GDPR and Client Videos: Who Is Responsible for the Data?

GDPR applies to a screen recording as soon as it contains personal data: a face, a voice, a name, a customer list in an admin panel. For the videos your agency sends about its own work, you are usually the controller; when you record your client’s data while working for them, you are usually their processor. Either way, the tool that hosts your videos is a processor too, so you need a data processing agreement (DPA) with it, a record of what you do, and a limit on how long shared copies stay online.

Below, each of those in plain terms, with references to the GDPR text, then what to do in practice.

When a client video contains personal data

The GDPR defines personal data as “any information relating to an identified or identifiable natural person” (Article 4(1)). In a typical client video, that includes:

• You and your team. Your face in the camera bubble and your voice are enough to identify you.
• People on screen. Names in a CRM, customer emails in a shop admin, a colleague’s name in a Slack sidebar.
• People you talk about. “Marco from accounts asked for this change” is personal data in the audio and in the subtitles.

A video of a Figma prototype with placeholder text and no camera may contain none. Most real client videos contain some. That’s why our screen recording privacy checklist starts with keeping other people’s data out of the frame: data that isn’t in the video doesn’t need protecting.

Controller or processor: who is responsible

The GDPR splits responsibility between two roles:

• The controller “determines the purposes and means of the processing of personal data” (Article 4(7)). It decides why the data is processed and how.
• The processor “processes personal data on behalf of the controller” (Article 4(8)). It follows the controller’s instructions.

The European Data Protection Board’s guidelines on these concepts stress that the roles depend on what each party actually does in a specific situation, not on what a contract calls them. In client work, three situations come up again and again:

Situation	Controller	Processor
You send a video about your own work: a quote, a design review, a status update	Your agency	The video tool that hosts it
You record your client’s live admin, CRM or analytics to fix or explain something for them	Your client	Your agency, and the video tool as sub-processor
Your client records a bug report and sends it to you	Your client (for the recording)	Depends on what you do with it

Roles depend on the facts of each case. Not legal advice.

The second row matters most. If you process your client’s customer data as their processor, the GDPR says you can’t engage another processor, such as a video hosting service, “without prior specific or general written authorisation of the controller” (Article 28(2)). Your contract with the client should cover this, usually with a list of the tools you use.

What each role has to do

The two roles come with different duties. These are the ones that matter most for client videos:

Duty	Controller	Processor	GDPR
Decide why and how data is processed	✓	✗ follows documented instructions	Art. 4(7), 28(3)(a)
Choose the lawful basis	✓	✗	Art. 6
Answer people who exercise their rights	✓	~ helps the controller	Art. 28(3)(e)
Have a processing contract	✓ with each processor	✓ and with its own sub-processors	Art. 28(3), 28(4)
Bring in another processor	✓ authorizes it	~ only with written authorization	Art. 28(2)
Keep a record of processing	✓	✓	Art. 30(1), 30(2)
Take security measures	✓	✓	Art. 32
Report a data breach	✓ to the authority, within 72 hours where feasible	~ to the controller, without undue delay	Art. 33
Delete or return data when the work ends	Chooses which	✓	Art. 28(3)(g)

Simplified from the GDPR text on EUR-Lex. Not legal advice.

The lawful basis, in plain terms

Every processing needs one of the six lawful bases in Article 6(1). For client videos, three are relevant:

• Contract (Article 6(1)(b)): processing necessary to perform a contract with the person concerned. This fits a freelancer recording themselves for a client they have a contract with.
• Legitimate interests (Article 6(1)(f)): processing necessary for your legitimate interests, unless the person’s rights override them. Explaining your work to a client by video is a reasonable interest; showing third parties’ data that the viewer doesn’t need is harder to justify.
• Consent (Article 6(1)(a)): often the first thing people think of, and often the weakest. The EDPB’s consent guidelines explain that consent from employees is rarely freely given, because of the imbalance of power with the employer.

When you act as your client’s processor, the lawful basis is the client’s to determine: you follow their instructions.

The data processing agreement

Article 28(3) says processing by a processor “shall be governed by a contract or other legal act” that binds the processor to the controller. That contract has to cover, among other things, that the processor:

• acts only on the controller’s documented instructions, including for transfers outside the EU;
• ensures the people handling the data are bound by confidentiality;
• takes the security measures required by Article 32;
• uses sub-processors only under the conditions in Article 28;
• helps the controller respond to people exercising their rights;
• deletes or returns the data at the end of the service;
• makes available the information needed to demonstrate compliance, and allows audits.

In practice you’ll meet DPAs in two places. With your video tool, the vendor’s DPA covers the videos it hosts for you. Large vendors usually have a standard one: Atlassian’s, which covers Loom, applies automatically, as we describe in Loom and GDPR. With your client, if you act as their processor, they’ll often ask you to sign their DPA, or you can offer yours.

Records of processing activities

Article 30 asks each controller to keep “a record of processing activities under its responsibility”, and each processor to keep a record of the processing it carries out for controllers. The record lists, for example, the purposes, the categories of people and data, the recipients, transfers outside the EU, retention periods and security measures.

There is an exemption for organizations with fewer than 250 employees (Article 30(5)), but it doesn’t apply when the processing is not occasional, is likely to result in a risk, or includes special categories of data. Sending client videos every week is hard to call occasional, so for most agencies a short entry is the safe default. The EU has proposed simplifying this rule for smaller companies, and the EDPB and EDPS gave their opinion on that proposal in 2025, so check the current text before relying on the exemption.

An entry for client videos can be five lines: what you record, why, which tool stores the shared copies and where, who receives the links, and how long the copies stay online.

How long you can keep shared copies

The GDPR’s storage limitation principle says personal data should be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (Article 5(1)(e)).

For a feedback video, the purpose is done once the client has watched it and replied. Keeping it online for years doesn’t serve that purpose. Links that expire, or a retention rule that deletes old videos, put this principle into practice without anyone having to remember. We explain the day-to-day side in why expiring video links are safer.

Data in the EU vs transfers

Storing data inside the EU (or the wider European Economic Area) keeps you within the GDPR’s normal rules. Sending it to a country outside the EU is a transfer, and Chapter V of the GDPR allows it only under specific conditions (Article 44):

• an adequacy decision by the European Commission for that country (Article 45). For the United States, the Commission adopted one for the EU-U.S. Data Privacy Framework on 10 July 2023, which covers companies that participate in it;
• appropriate safeguards (Article 46), most often the standard contractual clauses adopted by the Commission.

So a US-based tool isn’t automatically ruled out, but you need to know which mechanism it relies on, and include it in your record. A tool that stores shared copies in the EU removes that step for the hosting itself. Check its subprocessors too: transcription and AI features are often where data leaves the region.

What an agency should do in practice

If you’re setting up a video workflow from scratch, our guide to async video for client communication covers the practical side, and our page on screen recording for agencies shows how JustRec fits a team.

Where JustRec fits

We built JustRec so that the GDPR part takes less work, not so that you can skip it. Your role and your record stay your job; a few of the steps above get shorter.