Is video messaging GDPR compliant? What secure video messaging needs, and where the recording lives
Steffen Rosenögger, Founder of CapmeUpdated November 1, 2026
Yes, with the right setup. Five GDPR checks for secure video messaging, six vendor questions to copy, and the three places a recording can be stored.
In short
- Send each vendor six questions in writing; the answer on deletion tells you the most.
- Capme publishes its DPA, subprocessors and measures but holds no ISO 27001 or SOC 2 of its own.
Yes, a company can use video messaging and stay within the GDPR if the setup is right. Secure video messaging, in the GDPR's terms, means recorded messages whose file, audience and storage period your company controls and can document. That takes a legal basis and a notice to the people recorded, a data processing agreement with every vendor that hosts the file, its named subprocessors, a basis for any transfer outside the EEA, and playback for the intended audience with an expiry.
This guide describes the law and one product, Capme, which we make; it is not legal advice. It does not fit companies outside the EU, and a recording that shows health data needs an impact assessment and more than this list. Embedding YouTube or Vimeo videos on your website is a separate question. The six questions to send a vendor are below, ready to copy; the documents a review asks for are in Capme's Trust Center.
Is a video recording personal data?
A video recording is personal data whenever a person in it can be identified, and the speaker always can. Article 4(1) GDPR covers any information about an identifiable person, including by physical features, so face, voice and a name in the title count. A face on video is not special-category data by default: Recital 51 counts photographs as biometric only when specific technical means identify a person, which a recorder does not do.
In screen recording, the data protection risk sits mostly in the screen: a share captures whatever was open, a CRM record or a payroll tab.
What does a compliant setup need?
A compliant video messaging setup needs five things: a legal basis with a notice, a DPA, named subprocessors, a transfer basis, and security with a deletion date. Most of the paperwork hangs on one sentence, Article 28(1) GDPR: "the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."
- A legal basis under Article 6(1) and a notice under Article 13. For staff, see our guide to employee video consent.
- A video messaging DPA (data processing agreement). Your company is the controller; a vendor that handles recordings on its behalf is a processor. Article 28(3) sets what their contract contains, and the Commission publishes standard clauses for it.
- Named subprocessors. A processor adds one only with your authorisation and announces changes so you can object (Article 28(2) and (4)); the EDPB's Opinion 22/2024 expects their names to be at hand.
- A transfer basis. Data leaves the EEA only under Chapter V: an adequacy decision such as the EU-US Data Privacy Framework, or standard contractual clauses plus a check for supplementary measures. The General Court upheld it in September 2025; the appeal is pending as of November 2026.
- Security and an end date. Article 32 asks for security fit for the risk, and every recording needs a deletion date. The processing goes into your Article 30 record.
Where can a recording live?
A recording ends up in one of three places, and the list above applies differently to each. On the person's device, the recorder encodes in the browser and no vendor holds the video, so there is no processor for it, and no link a colleague can open either. Capme's free recorder works this way; saving a take asks for an email address.
On the vendor's hosting, the file is uploaded and streamed, which makes it shareable and brings in the whole list: the vendor is your processor, its video host a subprocessor you may know by name. Capme's paid plans store takes with Bunny Stream in Germany and Sweden; delivery outside the EU runs under standard clauses.
In storage you run, the recorder writes into your company's S3-compatible bucket and playback comes from there. The vendor stays your processor for agenda, audience and audit log, and the line procurement likes to hear, that the vendor never holds the video, is true only here. On Business and Enterprise, only the poster frame passes through Capme's server, and Capme deletes an object only when a member deletes the recording.
| Place | In the browser | Vendor hosts, EU | Your own bucket |
|---|---|---|---|
| Vendor's role for the video | None | Processor, Art. 28 | Processor for metadata only |
| Retention | Until the person deletes it | The plan's period | Your lifecycle rule |
| Capme | Free | Solo, Team, Business and Enterprise | Business, Enterprise |
When must a recording be deleted?
A recording must be deleted once its purpose is met, and earlier when the person in it has a right to erasure under Article 17, for example after withdrawing consent. Article 5(1)(e) sets no number of days, so your company fixes a period per purpose, for example 90 days for a status update that replaced a meeting and 180 for an onboarding video. Each period goes into the Article 30 record with its reason.
Deleting has to reach every copy, including the file at the video host and any download. Ask the vendor how long its backups keep a deleted file, and give your own bucket a lifecycle rule. A policy you can copy is in our data retention policy template for meeting recordings.
What should you ask a video messaging vendor?
Send the questions below to every vendor on the shortlist, Capme included, and check each answer against the document it cites. For jurisdiction and ownership, use the four questions in our sovereign stack guide.
We think question 3 tells you the most, because a vendor that can say where a deleted file goes has mapped its own data flows. In Germany, question 5 brings in the works council: see our guide to works councils and video tools.
Where Capme stands, including what it does not have
Capme Meetings is a meeting platform for async meetings: the organiser writes the agenda and each speaker records a topic from a link. Viewers need no paid seat, and video lives on EU hosting or, from Business up, in your own bucket. Its answers:
| Question | Capme's answer | Where Capme falls short |
|---|---|---|
| Roles | Processor for your workspace; DPA on the Commission's clauses, accepted with a tick box when a trial or plan starts | Countersigned PDF only on request |
| Subprocessors | 6, named in DPA Annex IV; changes announced thirty days ahead (clause 4.7) | 2 rely on standard clauses or the Data Privacy Framework |
| Retention | Team: 365 days; Solo, Business, Enterprise: 1 to 365; any recording can be marked keep, deleting wins | Team cannot shorten its period |
| Playback | Organiser, speakers, audience, admins; public links off until an admin switches them on; unlisted, revocable | Solo workspaces start with public links on |
| Viewer data | Watched, partly watched, opened or not opened, per person or as totals only; no scores | Per person is the default |
| Leaving | "Download video" in the library for the person who recorded it; all videos as files on request, free; audit log as CSV from Business up | Metadata as JSON or CSV only on request |
| Certificate | Hetzner and netcup hold ISO 27001; CAIQ Lite questionnaire on request | No ISO 27001 or SOC 2 of its own; no independent penetration test yet |
What an admin sets, step by step
- In a Team workspace, the retention field is locked: "Team keeps every recording for 12 months. Business sets its own window." A recording made on 5 October 2026 expires on 5 October 2027.
- In a Business workspace, the admin types 30 and saves. The screen answers "New recordings will be kept 30 days. Nothing already recorded is shortened." A recording made on 5 October 2026 then expires on 4 November 2026, unless someone marks it keep.
- Under Public links, the switch reads Off: "Nothing in this workspace opens without a sign-in." Under Watch progress, the admin picks Per person or Totals only.
- If the owner deletes the workspace, Capme waits 14 days and then purges it on its own hosts and at the video host; recordings in your own bucket stay there as your files. Each download from the library is in the audit log.
If your policy names ISO 27001 or SOC 2, a vendor with that report is the better choice today. Otherwise a 14-day trial of Team lets your DPO check these screens before anyone records.
Read the documents before the call
It holds the DPA, the subprocessors, the measures and the works council document.
Frequently asked questions
- Can customer data appear in a video message?
- Only as much as the purpose needs (Article 5(1)(c)). A CRM record on screen is the customer's personal data, so close other tabs before recording, and re-record a take that shows more than the viewer needs.
- Do viewers have to be told that their viewing is recorded?
- Yes. Who opened a video and how far they watched is personal data about the viewer, so Article 13 applies. For staff, the employee privacy notice is the usual place; in Germany the works council has a say as well.
- Do we need a DPIA for video messaging?
- Not always. Per-person viewing data about employees, recordings of customers or health data on screen push towards one. Your DPO decides after reading the vendor's measures and viewer-data settings.
- Does a vendor need ISO 27001 to be GDPR compliant?
- No. Article 28(5) GDPR names approved codes of conduct and certifications as one way to show sufficient guarantees, not the only one. Whether a DPA and measures are enough is your policy's call.
- How do we get our data out if we stop using Capme?
- Download video in the library saves each video you recorded; Capme exports all of them free on request, and a Business bucket holds them anyway. Hosted videos stay available 30 days after a paid plan ends. Metadata comes as JSON or CSV on request.