Running BigBlueButton in line with the GDPR – video conferencing without a US cloud
BigBlueButton can be operated in a GDPR-compliant way – but what decides that is not only the software. Server location, contracts and your own rules for recordings matter just as much. This page explains what BigBlueButton brings with it, what the hosting side has to deliver, and what schools should watch for. We host BigBlueButton in a German, ISO 27001-certified data center, GDPR-compliant including a data processing agreement (DPA).
Please note: this page offers technical orientation, not legal advice. The data protection assessment of your specific use is yours to make, ideally together with your data protection officer.
Why is video conferencing sensitive under data protection law?
Because it produces unusually revealing personal data: image, voice, names, chat messages, attendance times and, depending on your setup, recordings. In a teaching context, data on minors is added to that.
There is also the question of who technically processes this data. With US services, third-country transfers and possible government access come up again and again – a point that lengthens every data protection impact assessment. Operating in Germany, without a parent company outside the EU, takes that question off the table.
What does BigBlueButton itself provide?
BigBlueButton is open source and was built for online teaching. Three properties matter for data protection.
No account required for participants. Participants join through a link and enter a display name. No permanent user profile is created with a provider – a noticeable difference from account-based services.
Encrypted transport. Connections between browser and server are encrypted in transit. BigBlueButton does not offer end-to-end encryption across all participants; media streams pass through the server. Describe it that way in your documentation.
Recording only when you want it. Recording is a deliberate choice per room and does not start automatically. The feature can also be switched off entirely.
Open source. The code can be inspected. What is processed can be verified rather than merely promised.
What must the hosting side deliver?
Software alone does not create compliance. Four points belong to operations.
| Requirement | What it means in practice |
|---|---|
| Server location Germany | Processing exclusively in a German data center, ISO 27001-certified in our case. No third-country transfer. |
| Data processing agreement (DPA) | A written agreement under Art. 28 GDPR between you as controller and us as processor. We provide it. |
| Technical and organizational measures (TOMs) | Documented measures on access control, encryption, backups and separation of instances – attached to the DPA. |
| Retention limits for recordings | Defined, technically enforced periods after which recordings are deleted automatically. We agree the specific period with you during setup. |
For how this fits together with Moodle, see Moodle hosting and GDPR.
Handling recordings properly
Recordings are the most common stumbling block. Three rules help.
- Settle the legal basis before you record. In teaching, recording is rarely a given; usually you need consent, and for minors, depending on age, consent from a parent or guardian.
- Be transparent. Announce it in advance, make it visible in the room, and offer a way to object – for example by turning off camera and microphone.
- Store sparingly. Record only what serves a purpose, restrict access to the people who need it, and delete automatically once the retention period ends.
If you do not need recordings at all, have the feature disabled. That is the simplest privacy-friendly setting.
Specifics for schools
Schools process data on minors and are additionally bound by the education law of their federal state. Three practical points follow from that.
- Check state-level requirements. Several German states set rules on permitted conferencing systems and server locations. We take the guidance applicable in your federal state into account during setup.
- Records of processing and consent forms. The conferencing system belongs in your record of processing activities, and consent for recordings should be documented in writing.
- No forced accounts for students. Joining by link without a user account makes the rollout considerably easier – and avoids debates about student profiles held by a US provider.
More on school rollouts under solutions for schools and in our comparison of BigBlueButton and Zoom.
Checklist: introducing BigBlueButton the compliant way
- [ ] Server location Germany confirmed
- [ ] DPA under Art. 28 GDPR signed, TOMs reviewed as an annex
- [ ] Entry created in your record of processing activities
- [ ] Decision documented on whether recordings are permitted
- [ ] Retention period for recordings defined and technically enforced
- [ ] Consent wording for recordings prepared
- [ ] Roles and permissions assigned, moderation rights clarified
- [ ] Users informed: what is processed, what happens to recordings
- [ ] Data protection officer involved
Frequently asked questions about BigBlueButton and the GDPR
Is BigBlueButton automatically GDPR-compliant? No. The software provides good foundations, but operations, contracts and your own rules decide the outcome. With us, a German server location and a DPA come on top. See hosting →
Is BigBlueButton end-to-end encrypted? No. Transport is encrypted, but media streams pass through the server. For most teaching and training scenarios, that plus a German server location is a workable basis.
Do participants need an account? No. They join through a link with a display name, which noticeably reduces the data processed.
How long are recordings kept? As long as you define. The period is enforced technically, and deletion happens automatically afterwards. We will tell you the default value and the configurable range on request.
Is BigBlueButton a suitable Zoom alternative for schools? In many cases yes, mainly because of the server location, the absence of forced accounts and the integration with Moodle. See the comparison.
Do we get a data processing agreement? Yes, we provide the DPA including the technical and organizational measures. Contact →
Do you provide legal advice? No. We supply the technical and contractual foundations and describe the processing transparently. The legal assessment remains with you.