GDPR Video Recording Consent Requirements

Before you start

GDPR applies when you record identifiable people in the European Economic Area, regardless of where your recording tool or storage provider is based. The legal basis may be consent, a contract, a legal obligation, or another lawful ground. Consent is only one possible basis, but when you choose it, it must be freely given, specific, informed, and unambiguous.

Consent requirements do not depend on a specific camera, microphone, recording format, or bitrate. They apply to any capture source that records identifiable individuals, including webcams, phone cameras, meeting software, and audio recorders. Check whether your recording happens locally or through a service, because that affects how you describe storage and access.

Review national laws and any workplace or institutional rules before recording. Some jurisdictions add stricter rules for employees, students, patients, or children. When your recording includes people other than yourself, do not rely on assumptions about implied consent.

Step-by-step instructions

1) Choose a lawful basis. Decide whether consent is the correct basis for your situation. If you are acting under a contract, legal duty, or another valid ground, do not ask for consent as a fallback.

2) Plan the recording scope. Identify the capture source, whether video only, audio only, or both, and limit the recording to what is necessary. Avoid recording areas or conversations that are not needed.

3) Prepare clear information. Explain who is recording, the purpose, what is captured, how long the recording is kept, who can access it, and how people can withdraw consent or request deletion.

4) Obtain consent before recording. Use a clear affirmative action such as a recorded verbal confirmation or a checkbox that is not pre-ticked. Silence, inactivity, or a general notice does not establish consent.

5) Configure the recording moment carefully. In video call software, use the built-in participant notification or recording indicator when available. In a room camera setup, use visible signage and a verbal announcement as supporting measures, not replacements for consent.

6) Store the recording securely. Keep access limited to people who need it. If the recording is processed through a service, check where the data is stored and whether the provider has a data processing agreement where required.

7) Record the evidence of consent. Save a dated note, log entry, or consent record showing what information was given and how the person agreed. For software meetings, keep the meeting time and the displayed recording notice where possible.

Check the output

Confirm that the recording contains only the people and areas covered by your consent or another valid basis. Check that audio and video are both present when both were expected, and that the recording format is one you can open and store securely.

Quality settings such as frame rate, bitrate, and encoding do not change your GDPR obligations. A compressed or low-bitrate recording is still personal data if individuals are identifiable. Verify that your output file does not inadvertently include more than intended, such as a screen share showing unrelated names or messages.

Common problems and next steps

If someone objects during the recording, stop the affected capture immediately and check whether you can continue without that person. A later request to withdraw consent means you should stop future processing based on consent and assess deletion or restriction under applicable rules.

Avoid using a blanket notice such as 'by attending you agree.' This usually fails the requirement for specific and informed consent. Use individual confirmation for each participant or clearly document the alternative lawful basis.

When the recording is made through a third-party video service, review the provider settings that control recording announcements, retention, and download access. Keep your own record of consent even if the provider also shows a notice.

For repeated recording, do not treat one consent as unlimited. Renew or update consent when the purpose, participants, storage, or capture method materially changes.