ElevenLabs compliance: GDPR, AI Act, DPA, training, transfers

TL;DR. A voice recording is personal data, and it becomes special-category biometric data when it is processed to identify the speaker uniquely (GDPR Articles 4(14) and 9(1)), as voice-clone verification can be. Enterprise tier: no training on customer data by default, Zero Retention Mode (ZRM) for select customers' API traffic, and storage in an isolated EU, India or Singapore environment. Self-serve plans (Free, Starter, Creator, Pro, Scale and Business): data is used for training by default unless the customer opts out, and the opt-out applies only to data submitted afterwards. ZRM covers API traffic for Text to Speech, Voice Changer, Speech to Text, Text to Dialogue and ElevenAgents. ElevenLabs lists voice cloning as not eligible, so cloned voice models are stored. Under EU AI Act Article 50, ElevenLabs must mark generated audio as AI-generated, and the buyer must disclose any output that is a deep fake.

DPO action: use Enterprise for EU processing of identifiable people's voices; document explicit consent for any cloned voice; disclose deep fakes under Article 50(4) and give the AI notice that the ElevenAgents terms require.

What the tool does

ElevenLabs makes AI voice synthesis and voice cloning. Buyers commonly evaluate one of three products:

1. ElevenLabs platform (self-serve plans: Free, Starter, Creator, Pro, Scale and Business) - plans for individual creators and teams. Voice synthesis from text, voice cloning from audio samples, dubbing. The Free plan is limited to non-commercial use
2. ElevenLabs API - programmatic access to text to speech, speech to speech (Voice Changer), speech to text, and ElevenAgents for voice agents (called the Agents Platform in parts of ElevenLabs' documentation)
3. ElevenLabs Enterprise - admin controls, custom DPA terms, BAA availability, data residency, Zero Retention Mode

Voice cloning specifically has its own compliance posture and is not covered by the same defaults as text-to-speech. Treat voice cloning as a separate evaluation item in any DPIA.

Data processed

• Source text (which can include any personal data the user types)
• Audio samples for voice cloning (personal data, and biometric data where processed to identify the speaker)
• Audio output (the synthesised speech itself)
• For Voice Changer (speech to speech): the source audio of the input speaker
• For ElevenAgents: full conversation transcripts and audio
• Account / billing data

Special-category likelihood: High for voice cloning. A voice recording is personal data. Under Article 4(14) GDPR it becomes biometric data when it undergoes specific technical processing that allows or confirms the speaker's unique identification, as in voice-print verification, and Article 9 applies where it is processed for that purpose (Article 9(1)). ElevenLabs' privacy policy says that when it uses voice data to check that the voice belongs to the account holder, it "may be handling biometric or sensitive or special category data under some laws". Treat voice cloning and speaker verification as likely Article 9 processing, and record the analysis in the DPIA. Even text input often contains personal data the speaker would not want synthesised. Cloning an identifiable person's voice without their explicit consent raises a GDPR lawful-basis question and, under the EU AI Act, the deep-fake disclosure duty (Article 50(4)) and the prohibitions on manipulative or deceptive techniques and, from 2 December 2026, on non-consensual sexually explicit material (Article 5(1)(a) and (ba)).

Default geographic processing: data is stored in the US as standard. Enterprise customers can have data stored in isolated environments in the EU, India or Singapore, according to ElevenLabs' data residency documentation (checked 15 October 2026); ElevenLabs' Enterprise page, checked the same day, lists the United States, the European Union and India. Non-Enterprise customers cannot choose a storage location, and their data may be processed in the US, the EU or Singapore for latency and service performance.

DPA availability

ElevenLabs publishes a DPA.

• URL: https://elevenlabs.io/dpa (last updated 8 April 2026)
• The DPA applies where ElevenLabs processes customer personal data as a processor on behalf of a customer acting as a controller, or as a processor for a third-party controller (section 2.1)
• It forms part of Enterprise agreements and, for self-serve customers, applies through the Terms of Service, which describe it as governing ElevenLabs' processing of personal data in content that business clients provide
• Custom DPA negotiation is available on Enterprise

Subprocessor list

The DPA states that ElevenLabs' subprocessor list is maintained at the trust centre, https://compliance.elevenlabs.io. The list had 32 entries on 15 October 2026 and displays only in a browser.

Notable subprocessors (checked 15 October 2026):

• Cloud infrastructure and storage: Google Cloud, AWS, Azure (for LLM services where India data residency is selected) and MongoDB
• Support, analytics and payments: including Zendesk, Slack, PostHog and Stripe
• Third-party AI model providers: LLM services from Google Cloud (Gemini and Anthropic models in ElevenAgents, through Vertex AI), Anthropic, OpenAI, xAI (only after the customer enables the integration), Fireworks AI and Databricks, and synthetic media providers for image and video, including ByteDance, Kling and Runway

ElevenLabs' sources describe third-party model training in two places. The subprocessor entries for Google Cloud and Anthropic state that "LLM Services may also be used for research, development, training, and product improvement purposes, to the extent permitted under the applicable agreement with the customer." The Zero Retention Mode documentation states that ElevenLabs' agreements with each third-party LLM provider "expressly prohibit such providers from training their models on customer content, whether or not Zero Retention Mode is enabled." Buyers should ask ElevenLabs how the two statements apply to their plan.

If the subprocessor list is not findable at review time, flag as red - for a vendor processing voice data, opacity on subprocessing is unacceptable.

Training-on-customer-data position

Enterprise: Training data use is off by default. By default, ElevenLabs does not train on Enterprise customers' data, other than as may be necessary to provide services to them. Zero Retention Mode is available to select Enterprise customers and covers API traffic only (generations through the web UI are not covered). ElevenLabs can restrict access, for example where it considers a use case high risk. With ZRM on, most request and response data is deleted once the request completes.

Self-serve plans (Free, Starter, Creator, Pro, Scale and Business): ElevenLabs uses data from these plans, including API use, to improve its models unless the customer turns off the "Improve the models for everyone" toggle in the Data use settings. The opt-out applies prospectively only - material already submitted may already be in training datasets. This default covers every self-serve plan, including paid API use, and the data is voice.

Scope of Zero Retention Mode: ZRM covers API traffic for Text to Speech, Voice Changer, Speech to Text, Text to Dialogue and ElevenAgents. ElevenLabs lists Instant and Professional Voice Cloning as not eligible, giving the reason "Voice cloning requires storing the clone to generate speech". Music, image and video, dubbing and ElevenCreative Studio are not eligible either. Separately, the trust centre lists the HIPAA-eligible services as the Text to Speech API, the Speech to Text API and ElevenAgents, each only with ZRM enabled. For ElevenAgents it adds: "Agent configuration data is persisted, meaning it is not covered by Zero Retention Mode and should not contain PHI."

In practice this means voice cloning models, and ElevenAgents agent configuration data, fall outside ZRM. Enterprise procurement teams need to capture this explicitly.

Enterprise + ZRM is a defensible posture for text-to-speech and speech-to-text. Voice cloning needs a separate explicit assessment regardless of tier - the data type (voice data that may be biometric) and the persistence of voice models put it outside ZRM's scope. Non-Enterprise voice cloning is not appropriate for any organisation processing identifiable individuals' voices. - My read

EU / UK transfer position

ElevenLabs is a US company. The DPA authorises transfers on the basis of an adequacy decision, including the EU-US Data Privacy Framework, under the Standard Contractual Clauses (SCCs), or on other permitted safeguards (section 11.1). Under the SCCs the parties use the Controller-to-Processor module, or the Processor-to-Processor module where the customer is itself a processor for a third-party controller. For UK transfers the DPA references the UK Addendum issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0), and it modifies the SCCs for Swiss transfers. Other vendors describe the same UK instrument by reference to its laying before Parliament on 2 February 2022.

ElevenLabs is certified under the EU-US Data Privacy Framework, the Swiss-U.S. DPF, and the UK Extension to the EU-U.S. DPF, listed as Active across all three on the official dataprivacyframework.gov registry (registered as Eleven Labs Inc., checked 15 October 2026). All three periods run to 9 February 2027. Coverage extends to both HR Data and Non-HR Data. ElevenLabs' privacy policy notes that the certification "applies only to ElevenLabs' U.S. entity". Transfers to Eleven Labs Inc. can therefore rely on the EU adequacy decision for the DPF under Article 45 GDPR, which does not require a transfer impact assessment. Transfers to ElevenLabs' affiliates outside the US rely on the other mechanisms above. Neither OpenAI nor Anthropic appears on the register.

Data residency: Enterprise-only feature, offered at ElevenLabs' discretion. Enterprise customers can have data stored in isolated environments in the EU, India or Singapore; the US is the standard location. Residency controls where data is stored, not where it is processed. The DPA and the residency documentation both say that processing may take place outside the selected location, including by affiliates and subprocessors, for support and for content moderation. With EU residency, a customer can keep processing in the EU by using ZRM through the API, unless it uses optional integrations, such as custom LLMs or post-call webhooks, that need processing outside the region. Non-Enterprise customers cannot choose where their data is stored, and their data may be processed in the US, the EU or Singapore for latency and service performance.

Self-serve business customers are covered by the DPA through the Terms, and transfers to Eleven Labs Inc. rely on the DPF or the SCCs. What self-serve customers do not get is a choice of storage location, ZRM or a BAA, and for EU and UK SME buyers that is the main limitation of these plans. Enterprise pricing is quoted individually.

Security documentation

Per the ElevenLabs trust centre at https://compliance.elevenlabs.io/, checked 15 October 2026:

• SOC 2 Type 2
• ISO 27001:2022
• ISO/IEC 27017:2015 (cloud-specific information security controls)
• ISO/IEC 27018:2019 (cloud privacy / PII processor controls)
• ISO/IEC 27701:2019 (privacy information management)
• ISO/IEC 42001:2023 (AI management systems - downloadable certificate visible as "ISO 42001 - AIMS Certificate - Eleven Labs.pdf")
• PCI DSS 4.0.1 Level 1
• FedRAMP 20x Class A
• CSA STAR Level 1 and CSA STAR AI Level 1
• AIUC-1 (the published audit report covers the ElevenLabs Docs Agent)
• HIPAA: attestation available to Enterprise customers on request; BAA with eligible Enterprise customers
• HDS (Hébergeur de Données de Santé, the French health data hosting certification), for the Agents and API platforms when used with EU data residency and ZRM, certified by Schellman
• UK Cyber Essentials Plus
• TX-RAMP Level 2
• NHS DSPT
• GDPR, addressed in the DPA

The trust centre also lists the CCPA, CPRA, LGPD, DORA, "EU AI ACT", "EcoVadis Committed" and "Trusted Partner Network - Blue Shield".

ISO/IEC 42001 certification is evidence of an AI management system. It does not by itself create a presumption of conformity with the AI Act, which the Act attaches to harmonised standards published in the Official Journal and to Commission common specifications (Articles 40 and 41). The HDS certification matters to buyers hosting French health data.

ElevenLabs announced its ISO 27701 and ISO 42001 certifications on 10 February 2026 and its HDS certification on 22 January 2026.

AI Act role + risk classification

• Role: ElevenLabs is a provider of AI systems (text to speech, voice cloning, Voice Changer, speech to text and ElevenAgents). As a provider of systems that generate synthetic audio, it must mark their output in a machine-readable format so that it is detectable as artificially generated (Article 50(2)). ElevenAgents, as a system intended to interact directly with people, must be designed so that people are informed they are interacting with AI (Article 50(1)). Where ElevenAgents is built on third-party general-purpose AI models, it may be a general-purpose AI system within Article 3(66).
• Your role as a buyer: deployer with deployer obligations. A buyer that changes the intended purpose of a system so that it becomes high-risk (for example, by using a voice agent for recruitment screening) can become its provider under Article 25(1)(c).
• Risk tier:
  • Text to speech for narration, accessibility or content production: carries the Article 50(2) marking duty, which falls on ElevenLabs as provider. The buyer must tell listeners that the audio is AI-generated where it is a deep fake (Article 50(4)). ElevenLabs' ElevenAgents terms separately require the buyer to tell end users that they are interacting with AI rather than a human and that conversations are recorded and may be shared with ElevenLabs and its third-party LLM providers
  • Voice cloning of real people: not a high-risk use in itself. Output that is a deep fake must be disclosed (Article 50(4)). Using manipulative or deceptive techniques that cause significant harm is prohibited (Article 5(1)(a)). From 2 December 2026 it is also prohibited to generate realistic audio of an identifiable person's intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person's explicit consent (Article 5(1)(ba), inserted by Regulation (EU) 2026/1744; the date is fixed by Article 113, third paragraph, point (a), as amended). For a deployer, the use is prohibited where it uses the system for that purpose (Article 5(1a), point (b))
  • Voice agents: high-risk when used for recruitment or selection (Annex III, point 4(a)), for creditworthiness or life and health insurance pricing (point 5(b) and (c)), or for another use listed in Annex III, unless an Article 6(3) condition applies. A voice agent used for an Annex III purpose is always high-risk if it profiles people (Article 6(3), last subparagraph). These obligations apply from 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended; fixed). A customer-service voice agent is not high-risk, but Article 50(1) applies to it

Article 50 has applied since 2 August 2026 (Article 113, the general date of application; fixed). Providers of generative systems already on the market before that date have until 2 December 2026 to meet Article 50(2) (Article 111(4), inserted by Regulation (EU) 2026/1744; fixed). Under Article 50(4), the buyer as deployer must disclose that audio is artificially generated or manipulated where it is a deep fake, meaning it resembles an existing person (or object, place, entity or event) and would falsely appear authentic (Article 3(60)). For an evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing the existence of the generated content in a way that does not hamper the work. ElevenLabs' tooling can produce deep fakes regardless of the buyer's intent.

Review the UK regulator's current guidance on biometric data alongside any ElevenLabs deployment plan.

DPIA prompts (for your use case)

1. Are you processing biometric data? Voice data is biometric data where it is processed to identify the speaker uniquely, as in voice-clone verification or speaker recognition. If so, you need an Article 9(2) condition, such as explicit consent (Article 9(2)(a)), as well as an Article 6 lawful basis, plus a DPIA covering Article 35.
2. Is the cloned voice a real person's voice - and do you have their explicit, informed, written consent? Without consent, cloning likely lacks a lawful basis under GDPR. Copyright in the source recording is a separate question and does not establish consent on the data subject's behalf.
3. Are you on Enterprise with data residency configured to your jurisdiction? Self-serve plans (Free, Starter, Creator, Pro, Scale and Business) do not offer a choice of storage location, and their data may be processed in the US, the EU or Singapore.
4. Have you opted out of training data use if you are not on Enterprise? Training is on by default on every self-serve plan, including API use, and the opt-out applies only to data submitted afterwards.
5. Have you disclosed deep fakes under AI Act Article 50(4)? If you run a voice agent, have you given the notice the ElevenAgents terms require (that users are interacting with AI, and that conversations are recorded and may be shared with ElevenLabs and its LLM providers)?
6. Voice cloning specifically: are voice models stored beyond your project lifecycle? Voice cloning is not eligible for ZRM, so ElevenLabs stores voice models until you delete them - plan for deletion when the project ends.
7. ElevenAgents: if used, are conversation transcripts being processed under terms appropriate for the data type? This is a different surface from TTS and may have different defaults.

Unresolved questions / red flags

• Voice cloning on self-serve plans. Self-serve plans train on customer data by default and offer no choice of storage location, no ZRM and no BAA. An SME cloning identifiable people's voices on these plans needs a documented Article 9 condition where the data is biometric, and should turn off training.
• Zero Retention Mode has a defined scope. ZRM covers API traffic for Text to Speech, Voice Changer, Speech to Text, Text to Dialogue and ElevenAgents. Voice cloning is not eligible, so cloned voice models persist. ElevenAgents has its own carve-out: agent configuration data persists outside ZRM. Buyers thinking they have ZRM coverage on voice cloning specifically do not - and should not store PHI in ElevenAgents agent configuration.
• EU data residency is Enterprise-only. Pricing for Enterprise tier is not publicly listed - get a quote before assuming it's affordable for an SME.
• Subprocessor list: the DPA names the trust centre as its location. It had 32 entries on 15 October 2026 and displays only in a browser.
• AI Act Article 50. ElevenLabs must mark generated audio from 2 August 2026 (by 2 December 2026 for systems already on the market). Buyers must disclose deep fakes under Article 50(4).
• Use of cloned voices in advertising or political content may trigger additional sectoral obligations (Ofcom, ASA, Electoral Commission for UK; equivalent EU bodies). Outside the GDPR scope, but check sector-specific obligations before deployment.

Related profiles

This is the only voice-AI profile in the index so far. For text-LLM context that often pairs with voice agents:

• OpenAI - Whisper / Realtime API for speech-related work
• Google Gemini - natively multimodal, including audio

Sources checked

• https://elevenlabs.io/dpa (Data Processing Addendum, last updated 8 April 2026) - scope, self-serve coverage, subprocessor list location, transfers and the UK Addendum, data residency - checked 2026-10-15
• https://elevenlabs.io/terms-of-use (last updated 9 October 2026) - DPA incorporation, Free plan restriction, rights warranty, PHI restriction, training opt-out - checked 2026-10-15
• https://elevenlabs.io/privacy-policy (updated 9 October 2026) - biometric data in voice verification, training opt-out, DPF reliance and its limit to the US entity - checked 2026-10-15
• https://elevenlabs.io/docs/help-center/legal/is-my-data-used-to-improve-eleven-labs-ai-models.md - training default, Enterprise exception, Data use toggle - checked 2026-10-15
• https://elevenlabs.io/docs/eleven-api/resources/zero-retention-mode.md - ZRM eligibility by product, API-only scope, availability, default retention and backups, third-party LLM training prohibition - checked 2026-10-15
• https://elevenlabs.io/docs/overview/administration/data-residency.md - isolated environments in the EU, India and Singapore, storage versus processing, Enterprise-only access - checked 2026-10-15
• https://elevenlabs.io/enterprise - Enterprise residency locations and HIPAA support - checked 2026-10-15
• https://elevenlabs.io/pricing - plan names, Enterprise custom pricing and DPA terms - checked 2026-10-15
• https://compliance.elevenlabs.io/ (trust centre, rendered in a browser) - certifications and frameworks, audit reports, certification announcements - checked 2026-10-15
• https://compliance.elevenlabs.io/subprocessors (rendered in a browser) - the 32 subprocessors, hosting locations, LLM services wording - checked 2026-10-15
• https://compliance.elevenlabs.io/faq (rendered in a browser) - HIPAA-eligible services and the ElevenAgents configuration-data exception - checked 2026-10-15
• https://elevenlabs.io/docs/eleven-agents/legal/hipaa.md - BAA availability for Enterprise and ElevenAgents controls - checked 2026-10-15
• https://elevenlabs.io/docs/eleven-agents/legal/disclosure-requirement.md - the ElevenAgents end-user disclosure requirement - checked 2026-10-15
• https://elevenlabs.io/docs/eleven-api/concepts/voice-cloning.md - voice verification for Instant and Professional cloning - checked 2026-10-15
• dataprivacyframework.gov participant registry, Eleven Labs Inc. (participant 9996), with Anthropic and OpenAI checked as controls - checked 2026-10-15
• Regulation (EU) 2016/679 (GDPR), Articles 4(14) and 9(1), from the Publications Office (https://publications.europa.eu/resource/celex/32016R0679) - checked 2026-10-15
• Regulation (EU) 2024/1689 (the AI Act), Articles 3, 5, 6, 25, 40, 41, 50, 111 and 113 and Annex III, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Articles 5, 111 and 113, both from the Publications Office (https://publications.europa.eu/resource/celex/32024R1689 and https://publications.europa.eu/resource/celex/32026R1744) - checked 2026-10-15

Related reading

• DPA for AI vendors - the eight clauses to check on any AI vendor DPA, applied to ElevenLabs Enterprise
• EU AI Act for AI buyers - Article 50(4) deepfake labelling obligations for buyers running voice cloning
• HIPAA for AI tools - BAA gate for US healthcare voice work (clinical narration, patient-facing voice assistants)
• ElevenLabs vs other voice AI vendors - buyer-side comparison against the hyperscaler voice products

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.