GDPR session recording checklist
A public checklist for teams adopting session replay under GDPR and ePrivacy-style rules. It is not legal advice, it is not gated behind an email form, and it should be read alongside your own counsel, the privacy controls guide, and the Replayly fact sheet.
Last updated .
Decide why you are recording
Session replay is personal-data processing when a recording can relate to a person, even if you never store a name. Write down the job: fixing a checkout bug, supporting a customer, or improving a flow. Vague “analytics” is a weak starting point.
- Name a purpose that a reviewer can understand, and drop recordings that do not serve it.
- Choose a lawful basis with your own counsel. This checklist is product documentation, not legal advice.
- Match retention to that purpose. Replayly hosted plans publish retention in days on the fact sheet; self-host operators set their own.
Minimize what a replay can show
The cheapest privacy mistake to avoid is storing a password, address, or health field because a toggle was left off. Conservative defaults matter more than a policy PDF nobody reads.
- Keep input masking on for production projects. Replayly masks inputs by default; do not turn that off to “see if it works” on a live form.
- Respect Do Not Track unless you have a documented, narrow reason to ignore it on a test page.
- Use consent mode where your policy requires a banner, and only start recording after the visitor’s choice is recorded.
- Mask or block widgets that can contain messages or cards, using text masking and CSS selectors on Starter and above.
Know where recordings live
A reviewer will ask who hosts the data and who is the controller. Your answer should be the same in the contract, the privacy notice, and the dashboard.
- If you self-host, you operate the VPS, Postgres, and object storage, and you are the controller of those recordings.
- If you use a managed workspace, Replayly processes session data to provide the service. Read the privacy policy and decide whether that hosting model is acceptable.
- Record the region or provider you actually use. Do not invent a US headquarters or a residency promise the product does not make.
Access, notices, and review
A good install still fails a review if anyone on the team can open sensitive sessions, or if the public notice disagrees with the product settings.
- Limit dashboard access to people who need to watch sessions, and review that list when roles change.
- Tell people, in your own notice, that you use session replay and how to opt out if you offer that choice.
- Re-check settings after you raise sampling or add a new project, and refresh this list when plans or defaults change. See the product facts page for current prices, retention, and defaults.
If you want product updates when this checklist or the fact sheet changes, you can join the newsletter below. The checklist itself stays public either way. More resources live on the resources page.