GDPR-Compliant Video Conferencing: What to Verify

A video conferencing platform is not GDPR-compliant simply because the vendor says it is.

GDPR compliance belongs to a specific processing activity.

The same platform can present a relatively simple compliance profile for an unrecorded project meeting and a much more demanding one when it is used for recorded HR interviews, medical consultations, board meetings, AI transcription, or calls involving participants outside the EEA.

The useful question is therefore not:

It is:

This guide explains how to answer those questions before selecting or configuring a video conferencing system.

Before comparing products, map what actually happens during a meeting.

A single call can create several separate processing operations.

For business meetings, the organisation arranging the processing will often be the controller for meeting-related personal data because it determines why and how the meeting is used.

A cloud conferencing vendor may act as processor for data it handles on the organisation’s behalf.

That does not mean every activity performed by the vendor necessarily has the same role allocation. Billing, fraud prevention, product telemetry or other vendor-defined processing may involve a different role depending on the actual circumstances and terms.

There may also be subprocessors for:

• hosting;

• cloud recording;

• transcription;

• customer support;

• email delivery;

• AI services;

• analytics.

The core GDPR principles include:

• lawfulness, fairness and transparency;

• purpose limitation;

• data minimisation;

• accuracy;

• storage limitation;

• integrity and confidentiality;

• accountability.

The controller must also be able to demonstrate compliance with these principles.

For video conferencing, these principles translate into practical questions.

Why is the meeting being processed?

The reason for holding a live meeting does not automatically justify:

• recording it;

• transcribing it;

• analysing sentiment;

• generating AI summaries;

• retaining attendance data indefinitely.

Disable information collection that is not necessary for the business purpose.

Possible examples include:

• unnecessary participant profiling;

• optional analytics;

• persistent recordings;

• unused transcription;

• excessive meeting telemetry.

Define retention for each data category.

GDPR provides six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests. The appropriate basis depends on the purpose and context of the processing.

Do not assume that one lawful basis automatically covers every function of a video platform.

For example, the lawful basis for:

• holding an employee meeting;

• recording it;

• generating an AI transcript;

• analysing attendance;

may need to be assessed separately.

Transparency must occur before or at the appropriate point in the processing.

Participants may need information about:

• controller identity;

• purpose of processing;

• lawful basis;

• recipients;

• retention;

• international transfers;

• data-subject rights;

• contact details;

• recording;

• AI transcription.

Article 13 generally concerns personal data collected from the data subject, while Article 14 covers relevant cases where personal data has been obtained elsewhere.

A calendar invitation can be a practical place to provide a concise notice and link to the full privacy information.

When a video conferencing provider processes personal data on your behalf as a processor, the relationship must satisfy Article 28 requirements.

The agreement should cover matters such as:

• processing subject matter;

• duration;

• nature;

• purpose;

• data categories;

• data subjects;

• controller instructions;

• confidentiality;

• security;

• subprocessors;

• deletion or return of data;

• audit rights.

But:

It solves one part of the governance model.

You still need lawful processing, transparency, appropriate security, retention rules and, where applicable, a lawful international transfer mechanism.

These are frequently confused.

Addresses the controller-processor relationship under Article 28.

Addresses qualifying international transfers under Chapter V.

Depending on the destination and recipient, mechanisms may include:

• adequacy decisions;

• EU-US Data Privacy Framework for participating US organisations;

• Standard Contractual Clauses;

• Binding Corporate Rules;

• applicable derogations in limited circumstances.

The EDPB describes Standard Contractual Clauses as pre-approved clauses that can be used to provide safeguards for transfers outside the EU.

Do not reduce this question to:

Instead map:

1. Where is meeting traffic processed?

2. Where are recordings stored?

3. Where is metadata stored?

4. Which entity provides support?

5. Which subprocessors can access the data?

6. Does AI processing occur elsewhere?

7. Can remote administrative access occur from outside the EEA?

8. What transfer mechanism applies to each relevant recipient?

The European Commission currently recognises US organisations participating in the EU-US Data Privacy Framework for covered transfers.

GDPR does not prescribe one universal video-conferencing security configuration.

Article 32 requires appropriate technical and organisational measures relative to the risk.

Depending on the meeting, relevant controls can include:

• encryption in transit;

• encryption at rest;

• end-to-end encryption where appropriate;

• strong authentication;

• SSO;

• MFA;

• waiting rooms;

• guest controls;

• meeting passwords;

• restricted recording permissions;

• administrative policies;

• access logs;

• backup protection;

• patch management;

• account lifecycle management.

The important phrase is appropriate to risk.

Recording changes the compliance profile because transient communication becomes persistent personal data.

A recording can contain:

• faces;

• voices;

• names;

• screens;

• documents;

• chat;

• confidential business information;

• special-category personal data.

Determine:

• the purpose;

• lawful basis;

• who will have access;

• retention period;

• whether participants have been informed;

• whether recording is genuinely necessary.

Restrict access according to purpose.

Consider:

• role-based access;

• link sharing;

• download permissions;

• audit logs;

• storage encryption.

Delete recordings once the documented purpose and retention requirement have expired, unless another valid legal or regulatory retention requirement applies.

Make sure a real process exists for:

• finding recordings;

• providing access where applicable;

• deleting data where the conditions for erasure are met;

• handling objections;

• documenting the response.

AI meeting assistants are one of the most important procurement questions in 2026.

Do not treat transcription or meeting summaries as ordinary interface features.

They can introduce:

• an additional processor;

• a new subprocessor;

• another processing location;

• new retained personal data;

• new purposes;

• model-training questions.

Before enabling AI, ask:

The common shorthand “every breach must be reported within 72 hours” is incorrect.

Under Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

Communication to affected individuals follows a higher threshold: the breach must be likely to result in a high risk to their rights and freedoms.

All breaches should still be documented internally.

For a video platform, an incident-response plan should cover:

• exposed recordings;

• stolen meeting credentials;

• unauthorised meeting access;

• leaked transcripts;

• compromised administrator accounts;

• exposed attendance reports.

No deployment model creates GDPR compliance automatically.

It changes which risks and obligations you have to manage.

Self-hosting can reduce external processor and international-transfer exposure, but only if the architecture actually avoids those external processing paths.

Check:

• licensing;

• support access;

• cloud push services;

• telemetry;

• remote monitoring;

• external backups;

• AI;

• identity providers.

Do not ask the vendor only:

Ask for evidence.

• DPA;

• subprocessor list;

• transfer mechanisms;

• support-access terms;

• retention terms.

• data-flow diagram;

• hosting locations;

• recording architecture;

• encryption documentation;

• authentication options;

• audit logging;

• backup architecture;

• deletion behavior.

• security certifications;

• penetration-test information where available;

• breach-notification process;

• vulnerability management;

• support escalation;

• change-notification process for subprocessors.

• recording policy;

• guest access;

• meeting authentication;

• retention;

• user provisioning;

• admin controls;

• AI enable/disable;

• export and deletion tools.

The best procurement comparison is therefore not:

It is:

Zoom currently provides EEA customers on eligible paid accounts with data-residency controls for certain stored data and meeting/webinar traffic.

Microsoft describes the EU Data Boundary as covering Customer Data and personal data for Microsoft 365 and other in-scope services, while also documenting limited circumstances in which data continues to be transferred outside the boundary.

Nextcloud Talk is designed as a self-hosted, on-premises audio/video and chat platform.

Secumeet should be evaluated as a server-connected communications environment, not simply labelled “GDPR compliant” and left at that.

Current public product information confirms that the Secumeet client depends on Secumeet Server for full functionality and combines personal and group messaging, meetings, shared files and other communication functions.

That can be useful when the buyer wants the communications architecture itself to be part of the procurement decision.

The GDPR advantage of this model depends on the actual deployment.

A customer-controlled server can potentially reduce reliance on a public multi-tenant conferencing cloud, but procurement teams should confirm:

• who hosts Secumeet Server;

• whether Secumeet personnel can access the environment;

• whether telemetry leaves the server;

• how licensing works;

• whether mobile push services are external;

• where recordings are stored;

• whether support involves remote access;

• what subprocessors exist;

• whether AI features use another processing service.

Best fit: Organisations that want to evaluate a server-based communication environment and are prepared to validate the complete data flow rather than rely on a generic compliance claim.

Main trade-off: Publicly available technical compliance documentation is less extensive than for several large enterprise providers, so procurement should require more direct architectural verification.

TrueConf Server provides a clearer documented example of the customer-operated deployment model.

TrueConf’s current documentation states that the server can operate on-premises without an internet connection and supports up to 2,000 participants, SIP/H.323 interoperability and corporate communication functions.

From a GDPR perspective, the useful characteristic is not a generic claim of “compliance.”

A fully internal deployment can reduce the number of third parties involved in meeting-content processing and can eliminate many ordinary cross-border meeting-data paths.

That still leaves the controller responsible for:

• lawful basis;

• participant transparency;

• recording policies;

• user access;

• retention;

• backups;

• patching;

• breach response;

• administrator privileges.

Best fit: Organisations that specifically want conferencing, recordings and user communication to remain on customer-operated infrastructure.

Main trade-off: Infrastructure control also means infrastructure responsibility.

Digital Samba represents the European managed-cloud approach.

It currently positions its video conferencing service around European hosting and GDPR-oriented processing rather than customer-operated infrastructure.

This model can reduce the operational burden compared with self-hosting.

The buyer should still review:

• DPA;

• hosting architecture;

• subprocessors;

• support locations;

• recording storage;

• retention;

• AI features.

Zoom can be used in GDPR-governed environments, but configuration and contract terms matter.

Zoom currently offers eligible EEA customers controls for EEA data residency and publishes GDPR, subprocessor and transfer documentation.

A procurement review should identify exactly what regional controls cover:

• real-time meeting traffic;

• cloud recordings;

• support data;

• AI processing;

• account data;

• subprocessors.

Microsoft’s EU Data Boundary is relevant to GDPR procurement because Microsoft commits to storing and processing covered Customer Data and personal data within the boundary for in-scope enterprise online services.

Microsoft also documents limited circumstances where transfers outside the boundary continue.

For Teams, review:

• which workload processes the data;

• recording and transcription;

• Copilot;

• support;

• telemetry;

• external guest identities;

• retention;

• data residency.

Jitsi is particularly relevant when the organisation wants to operate the conferencing stack itself.

Jitsi explicitly supports private self-hosting. Its security documentation also distinguishes self-hosted deployments from the public meet.jit.si service, which has its own account and analytics processing.

This distinction is critical.

A self-hosted deployment lets the organisation control much more of the infrastructure, but external services can still reappear through:

• hosting;

• authentication;

• recording;

• analytics;

• telephony;

• monitoring.

Nextcloud Talk is another self-hosted model.

Nextcloud describes Talk as a fully self-hosted on-premises audio/video and chat communication service and supports private-cloud or customer-operated deployment.

Its GDPR profile therefore depends heavily on who operates:

• the Nextcloud server;

• Talk backend;

• hosting;

• recording;

• integrations;

• AI services.

• Each meeting use case is documented.

• Personal-data categories are identified.

• Lawful basis is documented.

• Article 9 condition is identified where special-category data is processed.

• Recording is assessed separately.

• AI/transcription is assessed separately.

• Controller and processor roles are mapped.

• DPA is signed where required.

• Subprocessor list is reviewed.

• Managed support access is included in the processing map.

• Data locations are documented.

• Remote access locations are known.

• Appropriate transfer mechanism is documented.

• DPF participation is checked where relied upon.

• SCCs or other mechanisms are reviewed where applicable.

• Authentication controls are configured.

• Meeting access is restricted appropriately.

• Recording permissions are centrally managed.

• Encryption architecture is understood.

• Administrator access is limited.

• Patching and vulnerability management are defined.

• Recording retention is defined.

• Chat retention is defined.

• Transcript retention is defined.

• Deletion workflow is tested.

• Access-request workflow is tested.

• Departed-user data is handled consistently.

• Privacy notice covers video conferencing.

• Recording is disclosed before it begins.

• AI transcription is disclosed where used.

• External participants receive appropriate information.

• Video-meeting incidents are included in the breach plan.

• 72-hour assessment workflow is documented.

• Risk threshold for authority notification is understood.

• High-risk threshold for individual notification is understood.

A video call can contain health data, political opinions, trade-union information, religious beliefs or other special-category data.

Article 9 creates additional restrictions for this processing.

That means a platform that is acceptable for routine sales calls may require a different architecture or configuration for:

• healthcare;

• HR investigations;

• occupational health;

• legal consultations;

• union discussions.

Video platforms can also create employee-monitoring implications through:

• attendance tracking;

• activity reports;

• participation metrics;

• recording;

• transcription;

• AI summaries.

GDPR is only one part of that analysis.

Depending on the country and organisation, national employment and co-determination rules may also apply.

There is no single product feature that creates compliance.

The organisation needs an appropriate lawful basis, transparency, appropriate security, controlled retention, valid processor arrangements and lawful international transfers where applicable.

No.

A DPA addresses the Article 28 processor relationship. It does not establish lawful basis, solve retention, determine security configuration or automatically provide a Chapter V transfer mechanism.

No.

It is useful, but you still need to understand subprocessors, support access, AI, metadata and other data flows.

No.

Self-hosting gives the organisation more control over infrastructure, but the organisation still has to comply with GDPR and secure the environment.

External processors may also remain if hosting, support, AI or other services are outsourced.

Usually yes when they contain identifiable personal data such as a participant’s image, voice, name or shared information.

The purpose, lawful basis, access and retention should be documented.

Not necessarily.

Consent is one possible lawful basis, but the correct basis depends on the specific processing context.

If consent is relied upon, it must satisfy GDPR requirements for valid consent.

Yes.

The appropriate transfer mechanism depends on the recipient and processing arrangement. The European Commission currently recognises participating US commercial organisations under the EU-US Data Privacy Framework.

Other mechanisms such as SCCs may also apply in appropriate cases.

No.

Article 33 requires supervisory-authority notification when a breach is not unlikely to result in risk to individuals’ rights and freedoms. Communication to individuals applies when a breach is likely to result in high risk.

No.

E2EE may be an appropriate security measure for certain risks, but GDPR compliance also includes lawful basis, transparency, data minimisation, retention, rights, processors and transfers.

Do not begin procurement by asking vendors whether they are GDPR-compliant.

Begin with five questions:

1. What personal data will this meeting scenario process?

2. Why are we processing it and what lawful basis applies?

3. Who will process the data besides us?

4. Where will every major data category be processed and stored?

5. Can we technically enforce the retention, access and security rules we have documented?

Only then compare video platforms.

A public-cloud product may be appropriate when the organisation has the right contracts, transfer mechanism, configuration and risk profile.

A European cloud provider may reduce certain jurisdictional and transfer complexities.

A self-hosted system such as TrueConf Server or a private communication environment built around Secumeet may reduce dependence on external meeting infrastructure when correctly deployed.

The central GDPR question is therefore not whether a vendor can display a compliance badge.