GDPR-compliant video conferencing (2026): what it actually takes (and a Zoom alternative that translates)

"GDPR-compliant" on a video platform's homepage is close to content-free. GDPR is not a certification you pass — it's a set of obligations on you, the data controller, that a vendor either helps you meet or quietly leaves on your desk. The useful question isn't "is this tool GDPR-compliant?" It's "what does this tool make me responsible for, and where does my meeting data actually go?"

🔒 Update — we did this to ourselves. Since this post went up, we ran InterMIND's own codebase through the full checklist below and closed every item — erasure, retention, EU runtime, sub-processors — verified against the code, not asserted on a page. → Read the audit close-out, line by line.

This post is the plain-terms version of that question: the checklist a DPO actually works through, where Zoom sits on it (fairly — it's more compliant-capable than the internet implies), and where an EU-runtime alternative changes the answer. If you want the broader "how should real-time meetings work" frame, that's the pillar guide; this one is specifically about the data-protection layer.

The plain-terms checklist

Strip the marketing and "GDPR-compliant video conferencing" comes down to seven things you can actually verify:

1. A signed DPA. A Data Processing Addendum that names the vendor as your processor, with documented purposes and instructions. No DPA, no lawful processing — full stop.
2. A real sub-processor list. Every third party that touches meeting data — transcription, storage, email, analytics, AI features — named, with what they do and where they're domiciled.
3. Where data is processed at runtime. The physical region your audio, transcripts, recordings, and metadata are handled in. This is what most data-residency clauses are actually about.
4. The international-transfer mechanism. If any data leaves the EEA, on what legal basis? Standard Contractual Clauses (SCCs), adequacy, or a residency setup that avoids the transfer entirely. This is the Schrems II question, and it doesn't go away because a homepage says "compliant."
5. Security posture you can audit. ISO 27001, ISO 27701, SOC 2 — independent attestations, not self-assertions.
6. Data-subject rights tooling. Can you actually fulfil access, deletion, and portability requests for meeting data, or only in theory?
7. Retention and deletion you control. Recordings, transcripts, and AI summaries deleted on your schedule, not the vendor's default.

A tool is "GDPR-compliant" for your purposes only when all seven have concrete answers. Most homepages answer zero of them.

Where Zoom actually stands (fairly)

Zoom is more GDPR-capable than its reputation suggests, and it's worth being accurate about that rather than scoring cheap points:

• It publishes a global DPA with the 2021 EU Standard Contractual Clauses built in.
• It offers EU Data Residency — "Zoom EU Infrastructure" — for Enterprise and Education customers, covering Meetings, Webinar, Chat, Phone, and Contact Center.
• It holds ISO 27001 and, as of February 2026, ISO 27701 (the privacy-management extension), plus published EU public-sector sovereignty controls.

So a properly configured Zoom deployment, on the right tier, can satisfy most of the checklist. The honest caveats are about defaults and domicile, not capability:

• EU residency is a tier-and-config add-on, not the default. It's on Enterprise/Education and has to be turned on. The free and lower paid tiers don't get it. "We use Zoom" and "we use Zoom configured for EU residency" are different procurement facts.
• Zoom is a US-domiciled company. Even with SCCs and EU residency, the vendor's corporate domicile is in scope for CLOUD-Act and sovereignty-grade evaluations. For standard GDPR this is manageable with SCCs; for French souveraineté numérique or SecNumCloud-grade procurement, corporate domicile is itself a criterion, and that's a harder conversation.
• The meeting still happens in one language. Zoom's translated captions and AI Companion help, but the room doesn't become genuinely multilingual — every participant hearing the meeting live in their own language. If your compliance problem is also a language problem (cross-border audits, multi-site CAPA reviews), that gap is unsolved regardless of where the data lives.

The short version: Zoom can be GDPR-compliant when configured for it. Whether that's sufficient depends on how sovereignty-sensitive your buyer is — and whether the meetings are multilingual.

The EU-runtime alternative

We built InterMIND so the data-residency answer is the default, not a configuration project — and so the meeting can actually be multilingual. On the checklist above, the part that's structural rather than promised is where the meeting runs. As verified against the live deployment:

• Every runtime hop is in the EU. App and server APIs on Vercel in Frankfurt (fra1); the meeting WebSocket server on Fly in Paris (cdg); application data in Neon Postgres on AWS Frankfurt (eu-central-1); recordings on Tigris, EU-pinnable; error/analytics on Sentry EU and PostHog EU; transactional email via Resend in Ireland.
• The translation engine is our own code, in France (OVH) — not a US general-purpose model we resell. The single biggest flow of meeting content stays EU-resident and never touches a third-party LLM. Document translation goes to DeepL in Cologne — also an EU company.
• The sub-processor list with corporate-domicile detail ships with the DPA as standard practice, not on request.

No meeting content reaches a US-domiciled model. Everything derived from a meeting that needs a language model stays on EU processors: the post-meeting AI digest (topics, decisions, action items) runs on EU-hosted Mistral with zero-data-retention; the post-meeting summary and the AI note-editor translate through our own EU engine, and the editor's generative actions (fix, extend, simplify) run on the same EU Mistral. The one place a US model is still in the loop touches no meeting data: our public translation-quality benchmark judges machine translations of FLORES-200 reference sentences — a fixed public dataset, not anyone's call. The full vendor-by-vendor map is in Where one InterMIND meeting actually runs, and the build-vs-buy view is in What one InterMIND meeting is built from.

One thing we don't claim: we are not going to wave an ISO certificate we don't yet hold. Our answer to the checklist is architectural — EU runtime, own engine, transparent sub-processors, a real DPA — and we'd rather you verify that than trust a badge. Certifications are on the roadmap; the runtime is real today. We ran our own codebase through this exact checklist and closed each item against the code — the close-out report, line by line.

And the part Zoom's residency settings can't add: the meeting is multilingual by design — every participant live in their own language across 23 languages, voice and chat and notes, with translation quality published openly instead of asserted. How that works is in the pillar guide; the regulated-meeting use case is in multilingual compliance meetings.

The checklist as a table

The seven items against the two tools this post discusses in detail. Cells state only what each vendor documents (Zoom links in Sources below; InterMIND claims verified line-by-line in the audit close-out and the runtime map) — for any other vendor, make them answer the left column in writing.

FAQ

Is Zoom GDPR compliant? It can be, on the right tier and configuration: Zoom publishes a global DPA with the 2021 EU SCCs, offers EU Data Residency for Enterprise and Education customers, and holds ISO 27001 and (since February 2026) ISO 27701. The honest caveats: EU residency is a tier-and-config add-on rather than the default, and Zoom remains a US-domiciled company — manageable under standard GDPR with SCCs, but a real criterion in sovereignty-grade procurement.

What makes a video conferencing tool GDPR compliant? Seven verifiable things, not a homepage badge: a signed DPA, a real sub-processor list, a documented runtime region, a lawful international-transfer mechanism, independently audited security, working data-subject-rights tooling, and retention you control. A vendor is compliant for your purposes when all seven have concrete answers in writing.

Does GDPR require video meetings to stay in the EU? No — GDPR requires a lawful transfer mechanism (SCCs, adequacy) when data leaves the EEA, not residency as such. Residency matters because it removes the transfer question entirely — the post-Schrems II analysis gets short when the data never leaves. That's the difference between "compliant with paperwork" and "nothing to paper over."

Which video conferencing tools run entirely in the EU? Ask any vendor for their runtime map: region per hop — app, APIs, meeting media, database, recordings, analytics, email, AI features. InterMIND publishes exactly that (every hop, vendor by vendor): Vercel Frankfurt, Fly Paris, Neon Frankfurt, translation engine on OVH France, digest on EU-hosted Mistral with zero retention. Whatever tool you evaluate, the map — not the marketing page — is the answer.

Which buyer is this for

• German Mittelstand and regulated EU teams running standard GDPR DPAs: an EU-at-every-hop runtime answers the residency question directly, without a tier upgrade or a residency project. The transfer-mechanism conversation gets a lot shorter when the data doesn't leave.
• French public-sector and souveraineté-grade procurement, where vendor corporate domicile is itself part of the spec: that's a deeper conversation about deployment topology, and one we'll have honestly rather than oversell.
• US-domestic and APAC buyers: residency usually isn't the constraint — latency from your region is. Different problem; tell us and we'll plan for it.

Try it, then read the data map

• Try the live demo — hear the live, multilingual pipeline on a real meeting and hear what "EU-runtime and multilingual" actually feels like. No signup needed.
• InterMIND vs. Zoom — feature-by-feature, honestly.
• Where one InterMIND meeting actually runs — the full vendor map, gap included.

"GDPR-compliant video conferencing" is a checklist, not a badge. Whichever tool you pick — ours or another — make the vendor answer all seven questions in writing. The ones that can are worth your time; the ones that can't are selling you a homepage.

— The Mind.com Team

Sources on Zoom: Zoom — GDPR, Zoom — EU Data Residency / privacy in Europe, Zoom — ISO 27701, checked August 2026. Vendor offerings and tiers change; verify the current configuration against Zoom's trust pages. InterMIND runtime facts are verified against the live deployment as described in the linked data-map post.