Translation data ownership: Confidentiality is only the starting point

When organizations evaluate translation providers, they usually ask one question: is our content secure? That matters, but it's only part of the picture.

The more important question is whether your organization keeps practical control over its language assets: source content, translation memory, terminology, approved translations, review history, and audit records. A provider can keep your content completely confidential and you can still lose control of it.

What the public evidence shows

A review of public privacy notices, data processing agreements, security documentation, product terms, and regulatory guidance reveals a consistent pattern. Confidentiality is widely addressed. Control and portability are not.

A provider can promise confidentiality while leaving these unanswered:

• Can you export your translation memory and terminology in a usable, machine-readable format?
• Who can access your content, including subcontractors and downstream processors?
• Is that access role-based and recorded in an audit trail?
• What happens to your data after the contract ends?
• Which AI or machine translation systems actually process your content?

Ownership language alone doesn't answer these. "The customer owns its content" is a good starting point, but it doesn't guarantee a defined export process, timeframe, cost, or deletion procedure.

AI makes the question more specific

Public documentation from major AI and machine translation providers shows that data handling depends heavily on product tier and configuration. Standard processing often excludes customer content from model training. Optional adaptive, custom-training, or fine-tuning features often use customer-supplied data by design.

So the useful question is never just "does this workflow use AI." It's which provider, which product tier, which retention policy, which training policy, and who controls that configuration.

Regulation supports practical control, but doesn't guarantee it

GDPR defines clear roles and responsibilities for personal data processing, but it doesn't automatically hand you export rights over every operational business asset, including a complete translation memory (source). The EU Data Act and public procurement guidance push further in the right direction, strengthening the case for real switching, export, return, and deletion procedures. But none of this replaces checking the specifics of your own contract.

Four questions to ask before you commit

1. Who owns the language assets, in writing?
2. Can they be exported in a standard, machine-readable format?
3. Who can access them, and is that access auditable?
4. How are AI processing, retention, training, and deletion actually governed?

Try it with your own content

Reading about control is one thing. Seeing exactly what you can export, who has access, and how your data is handled is another. The clearest way to find out is to try it yourself.