Employee video testimonials and consent: what GDPR actually requires

Consent is the right legal basis for publishing an employee's face, voice, name, and role on a career page — and it is also the weakest one in the GDPR toolkit, because European guidance treats consent inside an employment relationship as problematic by default. The imbalance does not void consent; it shifts the burden onto the employer to prove the choice was real. This page covers what makes an employee consent record defensible, what to include in the text, what happens when someone leaves, and the one use case to avoid entirely.

Why employee consent is legally weaker than customer consent

Under the GDPR, consent must be freely given to be valid. European data protection authorities and the guidance from the European Data Protection Board have consistently taken the position that consent in an employment relationship is problematic by default, because the employee depends on the employer economically and cannot decline without perceived risk. The imbalance does not automatically void consent — but it shifts the burden onto the employer to show the choice was real.

For publishing an employee's face, voice, name, and role on a public career page, consent is still the appropriate basis: the processing is not necessary to perform the employment contract, and the employee must be able to refuse. What the imbalance means in practice is that you have to build the freedom into the process, not assert it in a clause.

This page describes how the mechanics usually work and is not legal advice. Employment and image rights vary by country, and works-council obligations vary by employer — check your specifics with counsel.

What makes employee consent defensible

Six properties, all of which should be provable after the fact:

1. Separate from employment terms. Consent to appear in marketing must not sit inside the employment contract, the handbook acknowledgement, or an onboarding bundle. Bundled consent is not freely given.
2. Specific about surfaces. "Marketing purposes" is too broad to be informed. Name them: career page, job advertisements, recruitment emails, company social accounts.
3. Time-bounded, or at least reviewable. State how long the video may be used, or commit to a review point. Indefinite permission granted in 2026 for a video of a person who leaves in 2027 is where problems start.
4. Withdrawable without consequence, and easy to withdraw. Name the contact, and commit to removal within a defined window. Withdrawal must not require negotiating with a manager.
5. Documented with a timestamp. A checkbox recorded at the moment of submission, tied to the specific recording, is far stronger evidence than a signed PDF filed somewhere separately.
6. Given away from the reporting line. If the person collecting consent manages the person giving it, the record is weaker regardless of what it says. Route collection through HR or comms.

The cleanest implementation is a consent step inside the recording flow itself, so the permission and the video arrive together with the same timestamp and the same scope. Consent stored separately from content is the most common evidentiary gap.

What to include in the consent text

Adapt to your jurisdiction, but cover these points in plain language:

• What is being recorded — video and audio of the participant, plus name and job title as displayed.
• Where it may appear — the named surfaces, and whether third-party platforms are included.
• For how long — a period, or a stated review cycle.
• What happens if they leave — whether the video continues to be used after employment ends, and for how long. Decide this in advance; it is the question that generates disputes.
• How to withdraw — a named contact and a removal timeframe.
• That participation is voluntary — and that declining has no employment consequence.
• Who to contact about their data — the controller and, where applicable, the data protection officer.

Ready-to-adapt consent structures, including an inline checkbox version and a full release: video consent forms and templates. Broader GDPR mechanics for testimonial video: GDPR and video testimonials.

What happens when an employee leaves?

The employment relationship ends; the consent does not automatically end with it, but relying on it gets harder — the person has less reason to tolerate a video they no longer want online, and more reason to exercise their rights.

Three practical policies, in order of how well they age:

Policy	What it says	Risk profile
Remove on exit by default	Clips come down when someone leaves, unless they opt in to stay	Cleanest legally; costs you content
Alumni opt-in at exit	Offboarding includes a specific ask to keep or convert the clip to an alumni story	Best balance; requires a process step
Indefinite retention	Clips stay until someone objects	Weakest; a career page featuring departed staff also misleads candidates

Whichever you choose, note that a career page showing three people who no longer work there is a credibility problem independent of the legal question. Candidates check LinkedIn.

Right to erasure applies to video

An employee or ex-employee can ask for their video to be deleted, and the request starts a clock — the GDPR gives controllers one month to respond, extendable in limited circumstances. Deletion means the underlying file and any published embeds, not just unpublishing the widget, and your vendor needs to be able to actually delete rather than hide. Workflow and template response: right to erasure and video testimonials.

Two operational implications: keep a record linking each published clip to the person and the consent, so you can locate everything a request covers; and check what your tooling's delete actually does before you need to rely on it.

The one use case to avoid: recorded performance conversations

Employee testimonials and performance management are different activities, and the second one should never run through testimonial tooling.

A recorded performance review, probation check-in, or evaluative conversation:

• creates employee personal data used for decisions about pay, progression, and continued employment,
• typically triggers consultation obligations with works councils or employee representatives in EU jurisdictions,
• cannot rely on consent in any meaningful sense, because the person being recorded reports to the person recording,
• and mixes a publishable content pipeline with an HR file, which is an access-control problem waiting to happen.

Employer-brand testimonials are a low-risk, well-understood use with documented consent. Appraisal recording is a different legal regime and a different product category. Keep the spaces, the tools, and the conversations separate — and if you collect first-90-days clips, make explicit in the ask that it is unrelated to the probation decision. Practical guidance on asking without pressure: how to ask employees for video testimonials.

A short operational checklist

1. Consent step inside the recording flow, timestamped with the submission.
2. Named surfaces and a stated duration in the consent text.
3. Exit policy decided in advance and written down.
4. Named withdrawal contact and a removal window you can actually meet.
5. Asks routed away from the reporting line, with declining explicitly cost-free.
6. Moderation queue so nothing publishes without review.
7. A register linking clips to people and consents, for erasure requests.
8. Performance conversations kept entirely out of the pipeline.

For the tooling criteria behind points 1, 6, and 7, see the guide to video testimonial software, and the HR setup on video testimonials for HR and recruiting.