GDPR video compliance for WebRTC infrastructure
Short answer
GDPR applies to any video infrastructure processing personal data (image, voice, session metadata). Enterprise compliance relies on data residency (France hosting), a DPA, recording governance, and subprocessor transparency—not on technology choice alone.
What personal data does video process?
| Data | Example | Component |
|---|---|---|
| Image / voice | Video and audio streams | SFU, TURN |
| Identity | Name, email | Signaling, API |
| Metadata | IP, duration, quality | Logs |
| Recordings | Session replay | Storage |
Five GDPR pillars for video infrastructure
- Legal basis — documented purpose per use case (support, meetings, training).
- Data residency — SFU, TURN, recordings in France or EU.
- DPA — contract with your video provider as processor.
- Recording policy — retention, consent, access rights.
- Subprocessors — mapped chain, no uncontrolled third-country transit.
GDPR and infrastructure choice
| Criterion | Sovereign infrastructure | Proprietary US SaaS |
|---|---|---|
| Residency | Controlled (France/on-prem) | Often US |
| DPA | Negotiable | Vendor standard |
| Subprocessors | Documentable | Opaque |
| Recordings | Configurable storage | Vendor-imposed |
| Audit | Possible (open source) | Limited |
Common GDPR pitfalls in real-time video
- “Web page in France” but TURN in the US;
- Recordings enabled by default without notice;
- Logs kept indefinitely;
- Subprocessors not listed in the DPA;
- Transfers to analytics APIs without safeguards.
DPO checklist (10 points)
Before validating video infrastructure, the DPO can verify:
- Processing register: documented video purpose (support, training, meeting…);
- Legal basis: legitimate interest, contract or consent as appropriate;
- Minimization: recording disabled by default if not required;
- Notice: banner or notice before image/voice capture;
- Residency: SFU, TURN, storage in France/EU;
- DPA: art. 28 signed, location and subprocessors listed;
- Retention: replays, logs, metrics with erasure date;
- Data subject rights: access and erasure procedure for recordings;
- Security: transit (DTLS-SRTP) and rest encryption, access control;
- Transfers: no flow to third countries without safeguards (SCC, BCR).
→ Detailed checklist: video conferencing and GDPR
Processing register and subprocessors
For video, the register (art. 30) typically mentions:
- Controller: the client company;
- Processor: the business video platform vendor;
- Sub-processors: cloud host, CDN, monitoring, backup;
- Data categories: identity, image, voice, session metadata;
- Recipients: authorized support agents, trainers, moderators;
- Transfers: none outside EU or explicit safeguards.
The DPO validates the full mapping, not just the contract with the main vendor.
FAQ
Does GDPR forbid cloud video?
No. It requires lawful basis, transparency, and appropriate safeguards—including residency and DPA when using a provider.
Are browser-based sessions GDPR-friendly?
WebRTC in the browser can be compliant when hosting, logging, and retention are designed with your DPO. See WebRTC infrastructure.
Can we host video in France only?
Yes. Leagora supports France cloud and on-prem deployments; contractual commitments are defined during scoping.
Key takeaways
- Video processes personal data by default: treat infrastructure as a GDPR project.
- Residency, DPA, and recording rules are the main enterprise levers.
- Pair GDPR hub content with France hosting and video API pages when scoping architecture.
Next step
Request a quote to align video infrastructure with your DPO requirements.