Skip to main content
Redactly

Guide

GDPR and video: when you must blur faces before publishing

What the regulation actually says about a face in video, and a practical checklist for footage you're about to make public.

GDPR doesn’t name faces in video specifically, but a face that can identify a real person is “personal data” under the regulation’s general definition. Once you’re processing another identifiable person’s personal data — which includes filming them and then publishing the result — GDPR’s rules on lawful basis and proportionality apply to that footage. In practice, this often means you need a lawful basis to publish an identifiable bystander as they are, and if you don’t have one, blurring their face and other identifying details before you publish is a common, prudent step. This page explains the reasoning. It is general information, not legal advice, and nothing below — including this app — makes footage “GDPR compliant” on its own.

This is general information about how GDPR treats faces and other identifying details in video, written for people deciding what to do with their own footage. It is not legal advice, and it does not cover every situation or jurisdiction. If the footage is sensitive, commercial, or you’re genuinely unsure, get advice from someone qualified to give it for your case.

What the regulation says

A face is personal data before it's anything else

GDPR Article 4(1) defines personal data as “any information relating to an identified or identifiable natural person”. A recognisable face in a video is information relating to an identifiable person, so it meets that definition whenever the person can actually be identified from it — directly, or by combining it with other information a viewer would reasonably have.

Regulators treat facial images differently again once they are processed specifically to recognise someone by their unique physical characteristics. GDPR Article 9, read with Recital 51, calls that “biometric data” — a special category subject to extra restrictions. Ordinary video that simply shows a face, without processing aimed at identifying the person through it, sits under the general Article 4(1) definition rather than that stricter category — but the moment facial recognition or similar identification is applied to the footage, it can cross into it. The safer default is to treat any recognisable bystander’s face as sensitive and blur it if there’s no clear reason not to.

Before you publish

A practical checklist

Not a substitute for legal advice — a starting point for the decision most people are actually facing.

  1. Identify who's identifiable in the shot

    Not just the main subject — bystanders, a name badge, a visible screen, a license plate. Anything that could point back to a real person counts.

  2. Work out whether you have a lawful basis to publish it as it is

    Genuine public-interest journalism, a properly balanced legitimate interest, or the person's consent are the usual routes. Whether one actually applies to what you're about to do with the footage depends on the specifics — this is where it's easy to assume too much.

  3. If you don't have a clear basis, de-identify before you publish

    Blur or otherwise cover anyone who isn't part of the story and hasn't consented — before the footage goes out, not after. Once it's public, removing it doesn't undo who already saw it.

  4. Treat other identifying details the same way

    A license plate, a home address, a name on a badge or document can identify a person just as directly as their face can.

  5. Check the file's metadata too

    Video shot on a phone usually carries GPS location and device details in the file itself. That can re-identify where a scene was filmed even after every face in it has been blurred.

  6. Keep a record of what you did and why

    What you blurred, and your basis for what you kept unblurred. That record is what regulators and courts actually look at — not the blur by itself.

Redactly blurs faces and other identifying regions on-device and strips location metadata on export — a genuine step toward reducing what a published clip discloses, alongside working out your basis for the rest.

Download on theApp Store

Alternatives

Other ways to reduce the risk

Don't publish that segment, or get consent

The simplest way to remove the risk from a clip is to not include the part with the identifiable person, or to ask them. Neither needs any tool, and both are worth considering before reaching for a blur.

iMovie

No built-in blur or pixelate effect, so it isn't an option for de-identifying a moving subject on its own.

Desktop editors (Premiere Pro, DaVinci Resolve, Final Cut Pro)

Capable of a tracked blur or mosaic if you already edit on a computer, at the cost of the software and the time to set it up per clip.

Online blurring services

Fast for a single clip, but they generally require uploading the footage to a third party's server first — worth weighing carefully when the whole point is limiting who has access to identifiable people.

Redactly

Blurs faces and other identifying regions on-device, with nothing uploaded, and strips location and camera metadata on export. It reduces a real risk in the footage you keep — it does not by itself decide your lawful basis or make the result compliant.

FAQ

Questions people ask about this

Does GDPR apply if I'm just posting a personal video, not running a business?
GDPR has an exemption for purely personal or household activity, but posting to an unrestricted public audience is generally understood — including by EU courts — to fall outside that exemption. A video posted publicly can be subject to GDPR even from a personal account. This is general information, not a ruling on your specific case.
Do I need consent from everyone in the shot?
Consent is one lawful basis, not the only one, and collecting it from every bystander in public footage is often impractical. That impracticality is exactly why blurring people who aren't part of the story is a common alternative to relying on consent from all of them. Whether you specifically need consent depends on your basis and jurisdiction.
Is blurring faces enough to make a video GDPR compliant?
No single edit makes a video compliant. Blurring identifiable people genuinely reduces the personal data you're disclosing, but other obligations — a lawful basis for what you do keep, data minimisation, retention, responding to rights requests — apply independently of the blur.
Does GDPR only cover the EU?
No. It generally applies to processing the personal data of people in the EU/EEA regardless of where the person or organisation publishing the footage is based, when that processing relates to offering something to, or monitoring, those individuals.
Are license plates or addresses covered the same way as faces?
Yes, if they can identify a person — a plate is usually registered to a specific individual or household. Article 4(1)'s definition covers any information relating to an identifiable person, not faces specifically.
Is a face in a video always 'biometric data' under GDPR?
Not automatically. A recognisable face is personal data under the general Article 4(1) definition either way. It becomes the stricter, special category of biometric data specifically when it's processed by technical means aimed at uniquely identifying the person — such as facial recognition — not simply by appearing in an ordinary video.

For how Redactly itself handles your video, see the Privacy Policy.