GDPR checklist for media tools.
Media services store images and videos that can show people, so uploads may be personal data. Compare 2 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Vimeo | Usually a processor | Often the United States, check your account | Published by the vendor |
 Cloudinary | Usually a processor | Set per account or project | Published by the vendor |
What to check for media tools
- Get permission before uploading images or videos of identifiable people.
- Set who can view each file: private, unlisted or public.
- Check where files are stored and delivered from.
- Delete files when the reason for keeping them ends.
All media tools
Questions, answered.
What should I check before using a media tool under the GDPR?
Get permission before uploading images or videos of identifiable people. Set who can view each file: private, unlisted or public. Check where files are stored and delivered from. Delete files when the reason for keeping them ends.
Do I need a data processing agreement with a media provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which media tools does Privacyboard cover?
Vimeo, Cloudinary. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.