Data Protection Impact Assessment: Public Summary
TP Transcription Limited has completed a Data Protection Impact Assessment (DPIA) of its human transcription service. This page explains the processing covered, the risks to individuals and the safeguards in the approved assessment.
Underlying assessment approved by Jonathan Fagan, Operations and IT Director, on 8 October 2026. Next scheduled review: 8 October 2027, or sooner following a material change.
Purpose and scope
A Data Protection Impact Assessment, or DPIA, considers how personal data processing could affect the rights and freedoms of individuals and identifies measures to address those risks. Our general assessment covers receiving recordings, allocating work, human transcription, quality review, secure delivery and deletion.
It applies to client audio and video recordings, working transcripts, completed transcripts and associated instructions handled by authorised employees and freelance transcribers. It is relevant to academic, business, legal, medical and investigative transcription where the same underlying workflow is used.
This public summary does not replace an engagement-specific assessment where the purpose, sensitivity, scale or delivery arrangements introduce different risks. AI transcription, live capture, translation, profiling, biometric identification, cross-client data matching and automated decisions are outside the assessed scope, as are the client’s subsequent decisions based on a transcript.
Our role and the client’s responsibilities
For client recordings and transcripts, TP Transcription Limited normally acts as a data processor. The client normally acts as the data controller and determines why the information is processed, the lawful basis and the permitted uses of the resulting transcript. These roles must be confirmed in the contract.
We process client content under documented instructions and the applicable data processing agreement. The controller remains responsible for its wider DPIA obligations. We support that assessment by providing information about our service, safeguards and relevant suppliers. Our separate processing of business administration, employment and accounting records is outside the scope of this assessment.
Information and individuals involved
Recordings may identify interview participants, employees, customers, research participants, witnesses or other people mentioned during a discussion. Personal information can include names, voices, contact details, employment information, financial circumstances and personal experiences.
Some assignments may include health information or other special category data, criminal offence information or allegations, or information about children and vulnerable adults. The categories, volume, frequency, number of people and retention requirements must be considered for each engagement. We do not assume that an interview is anonymous simply because names have been removed.
Necessity and proportionality
Access to the recording is necessary to produce an accurate written account. The amount of information shared, the number of people with access and the period for which copies are kept should be limited to what is required for the agreed service.
Where appropriate, the client can provide relevant extracts, use reference numbers or request anonymisation. A summary or set of minutes may be sufficient for some purposes, but may omit detail needed for research, legal or investigative work. The chosen output should reflect the client’s legitimate purpose and the possible effects on the people concerned.
The controller must establish the lawful basis and any additional conditions required for special category or criminal offence data. Client content must not be reused for unrelated purposes, marketing or AI training.
How information moves through the service
| Stage | Processing activity | Protection required |
|---|---|---|
| Receipt | Recordings and instructions are received through the agreed transfer route or accessed within an approved client system. | Secure transfer, verified access and an identifiable job reference. |
| Allocation | Authorised personnel allocate the work to an appropriate transcriber. | Access limited to assigned work and minimum necessary administrative information. |
| Transcription and review | A human transcriber prepares the transcript and authorised personnel undertake the required checks. | Confidentiality, approved equipment and software, a private working environment and controlled versions. |
| Delivery | The completed transcript is returned to the client’s authorised recipients. | Recipient verification and the agreed secure delivery method. |
| Closure | Working material is deleted or returned in accordance with documented instructions and the applicable retention schedule. | Defined deletion responsibilities, limited retention and consideration of backup copies. |
Main privacy risks and safeguards
Risk is assessed by multiplying likelihood and consequence, each scored from 1 to 4. Scores of 1–5 are low, 6–11 medium and 12–16 high. Consequence reflects potential harm to individuals. Inherent risk is assessed before safeguards; residual risk is the risk remaining with the approved controls applied. These scores are professional judgements, not measured probabilities, and a low score must not override a credible prospect of very serious harm.
| Risk | Possible effect on individuals | Relevant safeguards |
|---|---|---|
| Unauthorised access or disclosure | Loss of confidentiality, distress, reputational damage or financial disadvantage. | Restricted access, authentication, encryption requirements, confidentiality obligations and secure working practices. |
| Incorrect delivery | Disclosure to an unintended recipient or another client. | Job and recipient checks, controlled sharing and secure delivery arrangements. |
| Inaccurate transcription | Misrepresentation of a person’s words or adverse effects on decisions relying on the transcript. | Human verification, agreed transcription conventions, clear treatment of uncertainty and correction procedures. |
| Excessive collection or retention | Unnecessary exposure of private information or loss of control over old copies. | Data minimisation, documented retention periods, deletion instructions and backup lifecycle controls. |
| Unauthorised external processing | Unexpected use, retention or transfer by an unapproved provider. | Supplier review, contractual controls, restrictions on unauthorised uploads and prohibition of AI processing of client content. |
| Loss or unavailability | Delay, repeated interviews or difficulty accessing an accurate record. | Business continuity arrangements, protected backups and recovery procedures. |
| Inadequate rights or incident handling | Delayed correction or access, or prolonged exposure following a breach. | Requests and incident procedures, prompt escalation and assistance to the controller. |
Technical and organisational requirements
Our information security policies specify access on a need-to-know basis, confidentiality obligations, personnel training, secure equipment, protection against malware and removal of access when it is no longer required.
Our cloud security policy requires TLS 1.2 or higher for data in transit and encryption of sensitive or personal information at rest. Our MFA policy requires multi-factor authentication for relevant accounts and remote access, with documented assessment, compensating controls and approval where implementation is not technically feasible. The approved service configuration must continue to meet these requirements. Documented backup arrangements specify AES-256 encryption; this is a statement about backups, rather than every application or platform.
Our AI policy prohibits the use of AI to process client recordings or transcripts. Unauthorised uploads to external services and disclosure to unapproved third parties are also prohibited. Transcription is performed by humans and is subject to human verification.
Retention and deletion
Our approved retention periods are set out below. They apply across the approved processing environment, including company storage, transfer services, authorised working copies and backups.
| Information | Retention period | Backup copies |
|---|---|---|
| Audio and video recordings | 28 days from receipt | The same 28-day deadline from receipt of the original recording |
| Transcripts | 12 months from completion | The same 12-month deadline from completion of the transcript |
Creating or restoring a backup does not restart the retention period. Redundant drafts and temporary files are deleted when no longer needed. Deletion covers relevant storage locations and recycle bins. Client material must not be retained for personal reference or reuse.
The transcript retention period allows correction queries, authorised replacement copies and service-quality enquiries to be addressed. Earlier client deletion instructions take precedence. Any different lawful retention period must be expressly agreed and documented.
Suppliers and processing locations
External services may support secure file transfer, storage, administration and IT maintenance. Relevant suppliers and subprocessors must be assessed and covered by appropriate contractual arrangements. Any required controller authorisation must be obtained.
Storage, backup, support and transcriber locations must be considered when agreeing the service. We do not infer a provider’s processing location from the address of its head office. Any restricted international transfer must meet applicable data protection requirements and the client’s contractual restrictions.
Individual rights and incident response
The controller is normally responsible for privacy information and decisions on individuals’ rights requests concerning client recordings. We assist with locating, accessing, correcting, restricting or deleting information in accordance with lawful instructions and the processing agreement. Requests received directly should be referred promptly to the appropriate controller.
Our incident procedure requires prompt reporting, containment, investigation and corrective action. Where we act as processor, the controller must be notified without undue delay after we become aware of a relevant personal data breach, in accordance with applicable contractual requirements.
Assessment outcome and review
The approved version 1.3 assessment identifies high inherent risks for several aspects of handling sensitive recordings. With the specified safeguards applied, residual risks are assessed as low for unauthorised access, incorrect delivery, device or home-working exposure, unauthorised AI or uploads, excessive retention, supplier or overseas access, excessive or unlawful processing, rights or transparency failures and delayed incident response.
Two residual risks remain medium: inaccurate transcription and loss or unavailability of information. These are accepted with human quality review, correction handling, protected backups, secure continuity arrangements and ongoing monitoring. Jonathan Fagan approved the residual risk decisions on 8 October 2026. No unresolved high residual risk was identified for the assessed scope.
These findings apply to the assessed service model and its safeguards. They are not a universal rating for every assignment. Changes in sensitivity, scale, purpose, systems, suppliers, processing locations or retention require review before the affected processing proceeds.
Engagement reviews consider relevant operational and privacy advice and, where appropriate, the views of individuals or their representatives. Where a Data Protection Officer is appointed, their advice is sought and documented as applicable. The controller determines whether consultation with individuals is appropriate and records its decision, taking account of confidentiality and the nature of the work.
If high residual risk cannot be sufficiently reduced, we escalate it to the controller so that any required prior consultation with the Information Commissioner’s Office takes place before the affected processing begins.
The assessment owner is Jonathan Fagan. The assessment is reviewed at least annually and following material changes or a relevant incident. The next scheduled review is 8 October 2027.
Further information
This public summary is derived from TPT DPIA 001, version 1.3, and describes the general human transcription workflow. Client identities, individual engagement schedules and detailed operational evidence are retained in the confidential assessment and supporting records.
Clients can contact their usual TP Transcription Limited representative to request the full DPIA or discuss their data protection requirements. Detailed material can be shared subject to appropriate confidentiality arrangements. Individuals with a question about information in a client recording should contact the organisation that commissioned the transcription; we assist that organisation with requests.
Supporting records include our information security, cloud security, MFA, AI use, supplier, access, incident and retention controls, together with the ISO 27001 risk register and applicable processing agreements.
Further information: ICO guidance on Data Protection Impact Assessments.
