An earnings release lands in my inbox at 5:47 p.m. Embargo lifts at 9:00 the next morning. The company is legally delaying disclosure under Article 17 of the Market Abuse Regulation, which permits a delay only while confidentiality holds throughout the window. The document is already inside information. If it leaks in the next fifteen hours—through my software, my cloud provider, a machine-translation API I forgot to switch off—the issuer’s compliance case for delayed disclosure collapses, and I am the point of failure. That is the moment the risk stops being hypothetical.
This is not a thought experiment. In 2017, employees at the Norwegian energy company Statoil discovered that documents they had run through the free Translate.com service—workforce reduction plans, dismissal letters, passwords, contracts—had been indexed by Google and were sitting in public search results. The service was free, and its handling of submitted text was there in plain sight for anyone who read the terms. Nobody in procurement had looked. I’ve been translating annual reports and ad-hoc disclosures for German-listed issuers since 2008, and the uncomfortable truth is that most data-security failures in this field are contractual and architectural, not malicious. This article is the checklist I wish more buyers ran before they sent me a file.
Inside information under MAR: when a translation commission becomes a compliance event
A draft annual report is inside information the moment it leaves the CFO’s office—and everyone who touches it, including external translators, inherits obligations under the Market Abuse Regulation (MAR, in German the Marktmissbrauchsverordnung or MMVO). Article 7 defines inside information as non-public, precise information that would likely move an instrument’s price if published. Crucially, Article 7(3) states that an intermediate step in a protracted process—a draft translation counts—can itself qualify if it individually meets the criteria. The regulation attaches to the document, not to the channel it travels through. Emailing it, uploading it, or pasting it into a browser-based tool does not change its legal status.
Two more articles matter for anyone buying translation. Article 17 requires issuers to disclose inside information without undue delay, and permits a legitimate delay only if confidentiality is maintained the whole time—which makes an LSP’s handling a direct compliance variable, not an internal procurement detail. Article 18 requires the issuer and all persons acting on its behalf or for its account to keep insider lists identifying everyone with access, retained electronically for at least five years. The regulation names advisers, accountants, and rating agencies as examples. A translation provider who receives, processes, and returns market-sensitive documents on the issuer’s instructions is, on a plain reading, a person acting on the issuer’s behalf—and should appear on that insider list. Almost no vendor RFP raises this. It should.
NDA vs. GDPR Article 28 DPA: two instruments, one critical gap
A standard NDA creates a confidentiality obligation between the signatories—it does not govern how a vendor’s cloud CAT platform, machine-translation API, or sub-processor network processes your text. That single distinction is the most consequential thing an enterprise buyer can internalise. An NDA is a bilateral instrument of contract law: it defines who may not disclose what, and what happens if they do. It says nothing about the vendor’s Azure backups, its DeepL API calls, or the browser session in which your translation memory momentarily lives.
A Data Processing Agreement under Article 28 GDPR is the instrument that reaches that layer. Article 28 requires that processing be governed by a binding written contract; that a processor may not engage a sub-processor without the controller’s prior written authorisation; that every sub-processor be bound by the same data-protection obligations as the main processor; and that the initial processor remain fully liable to you if a sub-processor fails. For text that contains personal data or trade secrets processed by automated systems—which describes virtually every annual report, HR document, and M&A file—the Art. 28 DPA is not a nice-to-have layered on top of the NDA. It is the only instrument that follows your data down the sub-processing chain.
Where your text actually travels: mapping the cloud CAT stack
In a modern LSP workflow, your document passes through five or more separate data-processing relationships before it comes back to you—and each one needs its own contractual basis under GDPR. Trace the journey. The file is uploaded to a project-management portal. It’s imported into a CAT tool—Trados GroupShare, memoQ Server, or a browser-based editor. It may be pre-translated through a machine-translation API such as the DeepL API, Azure Cognitive Services, or a GPT-class model. Segments are written to a translation-memory server. A QA plugin scans the output. Then you download the result.
Every one of those arrows is a handoff to a potentially different processor. memoQ’s own hosted service, to take a concrete example, runs on dedicated Microsoft Azure virtual machines with geo-redundant Azure backup storage, retaining the last seven backup generations. That is a perfectly reasonable architecture for most work—and it means your text is replicated across Microsoft-operated data centres the moment it enters the system. The uncomfortable follow-on: because Microsoft is a US-incorporated entity, that cloud layer carries US-law exposure regardless of where the servers physically sit. Which brings us to the questions procurement teams almost never ask the MT vendor.
The AI training-data question every procurement team forgets to ask
“We use DeepL Pro” is not a sufficient answer to a data-security question—because three very different guarantees hide behind that sentence. There is opt-out of training (your text won’t be used to improve the model, often applied retroactively), zero-retention (nothing is stored at inference time), and on-premise deployment (no external call leaves your infrastructure at all). These are not synonyms, and the gap between them is exactly where inside information leaks.
Look at what DeepL actually publishes. Its Pro security page states that texts are “never stored or used for model training without your consent”—a genuine and meaningful commitment. But the operative Enterprise Terms are a separate instrument, and they permit DeepL to “temporarily store Content or Processed Content to the extent technically required,” including automatic storage “for a maximum period of 72 hours in case certain error patterns occur.” A 72-hour debugging retention window on a third-party server is trivial for a marketing brochure and unacceptable for an unpublished earnings release. The marketing page and the contract describe different realities; procurement must read both. For enterprise API use, the clause to request by name is a Data Processing Agreement together with a Data Security Addendum specifying zero-retention processing—not the default consumer or Pro terms.
EU data residency: what “processing in Germany” does and doesn’t guarantee
“Our servers are in Germany” answers only one of three separate questions, and not the one that usually matters most. Distinguish (a) the physical server location, (b) the legal jurisdiction of the vendor entity that operates the service, and (c) the data-transfer mechanism under GDPR Chapter V—Standard Contractual Clauses or an adequacy decision. A German-hosted cloud instance owned by a US parent still triggers Schrems II considerations without SCCs in place, because jurisdiction follows the corporate entity, not the rack.
The sharpest edge here is the US CLOUD Act. It obliges US companies—and their European subsidiaries—to hand business-critical data to US authorities on request, even where doing so conflicts with the GDPR, and often without notifying the data subject or any European authority. Standard Contractual Clauses address the lawfulness of a transfer; they do not neutralise a CLOUD Act production order. The two run in parallel. So when a vendor tells you the data “stays in Frankfurt,” the correct next question is: which entity, incorporated where, controls the keys? Swiss corporate groups face an analogous regime: the revised Swiss Data Protection Act (nDSG), in force since September 2023, imposes its own restrictions on cross-border transfers.
EU AI Act: transparency obligations live from August 2026, high-risk provisions deferred to December 2027
By this article’s publication the AI Act’s transparency duties are live, but the high-risk Annex III obligations have been pushed back—so don’t let a vendor cite either date wrongly. The Digital Omnibus amendment, which entered into force on July 27, 2026, deferred the stand-alone Annex III high-risk obligations from August 2, 2026 to December 2, 2027. What remains on the original August 2, 2026 schedule are the Article 50 transparency obligations—disclosing AI-generated content and informing people they are interacting with AI. Translation tools are not themselves listed in Annex III; the high-risk categories cover things like creditworthiness assessment, insurance pricing, and HR decisions. The provision that already bites is the general-purpose AI regime: vendors building on GPT-class or comparable models must maintain conformity and technical documentation. The practical ask for now is simple—can your vendor produce that documentation for whatever model sits in its pipeline?
Eight questions to put to any translation vendor
Use these verbatim in an RFP. For each, I’ve noted what separates a credible answer from a PR non-answer.
1. Do you hold a signed GDPR Art. 28 DPA with every sub-processor in your MT and CAT stack?
A credible vendor names the sub-processors and confirms a written DPA with each; a non-answer waves at “GDPR-compliant infrastructure” without a single contract on the table.
2. What is your data-retention policy at the MT-API layer—zero-retention or opt-out?
The right answer states a specific mode and cites the addendum that enforces it; “we don’t train on your data” dodges the question, because non-training and non-retention are not the same commitment.
3. Where are your TM servers physically located, and under whose legal jurisdiction does the operating entity fall?
A credible answer separates server location from corporate jurisdiction and volunteers the CLOUD Act exposure if a US-parent entity is involved; a weak one stops at “hosted in the EU.”
4. Can you provide a complete sub-processor list on request?
Producing the list within a day signals a vendor that actually tracks its data flows; hesitation or a partial list tells you they don’t know where your text goes.
5. Do your project managers sign individual confidentiality undertakings before accessing client files?
Look for named, per-person undertakings tied to access rights, not a single company-level policy that no individual has actually signed.
6. How are CAT-tool access rights managed when a freelancer leaves a project mid-way?
The good answer describes revocation on the day of departure and confirmation that no local copies persist; the poor one has no process, only trust.
7. What is your breach-notification procedure and SLA under GDPR Art. 33?
Article 33 gives the controller 72 hours to notify the supervisory authority, and requires the processor to notify the controller “without undue delay”—so a credible vendor commits to a firm internal SLA (many aim for 72 hours from their own awareness) rather than “we’ll be in touch.”
8. Can you deliver a fully on-premise or air-gapped workflow for inside-information documents?
For MAR-relevant material this is the deciding question: the credible answer is yes, with the MT layer switched off and confirmed in writing; anything that still routes text through a cloud API isn’t an inside-information workflow.
How I handle confidential assignments: 17 years of practitioner workflow
For inside-information documents my default is a workflow with no external call in it at all. I run Trados Studio installed locally, with cloud sync switched off—the translation memory lives on an encrypted local drive, not on a shared server. I offer a personal NDA and an Art. 28 DPA proactively, before a client thinks to ask, because for this category the DPA is the instrument that actually matters. I make no MT API calls on inside-information files, and I confirm that in writing with the client rather than assuming it’s understood. Delivery goes through whatever secure channel the client specifies—their portal, their encrypted transfer—never a plain email attachment for market-sensitive material.
To make that concrete: picture an annual general meeting (AGM) voting document arriving 48 hours before the meeting, the kind where a mistranslated resolution or a leaked draft would be a headline. It stays on one machine, in one CAT environment, with the machine-translation layer off and the file returned through the client’s own secure channel. There is nothing clever about this. It is deliberately boring, and boring is the point—the value is in the handoffs that don’t happen. Being a one-person practice helps here: there is no sub-processor network to audit, because there are no sub-processors. Just me. That’s a constraint for large-volume work and an advantage for confidential work.
Quick-reference checklist for IR and legal teams
Copy this into your vendor RFP. Every item should draw a specific, documented answer:
- Signed GDPR Art. 28 DPA with the vendor and every sub-processor in the MT/CAT stack
- Documented zero-retention (not merely opt-out) at the machine-translation layer, backed by a Data Security Addendum
- TM server location and the jurisdiction of the operating entity, with CLOUD Act exposure disclosed
- Complete sub-processor list available on request within one business day
- Individual, per-person confidentiality undertakings for everyone who touches the file
- Same-day revocation of CAT access when a linguist leaves a project
- A firm breach-notification SLA aligned to GDPR Art. 33 (72-hour cascade)
- An available fully on-premise or air-gapped workflow for inside-information documents
One closing thought. A vendor who can answer these questions crisply is telling you something beyond compliance: that they understand their own process well enough to describe it. Transparency about where your text travels is itself a quality signal—vagueness here usually predicts vagueness in the translation too. To be clear about my own limits: I don’t offer sworn or certified translation; court-sworn colleagues handle those. What I do offer for confidential corporate material is a documented, single-hand workflow and a contractual framework I’m happy to walk through line by line. If you’d like to see how the Art. 28 DPA and on-premise setup would apply to your next reporting cycle, get in touch—or read the services and pricing page first.