Key takeaways
- Under Article 28 of UK GDPR, a controller must use only processors providing sufficient guarantees of appropriate technical and organisational measures.
- A processor may not engage another processor, such as a freelance translator, without the controller's prior specific or general written authorisation.
- ICO guidance lists the terms a controller–processor contract must include, from documented instructions to end-of-contract provisions and audits.
- ISO/IEC 27001 and Cyber Essentials are independent evidence of security controls, but they do not replace contract terms.
- Public AI chatbots and free machine translation tools are a common, avoidable route for confidential text to leave your control.
This guide is for legal, HR, compliance and procurement teams sending confidential or personal information for translation: contracts, employee records, medical reports, investigation files or unreleased product information. It explains what UK data protection law expects, which questions to put to a translation provider, and where data actually leaks in translation projects.
It is general guidance, not legal advice. For the specific duties of law firms, see legal translation confidentiality.
Is a translation agency a data processor under UK GDPR?
In most cases, yes. When you send documents containing personal data for translation, you decide why and how the data is processed, so you are the controller, and the translation provider processes the data on your behalf, so it is a processor. A translator working as a sub-contractor to the agency is a sub-processor.
Article 28(1) of UK GDPR sets the starting point:
“Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.”
What must a translation data processing contract include?
A contract with a translation provider that processes personal data must include specific terms. The Information Commissioner's Office (ICO) guidance on what needs to be included in the contract lists details of the processing (subject matter, duration, nature, purpose, types of data and categories of data subject) and these minimum terms:
- processing only on the documented instructions of the controller;
- a duty of confidence;
- appropriate security measures;
- rules on using sub-processors;
- help with data subjects' rights and with the controller's own obligations;
- end-of-contract provisions, meaning deletion or return of data;
- audits and inspections.
A separate non-disclosure agreement (NDA) protects commercial confidentiality, but it does not replace these data processing terms.
Can a translation agency use freelance translators with my data?
A translation agency can use freelance translators only with your authorisation. Article 28(2) of UK GDPR states: “The processor shall not engage another processor without prior specific or general written authorisation of the controller.” Under a general authorisation, the processor must tell you about intended changes and give you the opportunity to object.
This matters in translation because many agencies work with networks of freelance linguists, sometimes in other countries. Ask:
- whether your files will be handled by employees, freelancers or partner agencies;
- whether linguists sign confidentiality agreements and receive security instructions;
- in which countries files will be accessed, and how any international transfers are covered;
- whether linguists work inside a secure online platform or download files to their own devices.
What certifications show a translation provider takes security seriously?
ISO/IEC 27001 and Cyber Essentials are the two most relevant independent certifications for UK buyers. ISO describes ISO/IEC 27001 as “the world's best-known standard for information security management systems (ISMS)”, and the ISO Survey 2022 cited on that page reported over 70,000 certificates in 150 countries. The National Cyber Security Centre (NCSC) describes Cyber Essentials as “the minimum standard of cyber security recommended by the Government for organisations of all sizes”, covering five technical controls.
| Evidence | What it shows | What to check |
|---|---|---|
| ISO/IEC 27001 certificate | An audited information security management system | Scope covers translation services; certificate is current |
| Cyber Essentials or Cyber Essentials Plus | Basic technical controls in place; Plus adds independent testing | Certificate date and organisation name |
| Data processing agreement | Contractual commitments under UK GDPR Article 28 | Sub-processor, deletion and breach-notification terms |
| Written AI and machine translation policy | Whether your text could enter third-party tools | Which tools, which licence tier, with whose consent |
Certifications are evidence, not guarantees. The differences between quality and security standards are explained in ISO 17100 vs ISO 9001.
Can translators put my documents into AI tools?
Your contract should say whether translators may use machine translation or AI tools, and which ones. Free tools may keep or reuse what is pasted in, and UK guidance for judges is blunt about public chatbots. The AI guidance for judicial office holders states: “Any information that you input into a public AI chatbot should be seen as being published to all the world.”
How DeepL and ChatGPT handle data on free and business tiers is compared in are DeepL and ChatGPT good enough for business translation. Remember that the same rules apply to your own staff: a colleague pasting a contract into a free tool creates the same risk as a supplier doing so.
Translation data security checklist
Use this checklist before sending confidential files to any translation provider.
- Classify the documents: personal data, special category data (such as health data), commercially sensitive or public.
- Remove or anonymise personal data that does not need translating.
- Sign a data processing agreement that meets Article 28, plus an NDA if needed.
- Agree the sub-processor position and where data will be accessed.
- Agree whether any machine translation or AI tools may be used.
- Use the provider's secure transfer method; never send passwords in the same email as files.
- Agree retention and deletion, including any translation memory that contains your text.
- Agree how quickly the provider will tell you about a personal data breach.
Common mistakes with translation data security
The most common mistake is focusing on the agency's certificate and ignoring where the files actually go. Other frequent gaps:
- Emailing unencrypted attachments to several suppliers for quotes. Share samples or redacted extracts at quote stage.
- Forgetting translation memories. A TM stores every sentence translated; see what translation memory is.
- No deletion date. Files remain on laptops and in inboxes years after the project.
- Overlooking reviewers. In-country colleagues and partners who review translations also handle the data.
Security is one of the selection criteria in our guide on how to choose a translation agency.
How TranslationWorks can help
TranslationWorks is a UK-based translation agency certified to ISO 17100 for translation services, registered to ISO 27001 for information security and ISO 9001 for quality management, and certified under Cyber Essentials. It provides professional human translation by native-speaking linguists in 150+ languages, including for legal and medical content where confidentiality is essential. If your files contain personal or sensitive data, tell us in your quote request what they contain and what your organisation requires contractually, so this can be addressed before work starts. See our legal translation and translation services, or request a free quote within 24 hours.
