DPIA for Voice AI Roleplay: University Checklist

Data Protection Impact Assessment (DPIA) for voice AI roleplay maps lawful purpose, voice-data flows, vendor controls, student rights, accessibility alternatives and residual risk before a university careers service launches practice. Information Commissioner’s Office (ICO) guidance says two or more European high-risk criteria usually require a DPIA before processing begins.

What must a university careers service approve before voice-AI practice starts?

The Information Commissioner’s Office (ICO) DPIA guidance says a Data Protection Impact Assessment (DPIA) must be completed before processing likely to result in high risk begins under the UK GDPR.

Decision rule: the ICO says processing involving two or more European high-risk criteria requires a DPIA in most cases. One criterion can be sufficient in a particular case. Relevant criteria include evaluation or scoring, innovative technology, sensitive or highly personal data, vulnerable data subjects, systematic monitoring, and access to services or opportunities.

The university should document the proposed processing before student access opens. Name each operation: recording, speech-to-text, large language model processing, text-to-speech, transcripts, rubric-based scoring, feedback and retention. Identify the university’s role, involve the Data Protection Officer (DPO), record the controls and explain any residual risk.

Proposed formative-only control: treat the service as practice, not assessment. A student may rehearse a job interview, salary conversation or presentation. The session should not feed into progression, employability awards, placement, selection, student support or disciplinary decisions. If the university proposes any downstream use, reopen the purpose and risk assessment before enabling it.

This boundary is a governance control, not an automatic legal rule. The university still needs to assess whether the proposed use engages Article 22 UK GDPR, sensitive or biometric data, or another high-risk condition (gov.uk).

[6] The Department for Science, Innovation and Technology (DSIT) Responsible AI in Recruitment guidance identifies safety, transparency, fairness, accountability, and contestability as the UK government AI regulatory principles. Use those principles to test the purpose, safeguards, student notice, and challenge route before processing starts.

Which data, legal roles and decisions belong in the DPIA?

Greenhouse Voice AI lists eight candidate-data categories, but controller status, lawful basis and biometric or special-category classification depend on the configured deployment and jurisdiction. A university must map the actual service rather than infer legal treatment from the product label.

Processing operation	Data	Proposed purpose	University/vendor role	Legal-basis question	Downstream decision risk	Evidence still required
Session capture and turn detection	Raw voice, timestamps, device data and voice-activity signals	Run a voluntary rehearsal	Confirm whether the university is controller, joint controller or processor for each purpose. Confirm the vendor’s role separately.	What UK GDPR and Data Protection Act 2018 basis covers capture? Is participation genuinely optional, or does refusal disadvantage access to careers support?	A recording could later enter student support, employability or disciplinary processes.	Data-flow map, privacy notice, deletion route, access rules and the university’s documented controller analysis.
Transcription and response generation	Audio, transcripts, prompts and identifiers	Produce the simulated conversation and feedback	Confirm every recipient and instruction in the Greenhouse MSA, Greenhouse DPA, Greenhouse AI Terms, Greenhouse Security Addendum and Voice AI Terms. Contract names do not prove that the role matches the deployment.	Does the stated basis cover transcription, prompts, feedback and retention separately?	Transcript errors can misrepresent an answer, accent, hesitation or speech impairment.	Processing instructions, accuracy testing, subprocessor list and evidence that human reviewers cannot use outputs for unrelated purposes.
AI architecture and hosting	Audio, transcripts, prompts, responses, logs and technical metadata	Deliver speech-to-text, large language models and text-to-speech	Procurement must verify whether Pipecat, Deepgram, OpenAI, Google, Daily.co and WebRTC are actually used. Record each confirmed component, recipient, country and function. Do not imply involvement without vendor evidence.	What transfer mechanism and contractual instruction applies to each confirmed provider?	A new provider, model or data route can change the DPIA and the university’s risk assessment.	Current architecture diagram, subprocessor register, residency statement, Standard Contractual Clauses (SCCs), EU-U.S. Data Privacy Framework or UK Extension to the EU-U.S. Data Privacy Framework evidence, where relevant.
Scoring and feedback	Transcripts, rubric-based scoring, feedback and usage records	Give formative practice feedback	Confirm whether the university or vendor determines the scoring purpose and rubric.	Does the basis cover evaluation or scoring? Does the configured system create biometric or special-category data? Classification depends on the actual processing and jurisdiction.	A formative score becomes higher risk if staff reuse it for selection, progression, placement, awards, support or discipline.	Rubric specification, validation, subgroup error analysis, human oversight, correction process and a written prohibition on secondary use.
Sensitive or inferred information	Accent data, speech-impairment information, inferred traits and disclosures in prompts	Support the student’s chosen rehearsal scenario	The university must assess the configured data, not assume that all voice processing is biometric or special-category processing.	Ask the Data Protection Officer (DPO) whether the data falls within a protected category under the relevant jurisdiction and whether additional conditions apply.	Staff could mistake communication characteristics for employability evidence.	Data inventory, inference register, minimisation decision and documented DPO advice.
Automated decisions and opportunity access	Scores, transcripts and derived recommendations	Keep practice formative	Article 22 UK GDPR requires a specific assessment where solely automated processing produces a legal or similarly significant effect. A practice tool with no such effect differs from a score used to determine an opportunity.	Document why Article 22 UK GDPR is or is not engaged. Record human review, contestability and redress.	A university could silently turn rehearsal into automated assessment.	Decision map, human-oversight procedure, appeal route and confirmation that no score feeds consequential decisions without a new assessment.

Source: support.greenhouse.io, gov.uk.

Source: support.greenhouse.io, gov.uk.

The Information Commissioner’s Office (ICO) identifies evaluation or scoring, sensitive data, vulnerable data subjects, innovative technology and access to services or opportunities as DPIA screening factors. The Department for Science, Innovation and Technology (DSIT) frames the UK government AI regulatory principles around safety, transparency, fairness, accountability and contestability.

Add the Data (Use and Access) Act to the legal register. Its inclusion does not establish a lawful basis. The university must record its jurisdictional analysis, the DPO’s advice and the vendor evidence for the precise deployment. Where the answer remains unknown, procurement should mark the component or processing purpose as unresolved rather than approve it by assumption.

What exact questions should the vendor answer before procurement?

A university procurement schedule should produce one red-line decision and one accountable owner for every unanswered vendor question.

Use the matrix as a request-for-evidence schedule, not a general questionnaire. Every answer must name the university tenant, selected plan, and intended UK, EU or US deployment.

Vendor questions before a university voice-AI pilot

Procurement area	Question to put to the vendor	Evidence required before approval	Failure condition
Purpose and model training	Are raw audio, transcripts, prompts, scores, feedback or metadata used for delivery, analytics, research or training Greenhouse, OpenAI, Google or other models?	Written use restriction and applicable product terms.	Any undisclosed secondary use or training permission.
Retention and deletion	What separate periods apply to audio, video, transcripts, prompts, scores, logs, backups and derived artefacts under the selected plan?	Student deletion, subprocessor propagation and deletion confirmation.	One bundled period or no verifiable deletion result.
Residency and transfers	Where are UK, EU and US data stored and processed? Which subprocessors and transfer mechanisms apply?	Subprocessor register, Standard Contractual Clauses, EU-U.S. Data Privacy Framework or UK Extension reliance, and supplementary safeguards.	Any processing location or transfer route remains unnamed.
Security and access	What encryption, role-based access, support controls, breach cooperation and backup deletion apply?	Contract evidence, audit material and configuration records. Compare claims with Greenhouse’s published model: TLS 1.2 or higher, TLS 1.3 for voice infrastructure and AES 256-bit at rest. (Greenhouse Voice AI Data Processing FAQ)	A general security page replaces deployment-specific proof.
Student notice and AI disclosure	What exact notice appears before recording, covering AI identity, recording, retention, human access, model training and deletion rights?	The actual configured notice and screenshots.	Vague, missing or unverifiable disclosure copy.
Scoring and human oversight	Do audio, transcripts or scores influence a university decision? How are rubrics validated, errors appealed, and outputs corrected or deleted?	Written formative-use boundary and escalation procedure.	Any unapproved decision use or absent appeal owner.
Accessibility and fallback	Are transcripts, text or keyboard input, assistive technology, screen readers, BSL or human alternatives, paper routes and opt-out handling available?	Accessibility test evidence and reasonable-adjustment procedure.	Voice-only access or unsupported adjustment requests.
Contract and exit	Do the DPA, MSA, AI Terms, Security Addendum and Voice AI Terms govern this deployment? Can the university object to subprocessors?	Signed terms, export process and exit-deletion procedure.	Model, subprocessor or exit changes cannot be controlled.

The architecture needs separate answers for raw audio and transcript-derived scoring. RSE Labs describes speech-to-text, large language models, text-to-speech, silence detection and turn-level scoring as distinct stages; Greenhouse states that recordings generate transcripts while scoring uses the transcript. (RSE Labs voice roleplay research)

Reject a security webpage as proof of deletion, residency, training restrictions or accessibility. Request contractual language, configuration screenshots, subprocessor records and a test deletion result. Assign each red line to procurement, information security, accessibility or the Data Protection Officer (DPO)’s office.

How should retention, deletion, residency and security be written into the DPIA?

A university DPIA must set purpose-based retention rules before voice-AI processing, with each data type assigned its own deletion trigger and owner. The Information Commissioner’s Office (ICO) requires risks, mitigations, data flows and review to be documented.

Use separate rows for raw audio, video, transcripts, prompts, scores, feedback, access logs, backups and deletion copies. Record the purpose, retention period, access group, deletion method and evidence of completion for each row. A contract-duration default is not a university retention decision. Greenhouse Voice AI describes retention of recordings, transcripts and scores for the contract duration unless deleted earlier. That model still requires a university-specific decision under GDPR storage limitation.

Ask whether students can delete recordings and derived artefacts themselves. Specify how quickly deletion reaches subprocessors, model providers, backups and support systems. Require a deletion certificate or an itemised propagation report. An account-level “deleted” status is not enough if copies remain elsewhere.

Document every UK, EU and US storage and processing location. For each non-UK or non-EEA destination, name the transfer mechanism and supplementary safeguards. Record reliance on Standard Contractual Clauses (SCCs), the EU-U.S. Data Privacy Framework or the UK Extension to the EU-U.S. Data Privacy Framework. Assess CCPA/CPRA scope where US students, vendors or processing locations are involved.

Ask whether audio, transcripts, prompts, scores or feedback train vendor or third-party models. If university policy requires no training, write that restriction across product improvement, research, benchmarking and human review.

Specify role-based access, support access, incident notification, audit rights and exit deletion. Use Greenhouse’s published controls as evidence categories to request: TLS 1.2 or higher, TLS 1.3 for voice infrastructure, AES 256-bit at rest, ISO 27001, ISO 27701, ISO 42001 and SSAE 18 SOC 2. They are not proof of equivalent controls elsewhere.

Why should downstream scoring trigger a second DPIA gate?

The Information Commissioner’s Office (ICO) says two or more European high-risk criteria usually require a Data Protection Impact Assessment (DPIA), while one criterion can be sufficient in a particular case. ICO DPIA guidance lists evaluation or scoring, vulnerable people, sensitive data, innovative technology and access to services or opportunities among the relevant factors.

A second DPIA is not automatic for every new use. The trigger is a material change in purpose, scope, context or processing. If a university proposes moving a transcript or score beyond formative rehearsal, the Data Protection Officer (DPO) should review the existing assessment and decide whether a new assessment is required.

Formative feedback is distinct from consequential use. A careers adviser can use a student’s practice result to discuss interview structure or arrange human support without treating the result as an admissions or employability decision. The risk changes when staff use that result in employability awards, placement, progression, selection, student support or disciplinary processes.

The operating rule should be explicit: Razen voice-practice outputs stay formative unless the university approves a revised purpose and risk assessment. The review should recheck the lawful basis, student notice, consultation, rubric validity, subgroup error, retention and appeal route. It should also identify whether the university is making a decision, supporting a human decision-maker or merely providing feedback.

Article 22 UK GDPR requires a separate analysis where a decision is based solely on automated processing and produces legal or similarly significant effects (gov.uk). Human involvement does not resolve the issue if a staff member only accepts an AI score without meaningful review. A genuine decision-maker must inspect the evidence, consider the student’s challenge and have authority to correct, suppress or delete an output.

The Department for Science, Innovation and Technology (DSIT) frames this through human oversight, fairness, transparency, accountability, contestability and redress. The rule should name the accountable person and cover disputes about accent, silence, hesitation, fluency or disability-related speech.

Recruitment evidence does not establish safety for university rehearsal. An arXiv field experiment involving 70,000 applicants reported that applicants interviewed by AI agents were 12% more likely to receive job offers. That evidence concerns real recruitment, with human recruiters making hiring decisions. It does not validate a formative student tool, its rubric or its proposed downstream use.

What disclosure, accessibility and opt-out route keeps the rollout defensible?

The Information Commissioner’s Office (ICO) lists nine screening factors that can increase DPIA risk, including vulnerable data subjects, sensitive data, innovative technology and evaluation or scoring. A university careers service should turn those risks into clear student notice, genuine alternatives and named decisions.

Student notice

A proposed university notice should appear before microphone access. It is a practical template, not legal wording supplied by the sources.

You are speaking with AI.
What we collect: [audio / transcripts / prompts / scores / feedback / technical logs].
Why we collect it: [formative careers practice purpose].
How long we keep it: [retention period for each data type].
Who can access it: [university roles, vendor roles and human reviewers].
Model training: [state whether your data is used for vendor or third-party model training].
Human review: [state whether a person reviews sessions or challenges feedback].
Your choices: [non-voice route, refusal route and reasonable-adjustment process].
Deletion: [student deletion method, deletion scope and confirmation process].
Questions or complaints: [university contact and Data Protection Officer (DPO) contact].

The notice should make “continue” one choice, not the only choice. A student should see the non-voice route, deletion route and adjustment route before recording starts. The ICO DPIA guidance identifies data-subject rights, alternatives and mitigations as matters to document in the assessment.

The university should not copy a vendor’s generic privacy page into this notice. Name the actual data types, tenant, retention settings, human access and subprocessors used in the proposed deployment. State separately whether raw audio, transcripts, scores or feedback support analytics, research, product improvement or model training.

Accessible alternatives

The Civil Service reasonable-adjustments guide gives concrete examples including transcripts, extra time, readers, British Sign Language (BSL), paper-based alternatives, non-standard response formats and WCAG 2.1 Level AA or WCAG 2.2 Level AA audits. Treat those examples as options to assess, not proof that a voice-AI product already meets them.

The university should offer text or keyboard interaction before recording. It should also define a route through a human coach, peer or actor where appropriate. Paper-based alternatives belong in the adjustment plan where digital access is unsuitable. A refusal to use voice should not remove access to careers practice.

Equality Act 2010, section 20, creates the reasonable-adjustment duty (gov.uk). The Equality and Human Rights Commission (EHRC) should inform the university’s accessibility review. Assign an owner for each adjustment, including hearing loss, speech impairments, dyslexia, anxiety, neurodivergence, trauma and religious constraints.

British Sign Language (BSL) needs a separate service decision. A voice interface does not provide BSL practice. The university should specify a qualified human or accessible alternative if BSL support is required.

Test speech-to-text with relevant accents, dialects and speech impairments. Record the test method, result, adjustment and appeal owner. Do not treat pronunciation, hesitation, silence or fluency as employability signals unless the university has a validated and contestable purpose. The Department for Science, Innovation and Technology (DSIT) recruitment guidance places accessibility alongside fairness, transparency, human oversight and contestability.

FAQ

Does a university always need a DPIA for voice-AI practice?

No. The ICO requires a Data Protection Impact Assessment (DPIA) before processing likely to result in high risk. The ICO says two or more European high-risk criteria usually require one, although one criterion can be sufficient in a particular case. The DPO should record the screening decision before the first recording.

Can practice scores enter progression or student-support decisions?

Not by default. A formative score should stay formative. If staff reuse scores or transcripts for progression, employability awards, placement, selection, student support or discipline, the university should reopen the DPIA, reassess purpose and lawful basis, validate the rubric, provide human review and create an appeal route. The university should also assess whether Article 22 UK GDPR is engaged (gov.uk).

Who controls the student’s data?

The university must document whether it acts as controller, joint controller or processor for each processing purpose. The answer depends on the deployment, not the product label. The contract should identify responsibilities for audio, transcripts, prompts, scores, feedback, logs, deletion, access requests and subprocessors. The university’s DPO should approve that allocation.

How should deletion work?

The vendor should state how a student requests deletion and which artefacts the request covers. The process should address audio, transcripts, prompts, scores, feedback, logs, backups and derived copies separately. Procurement should require evidence that deletion reaches relevant subprocessors and that the university receives confirmation, rather than accepting an account-level deletion button without verification.

What happens if a student has a speech impairment?

The university should offer a reasonable-adjustment process and test speech-to-text accuracy rather than treating transcription failure as student performance. The Civil Service guide provides examples such as transcripts, readers, extra time and non-standard response formats. The university should appoint an adjustment owner and an appeal route. Feedback must not convert speech impairment, silence or pronunciation into an employability judgement without a validated purpose.

Does a non-voice route exist?

It should. Require text or keyboard interaction before microphone access, with transcripts, a human, peer or actor option and paper-based alternatives where suitable. The university should document the route in the student notice. An opt-out is not meaningful if refusing voice removes the only careers-support service.

What should the pilot acceptance test and review cycle contain?

A university pilot should use a controlled gate: no output may enter selection, progression, employability awards, placement, student support or disciplinary decisions. Publish that purpose in the operating procedure. Prohibit secondary use.

Test the complete deletion path. A student should be able to request deletion through the interface. Confirm removal from the vendor system, subprocessors and backups. Recheck the student notice. Inspect processing locations. Record whether vendor support staff can open sessions, and under what approval.

Treat latency as a usability control, not a legal threshold. RSE Labs reports a practical target below 1.5 seconds, while gaps above approximately two seconds feel broken. The university should set its own response and accessibility criteria. Test persona stability too. RSE Labs reports drift around turn 8 or 9 without reinforcement.

Compare transcripts and feedback across accents, dialects, speech impairments and adjustment routes. Log false interruptions from silence detection. Review harmful feedback and rubric drift before expansion. The Civil Service reasonable-adjustments guide provides test references including WCAG, extra time and alternative response routes.

Require separate sign-off from the Data Protection Officer (DPO), accessibility lead, careers-service owner, information-security lead, student representative and procurement owner. Reopen the DPIA when the model, subprocessor, retention policy, purpose or scoring use changes. The Information Commissioner’s Office (ICO) treats a DPIA as an ongoing review, not a one-off document.

Keep an exit plan. Export only data the university may retain. Delete tenant data. Revoke access. Notify students about material service changes. Reassess the Data (Use and Access) Act, UK GDPR and EU AI Act transparency position before renewal or replacement.

Watch it explained

Related guides

• Responding to a PIP Meeting: Employee Checklist
• How to Have a Difficult Conversation With a Co-Founder

Razen Rehearsal Sandbox: The Score-Dashboard Request at DPIA Sign-Off

It is Thursday’s DPIA sign-off meeting, and the careers service plans to offer voice-AI rehearsal to 400 students from Monday. The employability director wants individual scores sent to course leads by Friday so staff can identify students who need support, while the DPO has warned that practice outputs must not become assessment evidence.

Setting. A university careers-service meeting room. Alex, the careers-service pilot lead, is meeting Martin, the employability director, and Priya, the university DPO.

Cast

• Alex, Careers-service pilot lead. At stake: Must launch useful practice without letting formative scores enter student decisions.
• Martin, Employability director under deadline. At stake: Needs evidence of impact and wants staff to target support before the Monday launch.
• Priya, University data protection officer. At stake: Must prevent a voluntary rehearsal tool from becoming unapproved student assessment.

The Wrong Way

Martin: I need something concrete by Friday. Can course leads see which students are scoring low?

(Leans over the table, tapping the Friday deadline on his notes.)

Alex: We could share a limited dashboard. Just the score bands, not the recordings or full transcripts.

(Nods quickly and turns a page before Priya can respond.)

Priya: That still makes the score an input into staff action. What purpose are we recording in the DPIA?

(Stops writing and looks directly at Alex.)

Martin: Support, not selection. Nobody's using it to reject anyone.

(Raises both hands, then points toward the pilot plan.)

Alex: Right. We can keep it informal and label it formative. Staff will only use it to offer coaching.

(Uses a softer voice and circles “formative” on the agenda.)

Priya: A label does not control downstream use. Who gets access, and can a student challenge the result?

(Sets down her pen and waits.)

Alex: We'll restrict access to course leads and review anything disputed. That should let us launch Monday.

(Glances at Martin, then closes the laptop halfway.)

Martin: Good. Send me the dashboard wording tonight. We cannot lose another recruitment cycle.

(Collects his papers and stands before Priya has agreed.)

Why it fails. Alex makes the failure traceable at “share a limited dashboard” and then deepens it with “keep it informal.” Those lines accept individual scoring as a staff signal before the university has defined a new purpose, human review, challenge route or lawful basis. Priya identifies the risk, but Alex trades a documented boundary for the Monday launch.

The Right Way

Martin: I need an outcome measure by Friday. If the dashboard shows who needs help, why not give it to course leads?

(Keeps his voice clipped and slides the pilot timetable toward Alex.)

Alex: Because that changes the use. Students agreed to practise, not to have a score follow them into course support.

(Places one hand flat on the timetable and holds Martin’s gaze.)

Priya: That is the boundary the DPIA needs. Individual audio, transcripts and scores stay inside the practice service unless we reopen the assessment.

(Nods once and writes “formative only” in a large box.)

Martin: Then I have no way to show the budget holder this works.

(Leans back, jaw tight, and crosses out “student targeting.”)

Alex: You can have aggregate completion, deletion results, access requests and pre- and post-practice feedback. You cannot have named scores.

(Counts the four measures on their fingers, then pauses.)

Priya: Add a contract rule: no score or transcript enters selection, progression, placement, awards, support triage or discipline. Any change returns to this group.

(Turns her laptop so both colleagues can see the new control list.)

Martin: That costs us the Monday dashboard. I still want the pilot, but I need the delay recorded as a risk.

(Exhales through his nose and writes “launch metric delayed” in the margin.)

Alex: Agreed. I’ll record the risk, publish the non-voice route, and send the revised notice for your sign-off today. The pilot launches only with those controls.

(Sits back, removes the dashboard request from the action list, and speaks more slowly on the last sentence.)

Why it lands. Alex refuses the specific downstream use rather than arguing that the score is harmless because the pilot is voluntary. The response costs the team its preferred Friday dashboard, but it preserves a strict formative boundary and gives Martin usable service-level evidence instead. Priya’s line turns the boundary into a recorded DPIA control with a reopening trigger, not a promise made in the room.

<aside class="razen-coach-card" data-razen-scenario="the-score-dashboard-request-at-dpia-sign-off"> <p class="razen-coach-card__title"><strong>Practice this live.</strong></p> <p><a class="razen-coach-card__button" href="https://razenai.com/coach?scenario=the-score-dashboard-request-at-dpia-sign-off&amp;article=dpia-voice-ai-roleplay-checklist&amp;utm_source=razen_blog&amp;utm_medium=rehearsal_sandbox&amp;utm_campaign=dpia-voice-ai-roleplay-checklist">Click here to boot up the Razen AI voice coach for this exact scenario.</a></p> </aside>

Delivery playbook

Tone shifts

• After Martin asks for named scores, shift from accommodating to precise: slow the first sentence and stress “changes the use.”
• When Martin says the dashboard is needed for the budget holder, acknowledge the commercial pressure without retreating: lower the pitch on “You can have aggregate” and keep the list factual.
• On the final line, move from refusal to commitment; speak the launch condition as a decision, not a suggestion.

Pause placement

• Pause for 2 seconds after “Students agreed to practise” so the distinction between consent and downstream use lands before the second clause.
• Pause for 1 second after “You cannot have named scores” before listing the four permitted measures.
• Pause for 2 seconds after “That costs us the Monday dashboard” instead of filling the silence with an apology.

Physiological cues

• Before answering Martin’s first challenge, press both feet into the floor and release the jaw; do not glance at the timetable for reassurance.
• Keep one hand flat on the table while stating the boundary, and stop tapping or circling the word “formative.”
• When listing permitted measures, count on four fingers and keep eye contact with Martin; suppress the fast nod that signals premature agreement.

Recovery moves

• If you say, “We could share a limited dashboard,” correct it immediately: “Let me restate that. Named scores do not leave the practice service.”
• If Martin interrupts with “It’s only support,” say: “I hear that purpose. The control still has to cover what staff could do with the score.”
• If you promise a Monday launch too quickly, say: “I’m withdrawing that commitment until the notice, access rule and deletion test are signed off.”

Frequently asked questions

Does a university always need a DPIA for voice AI roleplay?

Not every voice tool automatically triggers a DPIA, but the Information Commissioner’s Office requires one before processing likely to create high risk. Evaluation or scoring, innovative technology, vulnerable students, sensitive data and access to opportunities are relevant factors. The university’s DPO should document the screening decision rather than rely on the product label alone.

What should the vendor disclose about student recordings?

The vendor should state whether it records audio, creates transcripts, generates scores or feedback, uses any output for analytics or model training, shares data with subprocessors, and where processing occurs. It should also provide separate retention periods, deletion routes, access controls, transfer mechanisms and the exact student-facing AI notice.

Can a university use voice-AI scores in employability decisions?

A formative practice score should not flow into selection, progression, placement, awards or disciplinary decisions without a new purpose and risk assessment. The university would need validated rubrics, subgroup testing, human oversight, an appeal route and a lawful basis. Article 22 UK GDPR should be assessed where solely automated decisions have significant effects (gov.uk).

What accessibility fallback should a careers service require?

Require a genuine non-voice route, such as text or keyboard interaction, transcripts, a human or peer practice option, and paper-based alternatives where suitable. Test screen readers, assistive technology, low bandwidth, hearing and speech access, BSL requirements and reasonable adjustments under Equality Act 2010, section 20 (gov.uk).

How long should voice-AI recordings be kept?

There is no universal retention period that fits every university. Set purpose-based periods separately for raw audio, transcripts, scores, feedback, logs, backups and deletion copies. Ask the vendor how student deletion propagates to subprocessors and backups. A contract-duration default, such as the period described by Greenhouse, does not replace the university’s storage-limitation decision.