TL;DR — Recording short video messages from employees can be done in a way that is generally consistent with GDPR, but it depends on your lawful basis, how clearly you explain the purpose, and what happens to the footage afterwards. This checklist walks through the questions to ask before you launch a campaign, not a guarantee of compliance.
- Consent is usually the right lawful basis for voluntary video messages, but it has to be freely given — an unequal power dynamic (like manager to direct report) needs extra care.
- Tell people what the video is for, who will see it, and how long it will be kept, before they record anything.
- Build in an easy way for someone to withdraw a clip after the fact, not just before recording.
- Retention and onward sharing are where most real-world problems come from, not the recording itself.
On this page
Start here: this is a checklist, not legal advice
This is general information, not legal advice. Rules vary by country and change over time — check current guidance from your relevant regulator (for UK/EU readers, the ICO or EDPB) and talk to a qualified privacy or employment professional before relying on this for a live campaign.
What follows is a set of practical questions worth working through before you ask colleagues to record a video message — for a leaving campaign, an onboarding welcome reel, an internal shout-out, or anything similar. None of it replaces reading current guidance from a regulator like the ICO or EDPB, or asking your own HR or legal team, particularly if the video will be used outside your organisation or involves anyone in a vulnerable position.
Why employee video raises different questions than customer video
Video of a colleague's face and voice is personal data under GDPR, the same as an email address or a photo. Collecting it at work adds a wrinkle that customer-facing video usually doesn't have: the relationship between employer and employee is not a relationship of equals. A request from a manager can carry an implicit pressure to comply even when it is framed as optional, and regulators have generally taken the view that consent given under that kind of pressure may not count as freely given.
None of this means employee video is off the table. It means the basis you rely on, and how you frame the request, matters more than it would for, say, a customer testimonial.
Choosing a lawful basis: a simple decision tree
GDPR requires a lawful basis for processing personal data, and for a voluntary video message most organisations lean on one of two bases. Work through these questions in order:
- Is the recording genuinely optional, with no real consequence for declining? If yes, consent is likely workable — but document that it was offered as optional and make opting out easy and visible.
- Is there any chance someone could feel they have to participate (a direct request from their manager, a team-wide expectation, a public sign-up sheet)? If so, consider whether legitimate interests is a better fit than consent, since consent obtained under subtle pressure may not hold up if challenged — and if you do rely on legitimate interests, you generally need to carry out and be able to show a balancing assessment against the individual's rights.
- Will the footage ever be used for anything beyond the original internal purpose — a public careers page, a LinkedIn post, a recruitment ad? If yes, treat that as a separate processing purpose that needs its own basis and its own explanation to the person involved, rather than assuming the original consent covers it.
- Does the recording include anyone outside your own organisation (a client, a visiting contractor)? If so, check whether your existing employee-facing privacy notice even covers them, since it generally won't.
The practical checklist
Before you send the link to record, it is worth checking off the following. None of these are exotic requirements — most are a few sentences in the message you send out.
- Have you told people, in plain language, what the video is for and roughly how it will be used?
- Have you said who will be able to see the finished video — just the team, the whole company, or anyone outside it?
- Is it clear that recording is optional, and does declining actually carry no consequence?
- Do you have a named person or inbox someone can contact with questions, or to ask for their clip to be removed?
- Have you set, and communicated, how long the footage will be kept before it is deleted?
- If the video might later be reused for a different purpose (marketing, recruitment), is that flagged up front rather than decided after the fact?
- If anyone recording is based outside the country your organisation is in, have you checked whether a different or additional local rule applies?
- Do you have a simple process for someone to withdraw a clip after submitting it, not just before?
What tends to go wrong in practice
The recording step itself is rarely where problems start. The two places that generate the most friction after the fact are reuse and retention: a farewell video that gets posted publicly months later without the departed colleague being asked again, or footage that sits in a shared drive long after anyone remembers why. See How Long Should You Keep Employee Video? for a fuller look at retention specifically.
A second common issue is scope creep in who can see the video. A clip recorded "for the team" that later gets shared in an all-hands meeting, or externally, without the contributor being told in advance, is the kind of thing that generates genuine and reasonable complaints — even when nobody involved meant any harm by it.
Putting it together: a short internal policy you can adapt
Many teams find it easier to write a short, standing paragraph they can reuse for every video campaign rather than drafting consent language from scratch each time. A starting point, to adapt to your own organisation and check against current guidance: state the purpose, state who sees it, state the retention period, name a contact, and state plainly that participation is optional. The consent form template has a fuller version of this you can copy directly.
How to do this in Whoosh
Whoosh doesn't make the legal call for you, but the workflow is built to make good practice the easy option: you can add your own purpose statement and consent wording to a campaign before the link goes out, set a retention reminder for yourself, and review every clip before it's compiled or shared anywhere beyond the original campaign.
- 1.Decide your lawful basis and write a one-paragraph purpose statement before creating the campaign.
- 2.Add that statement to the campaign so every contributor sees it before they record.
- 3.Set a reminder for your chosen retention period rather than leaving footage indefinitely.
- 4.Review clips before compiling, and check with anyone whose clip you want to reuse outside the original purpose.
- 5.Keep a simple log of who asked for a clip to be removed and when, in case you need to show it later.
Frequently asked questions
Do I need written consent for every employee video?
Not necessarily — it depends on which lawful basis you're relying on and how your organisation documents consent generally. In many cases a clear statement at the point of recording, with a record that it was shown, is treated as sufficient, but check current guidance and your own company policy.
Can we reuse an old farewell video for recruitment marketing?
Generally not without going back to the people in it, since that is a new and different purpose from the one they originally agreed to. Ask again before reusing footage outside its original context.
What if someone wants their clip removed after the video has already been shared?
Have a process ready for this before you need it — a named contact, and a realistic plan for pulling a clip from a compiled reel even if that means re-editing. The ability to withdraw is part of being able to say consent was freely given in the first place.
Does this apply to short clips recorded for internal use only?
Yes — personal data rules generally apply regardless of audience size or whether the video ever leaves the company, though the risk and the practical stakes are usually lower for something seen only by a small internal team.
Is a verbal "yes, that's fine" enough, or do we need something in writing?
Many organisations prefer something recorded or written specifically so there is a record later, since a purely verbal agreement is harder to evidence if a question comes up months afterward. Check what your own organisation's policy expects.