Audio Guide GDPR for Visitor Venues: Voice, Location, Hire Records
A visitor venue buying audio guides is not buying a speaker and a battery. It is buying a data flow: a voice path, a location path and a hire record that together describe where a named or pseudonymous person stood and what they listened to. Under the UK GDPR and the EU GDPR, that combination is what an inspector will ask you to map. The questions below are the ones a purchasing manager should be able to answer without calling the supplier, because the supplier cannot answer them for you. If you are still specifying hardware, start from the AI Audio Guides line and treat the compliance work as part of the same decision.
Start with the data map, not the device
Draw three columns: what is collected, where it is stored, and how long it lives. Voice is the first column. If your guides capture speech for translation or for a spoken query, that audio is personal data the moment a visitor can be identified, and often before. The pocket translator is a useful reference point here: translation output is a reference translation, not a certified one, and the same caution applies to any transcript you retain. Location is the second column. A trigger fired by a beacon or a geofence is still location data even when no coordinates are stored, because the trigger event itself records presence at a point in time. The hire record is the third column, and it is the one venues most often forget.
Voice: what leaves the device and what does not
Ask the supplier to state, in writing, whether audio is processed on the device or transmitted. On-device processing removes a transfer but not the lawful basis question, because the device still holds a buffer. If audio leaves the venue, you need a processor agreement, a transfer mechanism where relevant, and a retention rule you can defend. Ask for the retention default and whether it can be set to zero. A supplier who cannot answer this at the hardware revision level is a supplier to decline, however good the price. The CE RED document checklist is a reasonable model for how to ask: per model, per revision, in writing.
Location triggers and the hire record
Location triggers are usually the weakest link in a venue's documentation, because they are configured by the venue, not shipped by the factory. Whoever sets the trigger radius decides how precise the presence data becomes. Document the radius, the retention of trigger logs, and who can query them. The hire record is a separate processing activity with its own purpose: deposit, loss, damage and return. It typically holds a name, a document number or a card token, a device ID and timestamps. That is enough to reconstruct a visit. Keep it under a defined retention period and restrict access to the staff who need it. The rental cabinet is where the hire record is physically generated, which makes it the natural place to enforce a retention rule rather than a policy document nobody reads.
| Data flow | Question to ask | Evidence to hold |
|---|---|---|
| Voice capture | On-device or transmitted? | Written statement per hardware revision |
| Translation output | Is any transcript retained? | Retention setting and default value |
| Location triggers | Who sets the radius and logs? | Configuration record and access list |
| Hire registration | What identifies the visitor? | Retention period and deletion log |
| Firmware updates | Does an update change the flow? | Change note per firmware revision |
| Sub-processors | Who else touches the data? | Current sub-processor list |
DPIA for venue tech: what triggers it
A DPIA is not a formality for a venue running audio guides at scale. It is triggered by systematic monitoring of a publicly accessible area, by processing that is invisible to the visitor, and by any use of voice in a way the visitor would not expect. Write it against the flows in the table above, and revise it when firmware changes the flow. The factory page describes how hardware revisions are built and tested, which is the same revision logic your DPIA should follow. A DPIA written once and never updated is worse than none, because it documents a flow that no longer exists.
Procurement questions that survive an inspection
- Which hardware revision is quoted, and does the DPIA name it?
- Can audio retention be set to zero, and who can change that setting?
- Does the hire record delete on a schedule, with a log to prove it?
- Are location trigger logs separable from the hire record?
- Which sub-processors receive any data, and under what contract?
- What changes in the data flow when firmware is updated?
Commercial terms matter too, because they determine how easily you can change your mind. Standard MOQ is 500 units, logo 500, custom packaging 1,000 and firmware or app white-label 2,000, with samples at 3-5 days stock and 7-15 days configured; the MOQ, sampling and lead times page sets this out in full. If you need a different enclosure or a different data path, that is an OEM/ODM conversation and it should start before the DPIA is signed, not after. The buyer resources section is the place to check what documentation is supplied per model, and the journal carries the longer compliance notes.
One decision sits with you and cannot be delegated: whether the venue needs voice capture at all. A guide that plays pre-recorded content and logs nothing is a smaller compliance object than one that listens. If the visitor experience does not require listening, say no to that feature and write the refusal into the specification. The next step is to take the table above to your supplier and ask them to complete the evidence column for the exact revision you intend to buy, in writing, before the purchase order is raised.
Questions buyers ask
Does a venue need a DPIA before deploying audio guides?
A DPIA is likely to be expected where you process voice, precise location or biometric-adjacent data at scale, or where you track vulnerable visitors. The DPIA should be written against the actual hardware revision and the actual data flows, not a generic template.
Who is the data controller when a distributor supplies the guides?
The venue is normally the controller for visitor data; the distributor and the manufacturer are processors or sub-processors. That split must be written into the supply contract before any pilot starts.
Related: more on ai audio guides · buyer guides · customisation tiers