# GDPR-compliant video conferencing: a checklist for businesses

> Video calls process images, audio, chat messages and metadata. What German supervisory authorities require and which settings small businesses should use.

- URL: https://saascolumn.com/en/blog/video-conferencing-gdpr-compliance/
- Author: [SaaS Column Editorial Team](https://saascolumn.com/en/author/editorial-team/), Editorial team
- Published: 13 November 2026
- Other languages: DE https://saascolumn.com/blog/videokonferenz-datenschutz-dsgvo/

## In short

GDPR-compliant video conferencing needs a data processing agreement with the vendor, a legal basis for international transfers, at least transport encryption and privacy-friendly defaults. Camera, microphone and recording are off by default. Recordings usually require consent. Inform participants in advance about the vendor, retention and recording.

- **Choose the operating model:** online service, hosting by an IT provider or your own server. The DPA and transfer questions depend on it.
- **Encryption:** at least transport encryption in line with state-of-the-art guidance, plus end-to-end encryption for high-risk meetings.
- **Privacy-friendly defaults:** camera, microphone and screen sharing off on entry, recording disabled by default.
- **Recordings:** need a separate legal basis, usually consent.

Video calls process more data than many people think: image and sound, chat messages, shared screens, plus metadata about attendance and duration. The German data protection conference (DSK) published [guidance on video conferencing systems](https://www.datenschutzkonferenz-online.de/media/oh/20201023_oh_videokonferenzsysteme.pdf) on 23 October 2020. It is a useful reference across the EU. This guide turns it into a checklist for small businesses under the GDPR.

## Which operating model fits?

**The DSK distinguishes three operating models.** Each brings different obligations:

| Model | Typical example | Data protection consequence |
| --- | --- | --- |
| Online service (SaaS) | Microsoft Teams, Zoom | DPA with the vendor, check international transfers |
| External IT provider | hosted open source solution | DPA with the provider |
| Self-hosted | Jitsi Meet on your own server | full control, own effort for security |

According to the DSK, self-hosted systems let you decide which software runs and which data is created. [Jitsi Meet](https://jitsi.org/jitsi-meet/), for example, is open source and can run on your own servers. In return you need the skills for updates and hardening. For most small businesses, an online service is more realistic (provided the contracts are in order).

## Which contracts do you need?

**Online services and external providers require a data processing agreement.** The DSK is clear: if a provider can access personal data, you must conclude a DPA. This can even apply to self-hosted systems, for example through remote maintenance. Our guide to the [data processing agreement](https://saascolumn.com/en/blog/data-processing-agreement-saas/) explains what to look for.

If the vendor is based in the US, the transfer adds another layer. According to the DSK, a transfer also occurs when a vendor accesses data stored in the EU from a third country. Microsoft and Zoom were listed as active on the DPF List when we checked on 13 November 2026. Our guide to the [EU-US Data Privacy Framework](https://saascolumn.com/en/blog/eu-us-data-privacy-framework-saas/) shows how to check this yourself and how stable the framework is.

> **Hinweis:**
>
> This article is not legal advice. It reflects the situation as of November 2026. For sensitive data such as health or HR data, involve your data protection officer.

## How secure must the transmission be?

**At a minimum, transport encryption in line with the technical guidelines of the German BSI is required.** It must protect content and metadata. For high-risk meetings, the DSK calls for additional measures such as end-to-end encryption. With end-to-end encryption only the participants' devices hold the keys, so the operator cannot read along.

In 2020 the DSK acknowledged that end-to-end solutions for large meetings were not yet market-ready. In that case, transport encryption with compensating measures at the operator may suffice. Check your vendor's documentation today to see whether and for which meetings it offers end-to-end encryption. It often restricts features such as recording.

## Which settings should you use?

**Article 25 GDPR requires data protection by default.** The DSK spells this out for video calls. As an administrator, check these settings:

- Camera, microphone and screen sharing are off when participants join.
- Participants can switch off camera and microphone at any time.
- Nobody can switch on another person's camera or microphone without consent.
- Recording is disabled by default and available only to moderators.
- Guest access without sign-in exists only where it is needed.
- Diagnostic and telemetry data flow only as far as the service requires.

For your own staff, [single sign-on](https://saascolumn.com/en/glossary/single-sign-on-sso/) through your identity provider is a good choice. You manage access centrally and can revoke it immediately when someone leaves.

## When may you record?

**Recordings need their own legal basis.** Unless there is a specific documentation requirement, the DSK says consent is usually needed. This consent must be obtained separately. Show a visible notice when recording starts. Store recordings encrypted and delete them once the purpose is fulfilled.

The same applies to transcripts and AI summaries. They are created from the recording or live audio and process the same data. Enable such features only once the legal basis and information are clear.

## What belongs in the privacy notice?

**Participants must know in advance what happens to their data.** Under Article 13 GDPR and the DSK guidance, the notice should include these points:

- the vendor's name and any transfer to third countries
- whether meetings are recorded and how long data is kept after the meeting
- how participants can protect their own data, for example with a pseudonym or virtual background

## How do you roll this out in the team?

**Record the roll-out in a few fixed steps.** That keeps things manageable, even when a second tool is added later:

1. Choose the tool and operating model and note the reasons briefly.
2. Conclude the DPA and file it together with the TOM annex.
3. Set defaults centrally in the admin console, not user by user.
4. Add a privacy notice for participants and link it in invitations.
5. Write a clear rule for recordings, transcripts and AI features.
6. Add the processing to your record of processing activities.

This documentation helps when employees, customers or the supervisory authority ask questions. It is also the basis for switching tools cleanly later on.

Video calls are often part of a wider collaboration suite. Compare the chat features too, for example in our [team chat comparison](https://saascolumn.com/en/compare/team-chat-tools-comparison/). Your next step: compare the defaults of your current tool with the list above.

## Frequently asked questions

### Can I record a meeting without consent?

Only with another valid legal basis, such as a specific documentation requirement. Otherwise, the DSK says consent is usually required. Show a visible notice when recording starts.

### Is end-to-end encryption mandatory?

Not for every meeting. The DSK requires at least transport encryption. For high-risk meetings, such as health or HR discussions, additional measures like end-to-end encryption are advisable.

### Do I need a DPA for Microsoft Teams or Zoom?

Yes. Both are online services that process personal data on your behalf. The vendors provide standard agreements that you review and accept.

### Is a self-hosted system always better?

It gives you more control over software and data flows. In return you are responsible for updates, hardening and availability. Without in-house IT skills, a well-vetted online service is often the safer choice.

## Sources

1. [Orientierungshilfe Videokonferenzsysteme](https://www.datenschutzkonferenz-online.de/media/oh/20201023_oh_videokonferenzsysteme.pdf), Datenschutzkonferenz (DSK), 2020-10-23
2. [Jitsi Meet](https://jitsi.org/jitsi-meet/), Jitsi
3. [Data Privacy Framework List](https://www.dataprivacyframework.gov/list), International Trade Administration, U.S. Department of Commerce