GDPR and Session Replay — A Compliance Checklist

Short answer: to use session replay under the GDPR you need opt-in consent before the script runs, a clear privacy notice, masking so you collect only what is necessary, a data processing agreement with your vendor, a defined retention period, a way to honour access and erasure requests, and a valid mechanism if data leaves the region. The checklist below covers each.

Table of Contents

1. Legal Basis and Consent
2. Transparency
3. Data Minimisation
4. Your Vendor
5. Retention and Security
6. Individual Rights
7. Documentation
8. Key Takeaways

Legal Basis and Consent

Two rules apply together. Device access rules require consent before a non-essential script stores or reads information on the visitor's device. The GDPR then requires a lawful basis for processing the personal data collected. For session replay, consent is the usual answer to both.

• [ ] Recording does not start until the visitor consents
• [ ] Consent is a clear, affirmative action, not a pre-ticked box or continued browsing
• [ ] Accepting and refusing are equally easy
• [ ] Consent is specific: analytics and recording are named, not buried in "improve your experience"
• [ ] Withdrawal is as easy as giving consent, and stops recording at once
• [ ] You keep a record of consent
• [ ] Returning visitors' stored choices are respected

In DeepSync, projects default to consent-required mode and collect nothing until a consent signal arrives:

deepsync("consent", true);   // visitor accepted
deepsync("consent", false);  // visitor withdrew; recording stops immediately

Setup details: cookie consent and session replay.

Transparency

• [ ] Your privacy notice names session recording and heatmaps specifically
• [ ] It explains the purpose in plain language
• [ ] It names the vendor, or the category of vendor
• [ ] It states what is and is not captured, including that inputs are masked
• [ ] It states the retention period
• [ ] It explains how to withdraw consent and exercise rights
• [ ] The consent banner links to it

A sentence such as "We record how visitors interact with our site, with typed text masked, to find and fix usability problems" is clearer than any general statement about cookies.

Data Minimisation

Collect only what the purpose requires.

• [ ] Typed inputs are masked before leaving the browser
• [ ] Personal data displayed on screen is masked: names, emails, addresses, balances, order details
• [ ] Sensitive areas are excluded or blocked entirely
• [ ] Special category data (health, beliefs, and similar) is not recorded
• [ ] URLs do not contain personal data (PII in URLs)
• [ ] Attributes sent when identifying users are limited to what is needed
• [ ] Pages used mainly by children are excluded
• [ ] You have audited real pages with a test account

DeepSync masks passwords, payment fields, and text inputs in the browser by default, and provides classes for the rest (PII masking):

<div class="ds-mask">Jane Doe, 14 Example Street</div>
<div class="ds-block"><!-- not recorded at all --></div>

Your Vendor

A session replay provider acting on your instructions is a processor.

• [ ] A data processing agreement is signed
• [ ] The vendor processes data only on your instructions
• [ ] The vendor does not use your data for its own purposes
• [ ] You know where data is stored and processed
• [ ] If data leaves the EEA or UK, a valid transfer mechanism is in place
• [ ] You know the vendor's sub-processors
• [ ] Security measures are documented
• [ ] The vendor will assist with rights requests and breach notification

Retention and Security

• [ ] A retention period is set and matches your stated purpose
• [ ] Recordings are deleted automatically at the end of it
• [ ] Access is limited to people who need it
• [ ] Accounts use strong authentication
• [ ] Recording links are not shared in public channels
• [ ] Former staff are removed promptly

DeepSync retention is set per project, ranging from 30 days on Free to up to 365 on Enterprise. Recordings older than the window are purged automatically, and you can purge early (retention).

Individual Rights

• [ ] You can find a person's data
• [ ] You can export it for an access request
• [ ] You can erase it for a deletion request
• [ ] You can respond within the legal deadline
• [ ] You have tested the process at least once

In DeepSync, open Privacy, search for the visitor or session, and choose Export or Erase. Erasure is permanent and immediate. Identifying logged-in users by an internal ID makes it far easier to locate a person's sessions (identifying users).

Documentation

• [ ] Session replay is listed in your record of processing activities
• [ ] Purpose, legal basis, data categories, retention, and recipients are recorded
• [ ] You have considered whether a data protection impact assessment is needed, particularly for large-scale monitoring or sensitive contexts
• [ ] Your masking audit is documented and dated
• [ ] The setup is reviewed after significant site changes

Key Takeaways

• Consent before the script runs, with easy withdrawal.
• Name session recording plainly in your privacy notice.
• Mask inputs and displayed personal data; exclude sensitive areas.
• Sign a processor agreement, set retention, and test rights requests.

Conclusion

GDPR compliance for session replay is mostly configuration and documentation. Do it once, properly, and recheck when your site changes.

Read DeepSync's privacy docs.