GDPR-compliant video conferencing: a checklist for businesses

Video calls process more data than many people think: image and sound, chat messages, shared screens, plus metadata about attendance and duration. The German data protection conference (DSK) published guidance on video conferencing systems on 23 October 2020. It is a useful reference across the EU. This guide turns it into a checklist for small businesses under the GDPR.

Which operating model fits?

The DSK distinguishes three operating models. Each brings different obligations:

According to the DSK, self-hosted systems let you decide which software runs and which data is created. Jitsi Meet, for example, is open source and can run on your own servers. In return you need the skills for updates and hardening. For most small businesses, an online service is more realistic (provided the contracts are in order).

Which contracts do you need?

Online services and external providers require a data processing agreement. The DSK is clear: if a provider can access personal data, you must conclude a DPA. This can even apply to self-hosted systems, for example through remote maintenance. Our guide to the data processing agreement explains what to look for.

If the vendor is based in the US, the transfer adds another layer. According to the DSK, a transfer also occurs when a vendor accesses data stored in the EU from a third country. Microsoft and Zoom were listed as active on the DPF List when we checked on 13 November 2026. Our guide to the EU-US Data Privacy Framework shows how to check this yourself and how stable the framework is.

How secure must the transmission be?

At a minimum, transport encryption in line with the technical guidelines of the German BSI is required. It must protect content and metadata. For high-risk meetings, the DSK calls for additional measures such as end-to-end encryption. With end-to-end encryption only the participants' devices hold the keys, so the operator cannot read along.

In 2020 the DSK acknowledged that end-to-end solutions for large meetings were not yet market-ready. In that case, transport encryption with compensating measures at the operator may suffice. Check your vendor's documentation today to see whether and for which meetings it offers end-to-end encryption. It often restricts features such as recording.

Which settings should you use?

Article 25 GDPR requires data protection by default. The DSK spells this out for video calls. As an administrator, check these settings:

• Camera, microphone and screen sharing are off when participants join.

• Participants can switch off camera and microphone at any time.

• Nobody can switch on another person's camera or microphone without consent.

• Recording is disabled by default and available only to moderators.

• Guest access without sign-in exists only where it is needed.

• Diagnostic and telemetry data flow only as far as the service requires.

For your own staff, single sign-on through your identity provider is a good choice. You manage access centrally and can revoke it immediately when someone leaves.

When may you record?

Recordings need their own legal basis. Unless there is a specific documentation requirement, the DSK says consent is usually needed. This consent must be obtained separately. Show a visible notice when recording starts. Store recordings encrypted and delete them once the purpose is fulfilled.

The same applies to transcripts and AI summaries. They are created from the recording or live audio and process the same data. Enable such features only once the legal basis and information are clear.

What belongs in the privacy notice?

Participants must know in advance what happens to their data. Under Article 13 GDPR and the DSK guidance, the notice should include these points:

• the vendor's name and any transfer to third countries

• whether meetings are recorded and how long data is kept after the meeting

• how participants can protect their own data, for example with a pseudonym or virtual background

How do you roll this out in the team?

Record the roll-out in a few fixed steps. That keeps things manageable, even when a second tool is added later:

1. Choose the tool and operating model and note the reasons briefly.

2. Conclude the DPA and file it together with the TOM annex.

3. Set defaults centrally in the admin console, not user by user.

4. Add a privacy notice for participants and link it in invitations.

5. Write a clear rule for recordings, transcripts and AI features.

6. Add the processing to your record of processing activities.

This documentation helps when employees, customers or the supervisory authority ask questions. It is also the basis for switching tools cleanly later on.

Video calls are often part of a wider collaboration suite. Compare the chat features too, for example in our team chat comparison. Your next step: compare the defaults of your current tool with the list above.