Is Video Conferencing GDPR Compliant? What Organisations Must Check

Update: October 2026

No video conferencing tool is compliant on its own. Compliance depends on how your organisation configures the tool, what it records, where the provider processes the data and what you tell participants.

This guide covers the checks an organisation should complete before and during use of a platform such as Microsoft Teams, Zoom or Google Meet. It also explains what privacy regulators said to providers in a 2020 open letter, and why international transfers remain the part to watch.

Key Takeaways

• The organisation that decides why and how meetings are held is the controller, and the provider is normally its processor. Article 28 of the GDPR requires a written contract with the provider that sets out the processing instructions, security duties and rules on sub-processors.

• Recording, transcripts, attendance tracking and location data each need a lawful basis under Article 6 and clear notice to participants under Articles 13 and 14. A recording is personal data and has to be kept only as long as needed.

• If the provider processes data outside the EEA, a transfer mechanism under Chapter V is required. The EU-US Data Privacy Framework adequacy decision of 10 July 2023 is under appeal at the Court of Justice, so organisations that rely on it should keep a fallback.

Compliance Depends on Your Setup and Not on the Product Name

Regulators assess how an organisation uses a platform. The same product can be used lawfully by one organisation and unlawfully by another, depending on contract terms, settings, retention, the data shared in calls and the transfer route.

A video call involves several kinds of personal data: names, email addresses, IP addresses, device data, voice, video, chat messages, shared files and meeting metadata. In health, education, and legal work, call content can include special category data. The assessment starts with listing which of these your meetings generate.

The Organisation Is the Controller, and the Provider Is Usually the Processor

When an organisation chooses a platform and decides how meetings are used, it acts as controller for that processing. The provider acts as processor when it handles data on the organisation’s instructions. Providers often act as an independent controller for their own purposes, such as service analytics or account security, and their documentation should state which.

Article 28 requires a binding contract or other legal act between the controller and the processor. It has to set out the subject matter and duration of the processing, the type of data, the controller’s instructions, confidentiality, security measures, rules for sub-processors, assistance with data subject requests and breach handling, and deletion or return of data at the end of the service. Most major providers publish a data processing addendum. Check that you’ve accepted it for your account and that it matches how you use the product. Our guide to NDAs and DPAs explains what a DPA covers.

Recording and Transcription Need a Lawful Basis and Clear Notice

A recording or automated transcript creates a new set of personal data about everyone on the call. Article 6 requires a lawful basis. For internal meetings, an organisation may rely on legitimate interests, a contract or a legal obligation, depending on the purpose. For external participants, consent is often the most workable basis.

Articles 13 and 14 require participants to be told who is processing their data, why, on what basis, for how long and with whom it is shared. The practical approach is to say at the start of the call that the meeting is being recorded and why, and to link to a notice. The regulators’ 2020 letter, covered below, expects platforms to make it clear when recording or transcription is active. The organisation also needs a retention period, access controls for the recordings, and a route for people to request deletion of their data.

Where a participant objects to being recorded, the organisation needs a way to continue the meeting without recording that person’s contribution.

International Transfers Require a Chapter V Mechanism

Many providers process data in the United States or use group companies and sub-processors outside the EEA. Chapter V of the GDPR allows such transfers only through an adequacy decision, appropriate safeguards such as standard contractual clauses, or a listed derogation.

The Commission adopted the adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. The General Court dismissed an action against it on 3 September 2025, and the applicant lodged an appeal at the Court of Justice on 31 October 2025, registered as Case C-703/25 P, according to the notice in the Official Journal. Check the Court’s register for the current stage. Until a final ruling, organisations should confirm whether their provider is certified under the Framework and whether the contract also includes standard contractual clauses, and should record a transfer assessment.

Some providers offer EU data residency for meetings and recordings. In 2023, the EDPS found that the Court of Justice of the EU’s use of cloud videoconferencing services complied with the data protection rules for EU institutions, in a press release on a revised agreement with its provider. That decision applies to EU institutions and sets no standard for companies. It shows what a regulator looks for: contract terms, processing locations, and an assessment of risks from non-EU laws.

Regulators Set Out Five Expectations for Providers

On 22 July 2020, six data protection authorities published an open letter to video teleconferencing companies through the Global Privacy Assembly’s International Enforcement Cooperation Working Group. The signatories were the privacy regulators of Australia, Canada, Gibraltar, Hong Kong, Switzerland and the UK. The letter was sent directly to Microsoft, Cisco, Zoom, House Party and Google, and asked for responses by 30 September 2020. The full text is on the OAIC website.

The letter listed five principles: security; privacy by design and default; knowing your audience; transparency and fairness; and end-user control. Under security, it said providers should generally have effective end-to-end encryption for all data communicated, two-factor authentication and strong passwords as standard. Under privacy by design, it called for strong access controls by default, clearly announcing new callers and muting their audio and video when they enter. Under end-user control, it said that location data, attention tracking, recording and transcripts should be clearly indicated to everyone on the call.

The letter addressed providers and had no direct effect on customers. Organisations can use it as a checklist for choosing and configuring a platform, because the same points decide whether a deployment is defensible.

Security Settings Are the Organisation’s Responsibility

Article 32 requires appropriate technical and organisational measures. For video conferencing, that means setting controls an administrator manages: meeting passcodes or lobbies, restrictions on who can join and share screens, limits on recording rights, two-factor authentication for accounts, automatic client software updates, and disabling features the organisation does not need.

Remote staff add risk because meetings happen on home networks and personal devices. Our guide to cyber security and working from home covers the wider controls. A written policy should say who may host meetings, who may record, where recordings are stored and when they are deleted.

A DPIA Is Needed Where the Use Creates a High Risk

Article 35 requires a data protection impact assessment where processing is likely to result in a high risk. Video conferencing used for routine internal meetings may not meet that threshold. Remote medical consultations, therapy sessions, online teaching of children, recorded interviews, monitoring of employee attention, and large-scale recording of calls are likely to require an assessment. The 2020 letter also called for providers to run privacy impact assessments and to consult regulators where risks cannot be mitigated.

GDPRLocal helps organisations review video conferencing platforms, contracts and policies. See our GDPR consultant services.

Conclusion

An organisation can use a video conferencing platform in line with the GDPR when it has a processor contract, a lawful basis and notice for recordings, a valid transfer route, tight security settings, and, where the risk is high, a DPIA. None of these comes with the product by default.

Frequently Asked Questions

Is Microsoft Teams, Zoom or Google Meet GDPR Compliant?

No platform is compliant by itself. Compliance depends on the contract with the provider, the settings you choose, what you record, where data is processed and what you tell participants. Providers publish data-processing terms, and the organisation must check that they apply to its account and use.

Do We Need Consent to Record a Video Call?

You need a lawful basis under Article 6 and must inform participants under Articles 13 and 14. Consent is often the most workable basis for external participants. Internal meetings may rely on another basis, such as legitimate interests, if the purpose is documented and participants are told before recording starts.

Can We Send Video Call Data to a Provider in the United States?

You can if a Chapter V mechanism covers the transfer. The EU-US Data Privacy Framework adequacy decision applies to certified providers, and it is under appeal at the Court of Justice in Case C-703/25 P. Standard contractual clauses and a transfer assessment provide a fallback.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.