Primary risk is US CLOUD Act jurisdiction — all data on Google Cloud US is accessible to US government with valid legal process. Enterprise customers must negotiate DPA for GDPR-specific needs. Customers bear full responsibility for obtaining consent for any voice recordings they upload for Custom Voice Models — platform does not independently verify consent chain.
Sign enterprise DPA with EU-specific provisions if GDPR compliance is required. Maintain documented consent chain for any custom voice model subjects. WellSaid's enterprise contract model generally offers the strongest protections in this batch — negotiate retention and deletion SLAs explicitly.