{"id":17494,"date":"2021-06-29T13:37:04","date_gmt":"2021-06-29T10:37:04","guid":{"rendered":"https:\/\/trueconf.com/blog\/?p=17494"},"modified":"2026-09-03T18:25:58","modified_gmt":"2026-09-03T15:25:58","slug":"gdpr-compliant-video-conferencing","status":"publish","type":"post","link":"https:\/\/trueconf.com/blog\/reviews-comparisons\/gdpr-compliant-video-conferencing","title":{"rendered":"GDPR-Compliant Video Conferencing: 10 Checks Before You Choose"},"content":{"rendered":"<p class=\"primary-medium-text ui-mb-sm-1\">A video conferencing platform is not GDPR-compliant simply because a vendor describes it that way.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Compliance depends on the <b>specific processing activity<\/b>: what personal data is processed, why it is needed, who receives it, where it is stored, how long it remains available and what controls are applied.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">The same platform can create different requirements for:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">an internal meeting;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">a customer call;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">an HR interview;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">a recorded board meeting;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">AI transcription;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">communication involving infrastructure outside the EEA.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">For organizations evaluating <b>GDPR-compliant video conferencing<\/b>, the more useful question is:<\/p>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Can we document and control the processing chain for the way we intend to use the platform?<\/b><\/p>\n<\/div>\n<p class=\"primary-medium-text ui-mb-sm-1\">This article provides a practical evaluation framework and is not legal advice.<\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">GDPR Video Conferencing at a Glance<\/h2>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Check<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">What to verify<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Purpose<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Why is personal data being processed?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Data<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Which identifiers, meeting content and metadata are involved?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Lawful basis<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Which Article 6 basis applies?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Roles<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Who is controller, processor and subprocessor?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Transparency<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">What are participants told?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Recordings and AI<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Are calls recorded, transcribed or summarized?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Retention<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">How long is data kept?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Transfers<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Does data leave the EEA, and under which mechanism?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Security<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Are measures appropriate to the risk?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Deployment<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Which parts of the data path are controlled by third parties?<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Encryption or EU hosting alone does not answer all ten questions.<\/b><\/p>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">What Personal Data Does Video Conferencing Process?<\/h2>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Category<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Examples<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Identity<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Name, email, account ID<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Meeting content<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Audio, video, chat, files, screen sharing<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Technical metadata<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">IP address, device and connection data<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Derived content<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Transcripts, AI summaries, analytics<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Administration<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Logs, attendance and meeting history<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><img decoding=\"async\" src=\"https:\/\/trueconf.com\/blog\/wp-content\/uploads\/2021\/06\/conferences-in-4k-690x420.png\" alt=\"GDPR-Compliant Video Conferencing\" width=\"690\" height=\"420\" class=\"aligncenter size-medium wp-image-49402\" loading=\"lazy\" title=\"\" srcset=\"https:\/\/trueconf.com/blog\/wp-content\/uploads\/2021\/06\/conferences-in-4k-690x420.png 690w, https:\/\/trueconf.com/blog\/wp-content\/uploads\/2021\/06\/conferences-in-4k-1024x624.png 1024w, https:\/\/trueconf.com/blog\/wp-content\/uploads\/2021\/06\/conferences-in-4k-768x468.png 768w, https:\/\/trueconf.com/blog\/wp-content\/uploads\/2021\/06\/conferences-in-4k.png 1116w\" sizes=\"auto, (max-width: 690px) 100vw, 690px\" \/><\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">A face or voice is not automatically special-category biometric data merely because it appears in a video meeting.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Biometric data under GDPR involves specific technical processing that allows or confirms unique identification, such as certain facial or voice recognition systems.<\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Start With the Processing, Not the Platform<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Labels such as:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">GDPR compliant;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">encrypted;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">EU-hosted;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">certified;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">self-hosted;<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">can be relevant, but they do not establish compliance on their own.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Instead, map the processing activity.<\/p>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Question<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Example<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Purpose<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Weekly employee project meeting<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Data<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Names, video, audio, chat and metadata<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Recording<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Disabled<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>AI transcription<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Disabled<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Processor<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Conferencing provider<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Subprocessors<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Infrastructure or service providers<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Retention<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Defined by company policy<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Transfers<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Depends on vendor architecture<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>A recorded HR interview with AI transcription may use the same platform but create a different processing chain and risk profile.<\/b><\/p>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Controller, Processor and Subprocessors<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">In a typical cloud deployment:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">the organization may act as the <b>controller<\/b>;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">the conferencing provider may act as a <b>processor<\/b>;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">infrastructure or AI providers may act as <b>subprocessors<\/b>.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Where Article 28 applies, procurement should establish:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">whether a DPA is available;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">what processing it covers;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">which subprocessors are used;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">where they process data;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">how changes are communicated;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">what happens to data when the contract ends.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">The conferencing vendor may not be the only external party involved.<\/p>\n<p><iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/HJLxXqFZmN8?si=QhH9ufy5QS-th9e9\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Do Self-Hosted Systems Need a DPA?<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Self-hosting changes the processing model but does not automatically remove Article 28 considerations.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">If the vendor does not process personal data on the customer&#8217;s behalf, it may not act as a processor for the core meeting data.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">However, external processing may still occur through:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">licensing services;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">technical support;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">telemetry;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">push notifications;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">AI services;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">external storage;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">hosted gateways.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">The practical question is:<\/p>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Does any external party process personal data on our behalf in this configuration?<\/b><\/p>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Choose a Lawful Basis for Each Purpose<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Article 6 requires a lawful basis for processing.<\/p>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Purpose<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Question<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Employee meeting<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Why is video communication needed for the work activity?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Customer call<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Is processing necessary to provide the service?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Recording<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Why is a persistent copy required?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>AI transcription<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Why is an additional derived record needed?<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Published webinar<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Is publication a separate purpose?<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"primary-medium-text ui-mb-sm-1\">Possible bases include consent, contractual necessity, legal obligation, legitimate interests and other applicable Article 6 grounds.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Consent should not automatically be treated as the default basis for every video meeting.<\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Recording and Retention Under GDPR<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Recording creates an additional processing activity.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Before recording, determine:<\/p>\n<ol class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item\">Why is it necessary?<\/li>\n<li class=\"ui-list__item\">What lawful basis applies?<\/li>\n<li class=\"ui-list__item\">Who can access it?<\/li>\n<li class=\"ui-list__item\">How long will it be stored?<\/li>\n<li class=\"ui-list__item\">How will data-subject requests be handled?<\/li>\n<\/ol>\n<p class=\"primary-medium-text ui-mb-sm-1\">Participants should receive appropriate information about the recording, its purpose and retention.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Retention should also be considered separately for:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">recordings;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">transcripts;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">chat history;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">shared files;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">analytics;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">logs.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">The platform should allow stored information to be located, restricted or deleted according to organizational policy.<\/p>\n<p><a href=\"https:\/\/trueconf.com\/blog\/wp-content\/uploads\/2021\/06\/application-recording_en.svg\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"https:\/\/trueconf.com\/blog\/wp-content\/uploads\/2021\/06\/application-recording_en.svg\" alt=\"Record video conferences in their entirety or capture only the most significant moments using TrueConf desktop client applications for Windows, Linux, and macOS.\" width=\"554\" height=\"470\" class=\"aligncenter size-medium wp-image-49403\" loading=\"lazy\" title=\"\"><\/a><\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">AI Transcription Creates Another Processing Chain<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">AI meeting tools may process content for:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">transcription;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">summaries;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">action items;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">translation;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">search;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">analysis.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Organizations should verify:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">what meeting data is sent to the AI service;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">which processor or subprocessor handles it;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">where processing occurs;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">how long transcripts and summaries remain available;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">whether content is used for model training;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">who can access generated output;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">how it can be deleted;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">whether new international transfers are introduced.<\/li>\n<\/ul>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Disabling recording does not necessarily prevent persistent content from being created if transcription or summarization remains enabled.<\/b><\/p>\n<\/div>\n<p><a href=\"https:\/\/trueconf.com\/blog\/wp-content\/uploads\/2021\/06\/separation-by-speakers.svg\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"https:\/\/trueconf.com\/blog\/wp-content\/uploads\/2021\/06\/separation-by-speakers.svg\" alt=\"AI Transcription\" width=\"690\" height=\"325\" class=\"aligncenter size-medium wp-image-49404\" loading=\"lazy\" title=\"\"><\/a><\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Data Minimization Applies to Video Meetings<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Practical minimization can include:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">disabling unnecessary recording;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">limiting meeting analytics;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">avoiding unnecessary transcription;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">restricting access to archives;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">applying retention limits;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">collecting only necessary profile information.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Users should also avoid exposing unrelated information through screen sharing, notifications, open browser tabs or visible documents.<\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">International Data Transfers Are Not Automatically Prohibited<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">GDPR does not require every conferencing provider or server to be located inside the EU.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Transfers outside the EEA may use mechanisms such as:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">adequacy decisions;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Standard Contractual Clauses;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Binding Corporate Rules;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">other applicable GDPR mechanisms.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Organizations should determine:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">whether data leaves the EEA;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">which entities receive it;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">which mechanism applies;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">whether subprocessors are covered.<\/li>\n<\/ul>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\">EU hosting can simplify the data-flow model, but <b>EU hosting alone does not establish GDPR compliance<\/b>.<\/p>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Article 32: Security Is Risk-Based<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Article 32 requires technical and organizational measures appropriate to the risk.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">For video conferencing, these may include:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">encryption;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">MFA or SSO;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">role-based access;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">controlled meeting admission;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">audit logs;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">recording permissions;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">secure storage;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">infrastructure resilience;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">recovery procedures;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">regular security testing.<\/li>\n<\/ul>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>A statement that a platform is \u201cencrypted\u201d is therefore not enough.<\/b><\/p>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Common GDPR Video Conferencing Mistakes<\/h2>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Mistake<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Why it is weak<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cThe vendor says it is GDPR-compliant\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Compliance depends on actual processing<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cThe servers are in the EU\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Hosting location does not answer every GDPR requirement<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cIt is self-hosted, so GDPR is solved\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Controller obligations and external processors may remain<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cEveryone consented, so recording is fine\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Consent may not be the correct basis<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cThe meeting is not recorded, so nothing is stored\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Logs, chats, transcripts or AI summaries may remain<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cEncryption covers Article 32\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Security is broader and risk-based<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>\u201cProviders outside the EU cannot be used\u201d<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">GDPR provides lawful transfer mechanisms<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Cloud vs Self-Hosted Video Conferencing for GDPR<\/h2>\n<table style=\"overflow-x: auto; display: block;\">\n<thead>\n<tr>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Area<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Vendor-operated cloud<\/p>\n<\/th>\n<th style=\"padding: 8px 16px; text-align: left; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Customer-operated \/ self-hosted<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Infrastructure<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Provider<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Organization<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Processor relationship<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Usually central<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Depends on vendor involvement<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Data location<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Provider architecture<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Organization chooses<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Subprocessors<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Often used<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Can be reduced<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Maintenance<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Provider<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Organization<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Recording storage<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Configuration-dependent<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Can remain internally controlled<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>International transfers<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Must be evaluated<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Can often be reduced<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text ui-mb-xs-1\"><strong>Operational responsibility<\/strong><\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Lower<\/p>\n<\/td>\n<td style=\"padding: 8px 16px; border-bottom: 1px solid #F7F9FC; vertical-align: middle;\">\n<p class=\"primary-smallest-text\">Higher<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"primary-medium-text ui-mb-sm-1\">Neither model is automatically GDPR-compliant.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Cloud platforms can be used lawfully with appropriate contracts, transfer mechanisms, retention and security.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Self-hosting can reduce third-party processing and give the organization more control over the data path, but it does not remove GDPR obligations.<\/p>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">TrueConf Server for GDPR-Focused Video Conferencing<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Organizations that want greater control over video conferencing data can consider <b>TrueConf Server<\/b>, a customer-operated platform for video meetings, messaging and collaboration.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Unlike a conventional SaaS conferencing service, it is deployed on infrastructure controlled by the organization.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">The full version can operate autonomously inside a corporate network without requiring an Internet connection for internal communication.<\/p>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Keep the Core Meeting Data Path Under Your Control<\/h3>\n<p class=\"primary-medium-text ui-mb-sm-1\">Depending on configuration, organizations can manage data such as:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">conference recordings;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">files shared in chats;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">meeting and call history;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">server logs;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">user information;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">administrative events.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Internal meetings can be designed to remain inside a corporate network rather than routinely passing through a public conferencing cloud.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">This can simplify analysis of:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">data location;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">processor involvement;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">international transfers;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">recording storage;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">network dependencies.<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Integrate Corporate Infrastructure<\/h3>\n<p class=\"primary-medium-text ui-mb-sm-1\">TrueConf Server supports centrally managed accounts and corporate directory integration.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">It can also work with SIP and H.323 systems, allowing organizations to retain existing meeting-room and telephony infrastructure.<\/p>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Where TrueConf Fits<\/h3>\n<p class=\"primary-medium-text ui-mb-sm-1\">TrueConf Server can be relevant when an organization wants to:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">operate conferencing on its own infrastructure;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">keep internal meetings inside a corporate network;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">control where recordings and files are stored;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">reduce dependence on third-party conferencing infrastructure;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">integrate corporate directories;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">connect existing SIP\/H.323 equipment;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">support restricted-network environments.<\/li>\n<\/ul>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\">The GDPR-related advantage is <b>not automatic compliance<\/b>.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">It is greater control over where core communication data is processed and which external services are involved.<\/p>\n<\/div>\n<div class=\"grid-layout\">\n<div class=\"grid-layout__col-2\">\n<div class=\"grid-layout__item grid-layout__item--md grid-layout__item--color\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Try TrueConf Server Free!<\/b><\/p>\n<ul class=\"ui-list ui-list--small\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\"><b>1,000 online users<\/b> with the ability to chats and mske one-on-one video calls.<\/li>\n<li class=\"ui-list__item ui-list__item--disc\"><b>10 PRO users<\/b> with the ability to participate in group video conferences.<\/li>\n<li class=\"ui-list__item ui-list__item--disc\"><b>One SIP\/H.323\/RTSP connection<\/b> for interoperability with corporate PBX and SIP\/H.323 endpoints.<\/li>\n<li class=\"ui-list__item ui-list__item--disc\"><b>One guest connection<\/b> to invite a non-authenticated user via link to your meetings.<\/li>\n<\/ul>\n<p>            <a href=\"https:\/\/trueconf.com\/products\/tcsf\/trueconf-server-free.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" role=\"link\" class=\"default-button default-button--sm default-button--orange default-button--rounded default-button--truncate white-text\"><br \/>\n                <span class=\"default-button__text\">Learn more<\/span><br \/>\n            <\/a>\n        <\/div>\n<div class=\"grid-layout__item\">\n            <img decoding=\"async\" src=\"https:\/\/trueconf.com\/images\/products\/server-free\/feature\/--static-right\/__slide\/en\/features--static-right__slide--media.png\" alt=\"Content Sharing in High Quality\" title=\"Content Sharing in High Quality\" loading=\"lazy\">\n        <\/div>\n<\/p><\/div>\n<\/div>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">How to Evaluate a Video Conferencing Platform for GDPR<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">Before selecting a platform, verify six areas.<\/p>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Processing and Roles<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">What personal data is processed?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Is the vendor a processor?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Which subprocessors are involved?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Is a DPA available where required?<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Recordings and AI<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">Where are recordings and transcripts stored?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Who can access them?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Can retention be configured?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Is content used for AI model training?<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Transfers<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">Does data leave the EEA?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Which transfer mechanism applies?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Are subprocessors covered?<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Security<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">How are meeting streams and stored data protected?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Are administrative actions logged?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Are roles and permissions controlled?<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Deployment<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">Is the platform cloud, self-hosted or hybrid?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Which dependencies remain outside organizational control?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">Can it operate inside a private network if required?<\/li>\n<\/ul>\n<h3 class=\"h5--main h5--thick black-text ui-mb-xs-3 ui-mt-md-1\">Data Lifecycle<\/h3>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">What remains after the meeting?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">How long is each data category retained?<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">What happens when an account or contract ends?<\/li>\n<\/ul>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>If several of these questions cannot be answered, the compliance assessment is incomplete.<\/b><\/p>\n<\/div>\n<section id=\"faq\">\n<h2 class=\"h3--main h3--thick black-text ui-mb-md-1\">FAQ<\/h2>\n<div class=\"faq__container ui-mb-md-1\">\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">What is GDPR-compliant video conferencing?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">It is video communication conducted under a processing model that meets applicable GDPR requirements for lawful basis, transparency, processor relationships, security, retention, data-subject rights and international transfers. Compliance depends on how the platform is configured and used.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">Is self-hosted video conferencing automatically GDPR-compliant?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">No. Self-hosting can reduce third-party processing and give an organization greater control over data, but GDPR responsibilities and external dependencies may remain.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">Do I need a DPA with a video conferencing provider?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">If the provider processes personal data on your behalf as a processor, Article 28 requirements apply. For self-hosted systems, the answer depends on the actual data flow and vendor involvement.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">Do participants have to consent before recording?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">Not necessarily. Consent is one possible lawful basis, but another Article 6 basis may apply depending on the purpose and circumstances. Participants should still receive appropriate information about the recording.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">Can a US video conferencing provider be used under GDPR?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">Potentially, yes. If personal data is transferred outside the EEA, an applicable transfer mechanism such as an adequacy decision or Standard Contractual Clauses may be required.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"faq__item\">\n<p class=\"faq__question h4--main h4--thick black-text hyphens--auto margin--not\">What should we check before enabling AI meeting summaries?<\/p>\n<div class=\"faq__answer\">\n<p class=\"primary-medium-text margin--not\">Check what data is sent, who processes it, where it is processed, how long it is retained, whether it is used for training and how generated transcripts or summaries can be deleted.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<h2 class=\"h4--main h4--thick black-text ui-mb-xs-3 ui-mt-md-1\">Conclusion<\/h2>\n<p class=\"primary-medium-text ui-mb-sm-1\">GDPR-compliant video conferencing is not achieved simply by choosing a vendor that uses the term \u201cGDPR-compliant,\u201d enabling encryption or locating servers in the EU.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Organizations should understand:<\/p>\n<ul class=\"ui-list ui-list--medium\" style=\"margin-bottom: 18px;\">\n<li class=\"ui-list__item ui-list__item--disc\">what personal data is processed;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">why it is processed;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">who receives it;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">where it is processed;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">how long it is retained;<\/li>\n<li class=\"ui-list__item ui-list__item--disc\">how it can be secured or deleted.<\/li>\n<\/ul>\n<p class=\"primary-medium-text ui-mb-sm-1\">Cloud and self-hosted platforms can both form part of a GDPR-compliant environment when configured and governed appropriately.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">Customer-operated systems such as TrueConf Server can reduce third-party dependencies and provide greater control over the meeting-data path, particularly where data location, infrastructure control or private-network operation matter.<\/p>\n<p class=\"primary-medium-text ui-mb-sm-1\">The key procurement question is:<\/p>\n<div style=\"background: #F4F6FA; border-top: 3px solid #00BCD4; padding: 20px 24px 24px 24px; margin: 28px 0; border-radius: 8px;\">\n<p class=\"primary-medium-text ui-mb-sm-1\"><b>Can we demonstrate GDPR compliance for the way we will actually use the platform?<\/b><\/p>\n<\/div>\n<div class=\"divider\"><\/div>\n<div class=\"accent-note accent-note--special ui-mb-sm-1\">\n<p class=\"primary-medium-text\"><strong><i>About the Author<\/i><\/strong><br \/>\n<i>Olga Afonina is a technology writer and industry expert specializing in video conferencing solutions and collaboration software. At TrueConf, she focuses on exploring the latest trends in collaboration technologies and providing businesses with practical insights into effective workplace communication. Drawing on her background in content development and industry research, Olga writes articles and reviews that help readers better understand the benefits of enterprise-grade communication.<\/i><\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/olga-afonina-435b041a2\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" role=\"link\" class=\"primary-small-text to-page to-page--rarr cyan-icon\"><i>Connect with Olga on LinkedIn<\/i><\/a><\/p>\n<\/div>\n<style>\n  .divider {\n    border-top: 10px solid #01b7cc;\n    margin: 16px 0;\n  }\n<\/style>\n<p><script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"Person\",\n      \"@id\": \"https:\/\/www.linkedin.com\/in\/olga-afonina-435b041a2\/\",\n      \"name\": \"Olga Afonina\",\n      \"jobTitle\": \"Technology Writer, Marketing Content Manager\",\n      \"worksFor\": { \n        \"@type\": \"Organization\", \n        \"name\": \"TrueConf\", \n        \"url\": \"https:\/\/trueconf.com\" \n      },\n      \"url\": \"https:\/\/www.linkedin.com\/in\/olga-afonina-435b041a2\/\",\n      \"sameAs\": [\n        \"https:\/\/www.linkedin.com\/in\/olga-afonina-435b041a2\/\"\n      ],\n      \"description\": \"Olga Afonina is a technology writer and industry expert specializing in video conferencing and unified communications industry. At TrueConf, she focuses on exploring the latest trends in collaboration technologies and providing businesses with practical insights into effective workplace communication. Drawing on her background in content development and industry research, Olga writes articles and reviews that help readers better understand the benefits of enterprise-grade communication.\"\n    }\n  ]\n}\n<\/script><br \/>\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@type\": \"FAQPage\",\n  \"mainEntity\": [\n    {\n      \"@type\": \"Question\",\n      \"name\": \"What is GDPR-compliant video conferencing?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"It is video communication conducted under a processing model that meets applicable GDPR requirements for lawful basis, transparency, processor relationships, security, retention, data-subject rights and international transfers. Compliance depends on how the platform is configured and used.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Is self-hosted video conferencing automatically GDPR-compliant?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"No. Self-hosting can reduce third-party processing and give an organization greater control over data, but GDPR responsibilities and external dependencies may remain.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Do I need a DPA with a video conferencing provider?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"If the provider processes personal data on your behalf as a processor, Article 28 requirements apply. For self-hosted systems, the answer depends on the actual data flow and vendor involvement.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Do participants have to consent before recording?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Not necessarily. Consent is one possible lawful basis, but another Article 6 basis may apply depending on the purpose and circumstances. Participants should still receive appropriate information about the recording.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Can a US video conferencing provider be used under GDPR?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Potentially, yes. If personal data is transferred outside the EEA, an applicable transfer mechanism such as an adequacy decision or Standard Contractual Clauses may be required.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"What should we check before enabling AI meeting summaries?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Check what data is sent, who processes it, where it is processed, how long it is retained, whether it is used for training and how generated transcripts or summaries can be deleted.\"\n      }\n    }\n  ]\n}\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A video conferencing platform is not GDPR-compliant simply because a vendor describes it that way. Compliance depends on the specific processing activity: what personal data is processed, why it is needed, who receives it, where it is stored, how long it remains available and what controls are applied. The same platform can create different requirements [&hellip;]<\/p>\n","protected":false},"author":60,"featured_media":37608,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[32],"tags":[391,387],"class_list":["post-17494","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-reviews-comparisons","tag-healthcare","tag-video-conferencing","wpautop"],"_links":{"self":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/17494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/users\/60"}],"replies":[{"embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/comments?post=17494"}],"version-history":[{"count":78,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/17494\/revisions"}],"predecessor-version":[{"id":49405,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/17494\/revisions\/49405"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/media\/37608"}],"wp:attachment":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/media?parent=17494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/categories?post=17494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/tags?post=17494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}