Is there a data processing agreement?
The provider processes data on your behalf. You need a contract under Article 28 GDPR, which reputable providers offer without being asked.
Guide · Data protection
Video consultations for associations. Compliant and easy to join.
Advice by video saves people the trip to the office. Once the conversation turns to health, pensions, care or debt, it needs more than any old meeting tool. This guide explains what matters for data protection, what a good process looks like and when a free option is enough.
By Paul Czichos, consulting and project support at czichos.net GmbH · Updated
Why it’s sensitive
Data protection in video consultations. An advice session is not a team meeting.
Welfare, pension, care or debt advice is about illness, income and family. Health data is a special category under Article 9 GDPR, with stricter rules.
Many people seeking advice are older, borrow a grandchild’s tablet or use an old smartphone, and want neither to create an account nor to install an app.
A good tool therefore processes as little as possible and opens with a single click on a link.
The duties that apply to every association beyond that are covered in the guide to the GDPR for associations.
What to look for
Choosing a GDPR-compliant video tool. Six questions for any video tool.
Ask these before you choose.
Where do the calls run?
Servers in Germany or the EU are the simplest case. With providers from third countries, lawfulness depends on transfer mechanisms that keep being challenged in court.
Can it record?
A recording needs explicit consent and secure storage. The simplest option is a tool that cannot record at all.
Do clients need an account?
Without an account, the provider holds no login data and there is no hurdle before the appointment. A link that opens in the browser is enough.
How is the connection encrypted?
Transport encryption is standard. Some tools offer end-to-end encryption, often with limits on browsers or features. Ask exactly what applies.
What is left behind afterwards?
How long are chat logs, shared files and minutes kept, and who deletes them? There is often more risk here than in the conversation itself.
A good process
How a video consultation should run. From booking to deletion.
The process matters as much as the technology:
- Before: book the appointment, send the link by email or text message and include the privacy notice required by Article 13 GDPR.
- At the start: a waiting room, so nobody bursts into a session in progress. Briefly check whether anyone else is listening.
- Documents: exchange letters and certificates within the session instead of by unencrypted email or a contact form without proper data protection.
- Afterwards: what belongs in the case file goes into the file. Everything else is deleted, ideally automatically. The guide to email archiving covers retention periods for correspondence.
If your organisation regularly processes health data by video, a data protection impact assessment under Article 35 GDPR may be required. Check this with your data protection officer. This guide is not legal advice.
Do it yourself or have it run
Self-hosting Jitsi or using a service? For many associations, there is a free option.
If you advise people occasionally and someone can look after a server, you don’t need a provider. If sensitive conversations are routine, take a closer look.
Set it up yourself
If you advise occasionally and have some technical help
- Run Jitsi Meet yourselfOpen source, no licence fees, usable in the browser without an account. Needs your own server, which someone has to look after and update.
- BigBlueButtonAlso open source, built more for seminars. Large for one-to-one advice, good for training.
- A trustworthy public instanceFor conversations without sensitive content, a Jitsi server run by a well-known operator in Germany is often enough. For health data it is not.
- The telephoneFor many people the lowest hurdle.
Have it run
If sensitive advice is part of everyday work
- Health and social data every weekThen the contract, location, deletion periods and prompt security updates all matter.
- Nobody looks after the serverA video server that nobody has updated for months is a risk.
- Appointments from your own systemIf sessions should be created from your membership administration, you need an integration rather than links pasted by hand.
- Documents during the sessionFile exchange, screen sharing and orderly deletion are tedious to put together yourself.
On our own behalf: we earn money from the second column. If your association only advises by video now and then and without health data, take a free option.
Common questions
Video consultation FAQ. What associations ask.
May an association offer advice by video?
Yes. The GDPR requires appropriate safeguards: a data processing agreement, a secure connection, clear deletion periods and a privacy notice for the people you advise. Some professions, such as medical practices, have additional rules.
Which video tool is GDPR-compliant?
No tool is compliant by itself, it depends on how you use it. Good starting points are tools with servers in Germany or the EU, a data processing agreement, no recording and no account for clients.
Do I need consent from the people I advise?
For the session itself usually not, because the processing serves the service the person is asking for. A recording, however, needs explicit consent. Where health data is involved, clarify the legal basis with your data protection officer.
Is Jitsi good enough for welfare advice?
Technically yes, if Jitsi runs on your own server or with a trustworthy operator in Germany and the server is kept up to date. A random public instance without a contract is not suitable for health data.
Video consultations with secConsult
Clients open a link in their browser, with no account and nothing to install. Chat, file exchange and screen sharing are built in. Nothing is recorded, and shared files are stored encrypted and only briefly. secConsult runs on our own machines, with no third-party services in between.
Planning video consultations? Let’s talk.
Tell us briefly how your advice works today and what should move to video. We will tell you whether secConsult fits or a free option is enough.
No obligation and no contract. We usually reply within one working day and are happy to show you the tool in a short call.
Prefer to reach us directly? Send an email · call 030 994048000