GDPR (session replay context)
The GDPR governs session replay whenever recordings capture personal data of people in the EU, which in practice means nearly always. Compliance turns on four things: a lawful basis for recording, minimization through masking and sampling, honoring data subject rights over recordings, and processor agreements with any replay vendor.
How it works
Lawful basis: analytics-purpose recording often relies on consent in the EU (see consent mode), while narrower purposes such as fraud prevention may support a documented legitimate-interest analysis. Minimization: capture-time masking transforms configured values before transmission, so the original values do not enter the stored recording. The browser still processes the page and input while applying those rules, as the GDPR's definition of processing includes collection and alteration. Rights: access, erasure, and objection can extend to recordings, so the system needs a documented way to locate and delete applicable sessions. Roles depend on the deployment and contracts. A replay vendor commonly acts as a processor and requires a DPA, subprocessor transparency, and an appropriate transfer mechanism where personal data leaves the EEA. Recordings should also appear in the relevant records of processing and risk assessments.
Where you encounter it
Privacy reviews before rollout, DPA negotiations, DSAR runbooks, and the recurring build-versus-buy question where self-hosting simplifies the transfer analysis.