GDPR compliance: what it means for translation tools and how to check

Machine translation is now part of everyday business. But the moment personal data, contracts or internal documents pass through an AI tool, one question becomes critical that too few companies ask consistently: what does "GDPR-compliant" actually mean?

No other regulation is used as actively as a marketing argument. Yet GDPR compliance means, first and foremost, just one thing: the legal minimum. For IT decision-makers and compliance managers looking to roll out a tool company-wide, a marketing promise isn't good enough. This post outlines what actually matters when it comes to GDPR-compliant AI translation, and how to verify it properly.

Why "GDPR-compliant" is not a quality feature

There is no official seal of approval, and no EU authority that certifies software as GDPR-compliant. Compliance isn't a status a provider achieves once and can claim indefinitely. It's the result of a combination of server location, contractual setup, data-processing practices and verifiable security standards – and companies need to check all of these themselves.

Four criteria for a secure AI translator for enterprise use

1. ISO 27001 certification

This standard confirms that an independent auditor has reviewed the provider's processes around access control, encryption and risk assessment. What matters is not just the existence of a certificate, but its scope: a certificate that only covers part of a company's operations tells you little about the service you're actually using.

2. Swiss hosting

Switzerland has a data protection level recognised as acceptable by the EU, and offers a concrete legal advantage over US cloud providers: Swiss providers aren't subject to the US CLOUD Act, which can give US authorities access to data regardless of where the servers are physically located. For compliance teams, Swiss hosting significantly simplifies documentation under Art. 44 et seq. GDPR.

3. No training data from paid subscriptions

Many free tools use translated content to train their underlying AI models. A reputable provider will rule this out contractually for business customers – and not just in the terms and conditions, but explicitly in the data-processing agreement.

4. Data-processing agreement under Art. 28 GDPR

The moment a tool processes personal data, a DPA is a legal requirement. A provider that can't offer a standardised DPA simply isn't fit for enterprise use. A solid DPA sets out the purpose and scope of data processing, technical and organisational measures, subprocessors, and deletion timelines following the end of the contract.

A practical checklist

GDPR compliance is the starting point. These five questions go a step further and test whether a provider is genuinely reliable when it matters:

• Is there a valid ISO 27001 certificate with an appropriate scope?
• Is the data hosted in Switzerland or the EU — verifiably, not just claimed?
• Is your content contractually excluded from being used as training data?
• Does the provider offer a ready-to-sign DPA under Art. 28 GDPR?
• Are deletion policies and retention periods clearly documented?

GDPR-compliant is the starting point, not the finish line

Meeting only the legal minimum means meeting only the legal minimum. For companies that regularly handle sensitive data, that's not a sufficient basis. The question isn't whether an AI translation tool is GDPR-compliant – it's whether it's verifiably secure when it counts. Take the time to ask every provider these questions. This will protect not only personal data, but also your company from unnecessary liability.

See how Supertext meets these criteria on our Enterprise page.