any time. The data processing agreement applies automatically to every account, and the list of sub-processors is published. In detail and with references to the GDPR — in the article “Where your client’s document goes when you translate with Lingverra”. Which of you is the controller and which the processor, and what record you need — in the article “Sworn translators and the GDPR: are you a controller or a processor?”.
In short
- Thirty seconds: EU, separate key, no AI training, deletion after 72 hours or manually at any time, a GDPR agreement.
- Answer follow-up questions specifically: where, who sees it, how to delete it, what happens in an incident.
- Do not promise “nothing is stored” or “it can’t be hacked” — name periods and measures.
- Keep the data processing agreement and the list of sub-processors at hand — you can forward them to the client.
Data processing agreement (Art. 28 GDPR)
Read also: Where your client's document goes when you translate with Lingverra
Read also: Sworn translators and the GDPR: are you a controller or a processor?