Video is personal data under the GDPR whenever a person in it can be identified, so a dataset of real work needs a legal basis such as consent, a clear purpose, the removal of bystanders and only the data the purpose needs. A privacy-first workflow plans this before recording.
This article is general information, not legal advice. It summarises the parts of the General Data Protection Regulation (Regulation (EU) 2016/679), as published in the Official Journal (OJ L 119, 4.5.2016) and checked on EUR-Lex on 17 October 2026, that matter for real-world video datasets, such as first-person video of hands-on work for robot learning, the subject of Egocentric video for robot learning. The GDPR has numbered articles, which are binding. A recital is one of the numbered explanatory paragraphs at the start of the regulation; it is not binding but guides how the articles are read.
When is video personal data?
Video is personal data when a person in it is identified or can be identified. The GDPR defines personal data in Article 4(1) as any information relating to an identified or identifiable natural person, and an identifiable person is one who can be identified directly or indirectly, for example by a name, an identification number, location data or factors specific to their physical identity.
Much more than a face can identify someone in a video: a voice, a name badge or screen in the picture, a recognisable workplace, or several recordings of the same person taken together.
In first-person video, the wearer is rarely seen but can still be identified by hands, voice and place, and colleagues appear in front of the lens.
Who is responsible for the footage?
The controller is responsible. Article 4(7) defines the controller as the person or organisation that, alone or jointly with others, determines the purposes and means of the processing; a processor, under Article 4(8), processes personal data on behalf of a controller. Where two or more organisations decide the purposes and means together, Article 26 makes them joint controllers, who must agree their responsibilities in an arrangement.
Which role each party has depends on who decides what is recorded and why, not on job titles.
| Party | Often | Typical duties to settle |
|---|---|---|
| Data company that designs the dataset | Controller | Legal basis, consent form, information to contributors, retention |
| Recording partner filming on instructions | Processor, under a contract (Article 28) | Recording and review as instructed, security |
| Business whose staff are filmed | Possibly a joint controller, if it decides purposes too | Informing staff and bystanders, answering requests |
| Buyer that trains on the delivered footage | A controller for its own use | Use within the licence, deletion when asked |
Illustrative example of common set-ups; the real roles depend on the contracts and the facts, and are a question for legal advice.
What legal basis does recording need, and how does consent work?
Recording people needs a legal basis under Article 6 of the GDPR, and consent works only when it is freely given, specific, informed, unambiguous, provable and easy to withdraw. Article 6(1) lists six bases without ranking them; consent, in Article 6(1)(a), is a common one for recording people on purpose for a dataset, and the one this article follows.
Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes. Article 7 adds conditions:
- The controller must be able to show consent (Article 7(1)), for example with written consent linked to each recording.
- The request must be clear (Article 7(2)): if consent is given in a written declaration that also covers other matters, the request must be clearly distinguishable from them, in an intelligible and easily accessible form, using clear and plain language.
- Withdrawal must be easy (Article 7(3)): the person can withdraw at any time, it must be as easy to withdraw as to give consent, and withdrawal does not make earlier processing unlawful.
Article 13 lists what the person must be told when the data is collected. A consent form can cover its main points:
| Item on the form | Article 13 |
|---|---|
| Who collects the footage, and how to contact them | 13(1)(a) |
| The data protection officer, if any | 13(1)(b) |
| The purpose and the legal basis | 13(1)(c) |
| Who receives the footage, such as buyers | 13(1)(e) |
| Transfers outside the EEA and their safeguards | 13(1)(f) |
| How long the footage is kept | 13(2)(a) |
| The person's rights, such as access and erasure | 13(2)(b) |
| The right to withdraw consent at any time | 13(2)(c) |
| The right to complain to a supervisory authority | 13(2)(d) |
Can employees consent to being filmed at work?
Employees can consent to being filmed at work only if they have a real choice, which is hard because the employer has power over them. Recital 42 says consent should not be regarded as freely given if the person has no genuine or free choice or cannot refuse or withdraw without detriment, and Recital 43 warns against relying on consent where there is a clear imbalance between the person and the controller.
The European Data Protection Board goes further in its Guidelines 05/2020 on consent (version 1.1): it considers consent from employees to their employer problematic, and unlikely to be freely given for workplace camera observation. It accepts it only in exceptional circumstances, when giving or refusing consent has no adverse consequences at all. Its example: staff who do not want to be filmed get equivalent desks elsewhere during the filming.
Staff consent is easier to defend when refusal costs nothing, the form sits outside the employment contract, the employer does not see who refused, and refusers are not filmed.
Article 88 also lets Member States set more specific rules for employee data in the employment context, by law or collective agreement. Whether consent is enough, or another legal basis is needed, is a question for legal advice in the country concerned.
Are faces biometric data?
Faces in video are not automatically biometric data. Article 4(14) defines biometric data as personal data resulting from specific technical processing that allows or confirms the unique identification of a person, such as facial images, and Recital 51 adds that photographs are covered by the definition of biometric data only when processed through a specific technical means allowing unique identification or authentication.
The difference between video and biometric data matters because Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a person, unless an exception applies, such as explicit consent under Article 9(2)(a). Running face recognition on footage to identify people would bring in these stricter rules. Detecting faces only to blur them is not aimed at identifying anyone, which is the purpose Article 9(1) names.
Biometrics are not the only special category in Article 9(1). It also lists data concerning health and data revealing religious beliefs or ethnic origin, among others, and video can show signs of them, such as an injury, a disability or religious clothing. Framing the camera on the hands and the work, rather than on people, reduces such details in the picture; whether incidental footage counts is a question for legal advice.
How should bystanders be handled?
Bystanders need a legal basis of their own, because recording a bystander, even briefly before blurring, is processing of their personal data. A bystander is a person who appears in the footage but was not recorded on purpose and has not consented.
The basis usually considered for incidental capture is legitimate interests under Article 6(1)(f): processing necessary for the legitimate interests of the controller or a third party, except where the person's interests or fundamental rights override them. That requires a balancing test, and Recital 47 points to the person's reasonable expectations.
Filming counts as collecting data from the person filmed (Court of Justice, C-422/24, 18 December 2025), so Article 13 applies, not Article 14, and Article 13 has no exemption for disproportionate effort. Bystanders must be informed at the time, usually through a visible notice on site that links to the full information. Both points are for legal advice on the specific project.
Removal should happen before the footage leaves the collector. A buyer should never receive raw footage with bystanders in it.
What do data minimisation and purpose limitation mean for video?
Data minimisation and purpose limitation mean recording only what the stated purpose needs and using it only for that. Article 5(1)(b) requires data to be collected for specified, explicit and legitimate purposes, and Article 5(1)(c) requires it to be adequate, relevant and limited to what is necessary.
For a video dataset, that means a written purpose in the consent form, recording the task rather than the whole shift, and no audio unless the purpose needs it. Article 25 adds data protection by design: measures such as pseudonymisation that put principles such as data minimisation into effect.
A data protection impact assessment is a documented assessment of the risks of the processing and of the measures to address them. Article 35 requires one, before processing starts, where processing, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms. Filming a workforce for a dataset is worth checking against it.
What is the difference between anonymisation and pseudonymisation?
Pseudonymised data can still be linked to a person with additional information, and anonymous data cannot be linked to anyone by any means reasonably likely to be used; only anonymous data falls outside the GDPR. Recital 26 sets out the difference.
Article 4(5) defines pseudonymisation as processing personal data so that it can no longer be attributed to a specific person without the use of additional information, kept separately. Replacing a contributor's name with an ID, with the key stored elsewhere, is pseudonymisation.
Recital 26 says that pseudonymised data should be considered information on an identifiable person, and that identifiability depends on all the means reasonably likely to be used, such as singling out. In 2025 the Court of Justice added a nuance in EDPS v SRB (C-413/23 P), under the parallel regulation for EU institutions: pseudonymised data is not necessarily personal data in all cases and for every person, so a recipient who has no means of re-identification may be in a different position from the collector who holds the key.
That nuance rarely helps with video: a blurred face can still leave the voice, the clothes and the place, so the honest assumption is that the footage remains personal data, for the collector and for the buyer.
How long can footage be kept, and how is it deleted?
Footage can be kept only as long as the purpose needs it, and a deletion plan should reach every copy, including delivered ones. Article 5(1)(e) requires personal data to be kept in a form that permits identification for no longer than is necessary.
Illustrative example. A retention schedule for a recording project:
| Data | Example period | Deleted by |
|---|---|---|
| Raw footage | Until review and de-identification are complete, at most 3 months | Collector |
| Reviewed footage | For the licence term agreed with the buyer | Collector and buyer |
| Consent records | As long as any footage of the person exists, plus the period needed to show consent | Collector |
| Buyer's copies | Until the licence ends, or earlier on a deletion notice | Buyer |
When a contributor withdraws consent and asks for erasure under Article 17, the recording has to be found and deleted. Article 19 requires the controller to tell each recipient of the data about the erasure, unless this proves impossible or involves disproportionate effort, so a licence should oblige buyers to delete withdrawn recordings when notified and to exclude them from future training runs. What happens to models already trained on the footage is a question for legal advice.
What about transfers outside the European Economic Area?
Transfers of personal data outside the European Economic Area are allowed only under the conditions of Chapter V of the GDPR (Article 44).
For a buyer outside the European Economic Area, the transfer has to be settled in the contract before delivery; the details depend on the country and the safeguards, and are a question for legal advice.
What rights do contributors have?
Contributors, the people recorded on purpose, keep the rights to information (Article 13), to withdraw consent at any time (Article 7(3)), to access their data (Article 15) and to have it erased (Article 17). Linking every recording to a consent record, kept separately from the footage, makes these rights workable.
What does a privacy-first recording workflow look like?
A privacy-first workflow puts a privacy check into every step:
- Roles and basis: the controller, the legal basis for contributors and bystanders, and whether an impact assessment is needed.
- Consent form: written and specific, covering the Article 13 points.
- Briefing and notice: tell the contributor and everyone nearby, and put up a notice on site.
- Recording rules: only the agreed tasks, others out of frame where possible, no screens or documents.
- Review and removal: blur or remove the faces and personal data of anyone who did not consent, and log it.
- Delivery: reviewed footage only, consent references kept separately, under a licence with the permitted use, the retention period and the duty to delete on notice.
Illustrative example. A contributor in a commercial kitchen records three tasks. A colleague walks through the frame; their face and name badge are blurred and their voice is removed in review, and the removal is logged.
When the contributor later withdraws consent, the consent record points to the three recordings; the collector deletes them, and the buyer, notified under the licence, deletes its copies.
Vencur Motion is in its pilot phase. Everyone recorded on purpose gives written consent, and faces and personal data of anyone else are removed before delivery.
See Record your work for Vencur, the privacy policy and Vencur Motion. For what makes the footage useful once privacy is handled, see What makes robot training video useful?.
This article is general information, not legal advice. Regulation (EU) 2016/679, OJ L 119, 4.5.2016, current consolidated version dated 4 May 2016, checked on EUR-Lex on 17 October 2026.