There’s no screen recorder you can buy that makes you GDPR compliant by itself: compliance depends on what you record, who you send it to and how long it stays online. What a GDPR compliant screen recorder can do is make the right choices easy. JustRec keeps your library on your Mac, stores only the videos you share on servers in the EU, and deletes them when the link expires.
This page explains what’s at stake in a screen recording, who is responsible for it, and exactly what JustRec does. It isn’t released yet: join the waitlist to get it at launch.
What personal data a screen recording contains
The GDPR defines personal data as “any information relating to an identified or identifiable natural person” (Article 4(1)). A few minutes of screen recording usually contains plenty of it:
- Your own face and voice, from the camera bubble and the microphone.
- What’s on screen: a client’s CMS with real orders, a CRM with names and email addresses, an analytics dashboard.
- What you didn’t mean to show: a notification, your inbox for a second, a tab with another client’s project.
- What you say: names, prices, details about a person. If the video has subtitles, the transcript holds the same information as text.
Most of that is harmless in a video the right person watches this week. The risk grows with every copy of the video that stays online, and with every place it gets sent. Our screen recording privacy checklist covers what to hide before you press record.
Who is responsible: controller and processor
The GDPR splits responsibility between two roles:
- The controller is the person or organization that “determines the purposes and means of the processing of personal data” (Article 4(7)).
- The processor “processes personal data on behalf of the controller” (Article 4(8)).
For the videos you record and send, your agency decides what to record, why, and who receives it. For that processing you’re normally the controller, and the company that stores and serves the shared copies is your processor.
When the recording shows data that belongs to your client’s customers, the chain gets longer: your client may be the controller, your agency the processor, and the tool provider a sub-processor. We go through these cases in GDPR and client videos: who is responsible for the data.
Two consequences matter when you choose a tool. Article 28(1) says the controller “shall use only processors providing sufficient guarantees” of appropriate technical and organisational measures. And Article 28(3) says processing by a processor “shall be governed by a contract or other legal act”, which in practice is a data processing agreement (DPA).
What to look for in a GDPR compliant screen recorder
Whatever tool you use, these are the questions worth asking before your first client video:
| Question | Why it matters |
|---|---|
| Where are recordings stored, and where are shared copies hosted? | You need to know where the data is and who holds it |
| What goes online: every recording, or only what you share? | Data minimisation: no more data than necessary, Article 5(1)(c) |
| How long do shared copies stay online? | Storage limitation: no longer than necessary, Article 5(1)(e) |
| Where are subtitles and transcripts made? | A cloud transcription service is one more party that receives your voice |
| Does the video page set cookies or track viewers? | Tracking your client’s visit means processing more personal data |
| Can you withdraw a link straight away? | Links get sent to the wrong person |
| Is there a DPA? | Article 28(3) expects a contract with your processor |
For a closer look at a specific vendor, our article on Loom and GDPR shows how to check these points on a cloud recorder’s own documentation.
The choices we made in JustRec
We built JustRec at Nube, a web studio in Italy, for our own client work. These are the choices we made:
The library stays on your Mac
Every recording is saved locally, in Movies/JustRec by default. There is no cloud library.
Only shared videos go online
A copy is uploaded when you share a video. Recordings you don't share stay on your Mac.
Stored in the EU
Shared copies are stored on servers in the European Union.
Deleted when the link expires
After 3 days on Lifetime, 30 days on Personal and Team. You can withdraw a link earlier.
Subtitles made on the Mac
The speech-to-text model runs locally. Your voice is never sent to an external AI.
No tracking on the video page
No cookies, no analytics, no account for your client. They watch, and that's all.
A data processing agreement for agencies will be available.
When a link expires, the page tells the viewer the video is no longer available and asks them to request a new one. The original stays on your Mac, so sharing it again takes a click. We explain why links expire in why expiring video links are safer than a permanent library, and why the library stays local in local-first screen recording.
What stays your responsibility
A tool can limit how much data goes online and for how long. It can’t decide what you record or who you send it to. Anyone with an active link can watch the video, so a few habits still matter:
Before you share a client video
- Close inboxes, chat apps and other clients’ tabs, and turn on Do Not Disturb.
- Use demo data instead of real customer records when you can.
- Send the link to the person who needs it, not to a group chat.
- Withdraw the link if it went to the wrong place.
- Check whether your privacy notice and records of processing should mention client videos.
Subtitles deserve a thought too: on-device vs cloud transcription explains where your voice goes with each approach.
Why we don’t say “GDPR certified”
You’ll find screen recorders that call themselves GDPR compliant or certified. We prefer to tell you what JustRec does and let you decide, because the GDPR applies to how data is processed, and that includes your part: what you record, who you send it to, and what you tell your clients. If you’re comparing JustRec with a cloud recorder, the Loom alternative page sets out the differences.
Sources
- Regulation (EU) 2016/679 (GDPR): Article 4(1), 4(7) and 4(8) definitions; Article 5(1)(c) and (e) principles; Article 28 processor, EUR-Lex, checked November 2026.
Frequently asked questions
Is JustRec GDPR compliant?
Compliance depends on how a tool is used, so we don't put that label on JustRec. What we can say is what it does: recordings stay on your Mac, shared copies are stored in the EU and deleted when the link expires, subtitles are made on the Mac and the video page has no cookies or tracking.
Where are shared videos stored?
On servers in the European Union, only until the link expires: 3 days on Lifetime, 30 days on Personal and Team. The original stays in the library on your Mac.
Will there be a data processing agreement?
Yes, a data processing agreement for agencies will be available.
Is my voice sent to an AI service for subtitles?
No. The speech-to-text model is downloaded once and runs on your Mac, so your voice is never sent to an external AI.
Does the video page track my clients?
No. The page your client opens has no cookies, no analytics and no tracking, and they don't need an account to watch.
Who is the controller for a client video?
Usually the agency or freelancer who decides what to record and why, with the tool provider acting as a processor. If the recording shows your client's customer data, your client may be the controller and you the processor.