Dictation saves time in almost every medical practice, law firm, and counseling center. However, as soon as the dictation contains confidential information about clients, patients, or clients, the choice of tool is no longer merely a matter of convenience. Psychotherapists, notaries, psychologists, and social workers are among those bound by professional confidentiality under Section 203 of the German Criminal Code (StGB). The same basic principles apply to them: particularly sensitive data, a legal duty of confidentiality, and the question of who actually gets to hear what is said.
This summary page explains the common pattern underlying all these professions, shows why local processing is the obvious solution, and provides links to the individual pages for each occupational group.
The common theme: Section 203 of the German Criminal Code (StGB), sensitive data, local processing
As different as therapy, notary services, and social counseling may be in everyday practice, their starting points with regard to data protection are very similar.
What Section 203 of the German Criminal Code (StGB) requires
Section 203 of the German Criminal Code (StGB) makes it a criminal offense for certain professional groups to disclose a third party’s secret that was entrusted to them in their professional capacity. This applies not only to intentional disclosure but also to the careless disclosure to third parties. Since the 2017 reform, external service providers may be involved as “other contributing persons,” but only under certain conditions: They must, where necessary, be bound by a confidentiality obligation, and the disclosure must be necessary for the performance of their duties. Uncontrolled uploading of dictations to any cloud service rarely falls within this framework.
Why Dictation Is a Sensitive Issue
Many popular dictation and transcription services operate on the same principle: The microphone records, the audio file is sent to a cloud server, where it is converted into text and returned. The crucial step takes place on third-party servers, often outside the EU. Voice recordings constitute personal data as soon as a person is identifiable or is being discussed. If they are transferred to a third country such as the United States, the GDPR’s requirements for transfers to third countries apply (Chapter V, Article 44 et seq.). For those bound by professional secrecy, Section 203 of the German Criminal Code (StGB) also applies. Cloud dictation is therefore not prohibited across the board, but depending on how it is structured, it can pose a serious compliance risk.
Which professions are subject to confidentiality obligations
The following overview categorizes the occupational groups discussed here. Each has its own page with details and information on day-to-day practice.
Psychotherapists
Psychological psychotherapists and child and adolescent psychotherapists, as members of the healthcare profession, are bound by professional confidentiality under Section 203 of the German Criminal Code (StGB). Session notes, medical histories, and treatment records are among the most sensitive types of data. Anyone who dictates such information should be certain that what is said does not leave the device.
Psychologists
Occupational psychologists who have passed a state-recognized academic qualifying examination are expressly mentioned in § 203 of the German Criminal Code (StGB). Whether they are expert opinions, diagnostic findings, or counseling records, the content is personal in nature and particularly sensitive, so the same principles apply as in psychotherapy.
Notaries
Notaries are subject to their own duty of confidentiality and are also listed as holders of professional secrecy under § 203 of the German Criminal Code (StGB). Draft deeds, wills, and contract negotiations contain highly confidential information about assets and family circumstances. A dictation that transmits this content to an external service directly affects notarial confidentiality.
Social Work and Counseling Centers
State-certified social workers and social educators, as well as counselors at accredited counseling centers, are also covered by Section 203 of the German Criminal Code (StGB). Case documentation in social, addiction, or pregnancy counseling often involves people in particularly vulnerable situations, which further increases the requirements for confidentiality.
Also affected: other professions regulated by professional associations
The same pattern applies to lawyers, doctors, and tax advisors. There is a separate section for each of these groups: dictation software for lawyers and law firms, dictation software for medical practices, and dictation software for tax advisors. The overarching framework is provided by the hub article “GDPR-Compliant Dictation Software for Mac.”
Cloud Dictation vs. Local Dictation: An Overview of the Differences
| criterion | U.S. Cloud Mandate | Local dictation software (Flinktext) |
|---|---|---|
| Where the audio is processed | External servers, often located in the U.S. | On a Mac, on-device |
| Transfers to Third Countries (GDPR Chapter V) | If it takes place, it must be justified | Will not take place because no data was transmitted |
| External Processor under Section 203 of the German Criminal Code (StGB) | Generally, to involve and commit | Not applicable in standard operation |
| Data Processing Agreement (DPA) | Required | Not required for local processing; AVV available upon request |
| Works without the Internet | No | Yes, completely offline |
| Verifiability by Your IT Department | Proprietary, internal components not visible | Open Source, Verifiable Code |
| expenses | Mostly Subscription | Free of charge |
Why Local Processing Is the Common Denominator
The straightforward answer is the same across all professions covered by Section 203 and is technically simple: If speech recognition runs entirely on the device, the audio never leaves the Mac. There is no transfer to a third country because there is no transfer at all. There is no external processor that would need to be involved and bound by Section 203 of the German Criminal Code (StGB). And there is no cloud policy being violated.
Local processing thus fundamentally changes the data protection assessment. Instead of having to justify a risky transfer to a third country, you document purely local, data-minimal processing. This reduces the risk of unintended disclosure to third parties and thus helps ensure compliance with confidentiality obligations. A dictation tool alone does not make anyone compliant, but local processing is the technical foundation that enables such a tool to be used in compliance with the GDPR.
Flinktext: Local dictation software for professionals bound by professional confidentiality
Flinktext is a native macOS menu bar app from Lighthouse Consulting that consistently relies on this local approach. The interface is intentionally simple: hold down the hotkey, speak, and release. The recognized text appears immediately at the cursor, in any app—whether in patient or case documentation, a notary program, Mail, or Word. Four modes cover everyday needs: Raw for a 1:1 transcript, Polished for proper written German, Compose for fully formed texts based on a spoken command, and Emoji for casual correspondence.
These privacy features can be verified in the open-source code:
- 100% local by default. Speech recognition uses a bundled Whisper model that runs on the device. Your audio and dictation never leave the device.
- No telemetry, no tracking, no account. There are no analytics or crash reporters running that send data in the background.
- Keys are stored only in the Keychain. Login credentials are stored exclusively on the device in the macOS Keychain, without iCloud sync.
- Open source under the MIT license. The code is publicly available on GitHub and can be reviewed by your IT department or your data protection officer.
Optional cloud backends are available for particularly complex formulations, but they are disabled by default. They become active only if you explicitly enable them and provide your own API key. By default, everything remains local.
Can be used in compliance with the GDPR; not certified
An honest assessment is in order: No software is, by itself, GDPR-certified or guaranteed to be compliant with § 203. Data protection compliance always arises in the context of actual use—through a combination of tools, processes, and documentation. Flinktext provides the technical foundation that enables local, data-minimal processing. Ensuring legally compliant integration into the operations of a medical practice, law firm, or consulting firm remains the responsibility of the respective institution and, in case of doubt, should be clarified with the data protection officer. We provide a data processing agreement and data protection documentation for institutional rollout upon request.
Frequently Asked Questions
Does my profession fall under Section 203 of the German Criminal Code (StGB)? Psychotherapists, professional psychologists with a state-recognized final examination, notaries, and state-recognized social workers and social educators are listed in Section 203 of the German Criminal Code (StGB) as holders of professional confidentiality, as are physicians, attorneys, and tax consultants. Please consult your professional association or your data protection officer to determine the specific classification of your individual case.
Is cloud-based dictation automatically a criminal offense for those bound by professional secrecy? No, it’s not that simple. External service providers may be involved under certain conditions. However, uncontrolled uploading of sensitive dictations to a U.S. cloud can, depending on the circumstances, pose a compliance risk under both the GDPR and Section 203 of the German Criminal Code (StGB).
How does local processing help, specifically? When speech recognition runs locally on the Mac, the audio never leaves the device. There is no transfer to a third country and no external processor that would need to be included under Section 203 of the German Criminal Code (StGB). This reduces the risk of unintended disclosure to third parties.
Are my dictations uploaded to the cloud? Not by default. Flinktext's speech recognition runs on-device using a bundled Whisper model. Optional cloud backends are disabled by default and are only activated if you enable them yourself and provide your own key.
Does the dictation feature work without an internet connection? Yes. Since processing takes place locally, dictation works entirely offline.
How much does Flinktext cost? The app is free and open source under the MIT license. You can download the ready-to-use DMG file and get started right away—no need to compile it yourself.
Next step
Whether it’s therapy, notary services, psychology, or social counseling: the common thread is confidentiality, and local processing is the more secure approach. Download Flinktext for free from the product page and contact us to discuss a data-protection-compliant rollout for your practice, law firm, or counseling center.
Flinktext: The Dictation App for Mac
Free, open source, 100% local by default. Download, open, dictate.
Related Guides
- Blitztext Alternative: Flinktext, the all-in-one dictation app for Mac
- Wispr Flow Alternative: Dictate Locally, Without the Cloud and Without a Subscription
- GDPR-compliant dictation software for Mac: local storage instead of a U.S. cloud
- Dictation Software for Schools: Inclusion Without a U.S. Cloud
- Free & Local Dictation Software for Mac: An Honest Comparison
- Dictation Software for Law Firms: Local Dictation Subject to Confidentiality Obligations (Section 203 of the German Criminal Code (StGB))
- On-Premises Medical Speech Recognition: Dictation Software for Medical Practices Without a U.S. Cloud
- Dictation Software for Tax Advisors: Client Data Subject to Confidentiality
