UK GDPR and remote session recording: lawful basis, transparency, retention

When a session recording becomes personal data

UK GDPR applies to personal data, meaning any information relating to an identified or identifiable living person. A recording of a remote support session will usually show the operator's actions, and it may also show content on the user's screen, such as their name, an email address, or other identifying detail. Even keystroke or session metadata logs, showing which named account connected to which device and when, count as personal data about the operator at minimum.

This means session recordings cannot be treated purely as a technical or security artefact sitting outside data protection law. They need the same basic groundwork as any other processing of personal data: a lawful basis, a fair and transparent explanation to the people affected, and a defined retention period.

Choosing a lawful basis

There are six lawful bases under UK GDPR, and for security-related session recording, legitimate interests is the one most commonly used, since consent is often impractical for something an organisation needs to do consistently and a contract basis rarely fits neatly. Legitimate interests requires a documented balancing exercise: identifying the interest being pursued, such as security, accountability and fraud prevention, checking that recording is necessary to achieve it, and weighing that against the impact on the individuals being recorded.

Where an employer records staff sessions for support or security purposes, the balancing test needs to take the employment context seriously, since staff have a reasonable expectation of some monitoring for legitimate business reasons but not of open-ended surveillance. Recording that is proportionate, limited to support and security purposes, and clearly communicated is far easier to justify than recording that goes beyond what those purposes need.

• Identify the specific interest that recording serves, not a general reference to security
• Check that recording is a necessary and proportionate way to achieve that interest
• Document the balancing test rather than relying on an unwritten assumption

Being transparent about recording

The transparency principle requires that people are told, in clear and accessible language, that their sessions may be recorded, why, and for how long the recording is kept. For staff, this is usually done through an IT acceptable use policy or a monitoring policy referenced in the employment contract or staff handbook. For external users receiving remote support, a short, visible notice at the point a session starts is good practice and helps meet the fairness requirement, since consent to the session and awareness of recording are different things.

A policy that exists on an intranet page nobody reads does not, on its own, satisfy transparency in a meaningful sense, even if it technically ticks a box. Practical transparency measures, such as an on-screen notification when a session is being recorded, do more to meet the spirit of the requirement than a buried clause.

• Reference session recording clearly in staff monitoring or acceptable use policies
• Show a visible on-screen notice when an external support session is recorded
• Keep the explanation of why sessions are recorded specific and understandable

Retention: how long is too long

UK GDPR's storage limitation principle requires personal data to be kept no longer than necessary for the purpose it was collected for. For session recordings and access logs, that purpose is usually security assurance, incident investigation and audit evidence, which suggests a retention period long enough to support those activities but not indefinite. Many organisations settle on a period in the range of a few months to a couple of years depending on sector requirements, but the right figure depends on the organisation's own risk profile and any sector-specific obligations, such as those in health or financial services.

What matters most is that the retention period is a deliberate decision, written down, and applied consistently, with recordings deleted or anonymised once the period expires rather than accumulating by default because nobody set a limit. Retaining logs for a specific, justified minimum period to support incident investigation, then reviewing whether a longer commercial or contractual need exists, is a defensible approach.

Minimisation and access to recordings

Data minimisation means capturing only what the stated purpose requires. If session metadata, such as operator, device, time and duration, is enough to satisfy the audit and security purpose, full video recording of every session may go further than necessary, particularly for routine, low-risk support activity. Where full recording is used, restricting who can view the content of recordings, separate from who can see that a session simply took place, keeps access proportionate.

Tools that separate session audit logs from full session recording, such as 247connect's session logging, give organisations a way to meet the audit and accountability purpose with less personal data than full video capture would require, though the right balance always depends on the specific risk being addressed.