Guide

A woman puts sticky notes on a wall while her team watches

GDPR-Compliant Video Conferencing

The contract, the data location and the lawful basis.

No video tool makes you GDPR compliant by itself. Article 28 of the GDPR says you may use only processors that give sufficient guarantees, under a contract. So choose a tool that signs a data processing agreement (DPA), keeps your data in the EU or moves it under Standard Contractual Clauses, and have a lawful basis before you record. Jitsi Meet, Whereby, Zoom, Google Meet and Microsoft 365 each offer a way to do this.

Checked 12 November 2026 on each provider's own pages and on the GDPR text.

What to check before you choose

• The provider signs a data processing agreement. Article 28(3) says processing by a processor must be governed by a contract
• Data that leaves the EEA has a legal route, such as the Standard Contractual Clauses in Article 46(2)(c)
• An admin sets the data region before the first recording, where the plan allows it
• Each recording has a lawful basis under Article 6, such as consent or legitimate interests

Options for GDPR-compliant video calls

Tool	Where the data stays	Contract and transfers
Jitsi Meet	On your own server. You host it, so you choose where it runs	Open source, under the Apache 2.0 license
Whereby	Users in Europe connect to a data center in the EEA. Data is stored in Ireland or another place in the EU/EEA	Founded in Norway. Its DPA is written for Article 28(3)
Zoom	The US by default. On Pro and higher, admins choose data centers for meeting traffic and a storage country, such as Germany, for cloud recordings. Account data stays in the US	DPA in its terms, Standard Contractual Clauses, and the EU-US Data Privacy Framework
Google Meet	Data regions: on Business Standard, Business Plus, Enterprise Standard, Enterprise Plus and Frontline editions, admins can keep data at rest in Europe. Meet recordings and transcripts are covered	Google's Cloud Data Processing Addendum
Microsoft 365	The EU Data Boundary, for customers with a sign-up location in the EU or EFTA	The covered services are named in Microsoft's Product Terms

Is Zoom GDPR compliant?

Zoom puts a Data Processing Addendum in its terms, uses Standard Contractual Clauses for data that leaves the EEA, and takes part in the EU-US Data Privacy Framework. It stores customer content in the US by default. Paid accounts can choose Germany or another listed country for cloud recordings, but account data stays in the US.

Is Google Meet GDPR compliant?

Google offers a Cloud Data Processing Addendum for Workspace. On supported editions, an admin can set the data region to Europe, and Meet recordings, transcripts and attendance reports are covered. Fundamental data regions cover data at rest only, not data in use.

Which video conferencing tool keeps data in the EU?

Whereby stores data in Ireland or another place in the EU/EEA. Jitsi Meet keeps data on the server you run. Zoom and Google offer European storage on some plans, and Microsoft 365 has the EU Data Boundary for customers in the EU and EFTA.

Do I need consent to record a video call?

You need a lawful basis under Article 6 of the GDPR. Consent is one basis. Legitimate interests is another. Tell people before you record.