Is Panopto GDPR compliant? What universities should check
Panopto is one of the most widely used lecture capture platforms in European higher education. This page sets out what Panopto publicly documents about hosting regions, its data processing agreement, subprocessors, transfers and AI, and what that means for a university recording teaching at scale.
Short answer
Panopto acts as a processor for universities and publishes a detailed data processing agreement (DPA 4.0, last updated 15 April 2026) with standard contractual clauses and a subprocessor list. European customers contract with Panopto EMEA Limited, and customers choose the AWS hosting region, with Ireland among the options. Panopto states that it complies with the EU-US Data Privacy Framework and that it does not use customer data to train AI models without explicit permission. The main questions for a university are its own: which region it selects, which optional captioning and AI services it switches on, and how long it keeps recordings of students.
What Panopto documents publicly
The table summarises what Panopto states in its own documentation, read on 7 October 2026. It covers the Panopto cloud service as used by an institution for lecture capture, video hosting and LMS integration.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and role | Documented Panopto is headquartered in the US. Under the DPA, customers in Europe, the Middle East and Africa contract with Panopto EMEA Limited, located in the United Kingdom. The customer is the controller and Panopto the processor. | DPA 4.0 (PDF) [1], Authorized User Privacy Policy [2] |
| Where data is stored and processed | Customer-selected Amazon Web Services provides web hosting, AI search and translation, with processing in the United States, Canada, Ireland, Australia, Japan or Singapore, as selected by the customer or set in the agreement. Panopto also mentions on-premises deployment for specific residency requirements. | [1], Security page [3] |
| Data processing agreement | Documented A public DPA covers the GDPR, UK GDPR and Swiss law and incorporates the 2021 SCCs. | [1] |
| Subprocessors | Documented Listed in Exhibit C of the DPA. Optional captioning services (Cielo24, Verbit, 3Play Media) and 24x7 support list the United States, as do business tools such as Salesforce, Marketo, Pendo and ChurnZero. Luzmo, Omni.ai and Speechmatics follow the customer-selected region. Google Analytics is off by default. Panopto gives 30 days' notice of a new subprocessor, with 14 days to object. | [1] |
| International transfers (DPF, SCCs) | Documented Panopto states that it complies with the EU-US DPF, the UK Extension and the Swiss-US DPF (DPF status read from the vendor's privacy policy and DPA; the official list API returned no results for any query on the check date). The DPA also relies on SCCs. | [1], [2] |
| AI features and training | Documented Panopto's AI statement says it does not use customer data to train AI models without explicit permission and that customer data stays protected within its cloud environment. | AI statement [4] |
| Retention and deletion | Customer-controlled Customers can export data at any time and are responsible for their retention obligations. After termination, data the customer cannot delete itself is deleted or returned within 90 days. Backups are destroyed within one year, and audit logs one year and one day after creation. | [1] |
| Security certifications | Documented ISO 27001, ISO 27017, ISO 27018, ISO 9001 and TX-RAMP Level 2 certifications and a SOC 2 Type II attestation. The full SOC 2 report is available under NDA, and a SOC 3 summary without one. Content is encrypted at rest and in transit. | [3] |
| Institution controls | Documented Single sign-on, role-based access, audit logs and administrative reporting. Users can decline non-essential cookies where the customer has selected the EU storage region or enabled cookie settings, and the customer chooses the storage region. | [2], [3] |
Panopto's DPA is among the clearer ones we have read for a teaching tool. It puts deletion periods for backups and audit logs into numbers, ties several subprocessors to the region the customer chooses, and marks which subprocessors apply only if an add-on is bought. Those are practical strengths for a privacy office.
What this means for a university
Validemic's analysis
Students on camera. Lecture capture is designed to record what happens in a room. Students who ask questions, present or appear in the camera's field of view are recorded with their image and voice, and Panopto's privacy policy notes that content may include video and audio recordings and likenesses of users [2]. Students cannot easily opt out of being in a lecture. The university therefore needs a clear lawful basis, a notice in the room and the course page, and practical measures such as pointing cameras at the lectern rather than the audience. Under recital 51 GDPR, images are special category data only when processed by technical means that allow unique identification [5], which becomes relevant if face or speaker recognition is used.
Region and entity. The European contracting entity is in the UK. The European Commission renewed its adequacy decision for the UK in December 2025 [6], so transfers to Panopto EMEA Limited can rely on that decision, while hosting can be pinned to Ireland. Confirm the region in the order form and check it in the account.
Captioning and add-ons. The optional captioning providers listed process in the United States. Automated captioning is an accessibility benefit, but each add-on changes where recordings travel. Record which ones you use.
Retention. Panopto leaves retention to the customer. Many universities keep recordings indefinitely by default. A written retention rule, for example deleting recordings a set period after a course ends unless there is a documented reason to keep them, reduces both risk and the cost of answering access requests.
DPIA likelihood. Article 35 GDPR requires a DPIA where processing is likely to result in a high risk [7]. Institution-wide recording of teaching, long retention and AI processing of transcripts point towards a DPIA, which can be shared across faculties.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Panopto before approving it
- Which AWS region is our site provisioned in, and does that region apply to backups, logs, search indexes and AI processing?
- Which subprocessors apply to us, given the add-ons and support package in our order form?
- Which AI features are enabled by default on our site, and can administrators disable them centrally?
- What counts as "explicit permission" for AI training under Panopto's AI statement, and how would we be asked?
- Can we set automatic deletion or archiving of recordings after a defined period at site or folder level?
- How do we handle an access request from a student who appears in many recordings?
- Can we obtain the current SOC 2 Type II report and ISO certificates under NDA?
- Which address should receive the 30-day notices of new subprocessors?
The EU AI Act angle
Panopto's AI features, such as search, captions and translation, are general productivity and accessibility functions rather than the education uses listed as high-risk in Annex III of the AI Act. Article 4, as amended, requires deployers to take measures to support AI literacy among staff using AI systems [8], for example telling teachers that automatic captions and summaries can contain errors.
Article 5(1)(f) prohibits AI systems that infer emotions in education institutions, except for medical or safety reasons [9]. We found nothing in Panopto's public documentation describing emotion inference. If viewing analytics were ever combined with AI to evaluate students, that use would need a new assessment, as Annex III obligations apply from 2 December 2027 under the amended Article 113 [10].
Sources
- Panopto Data Processing Agreement, DPA 4.0 (last updated 15 April 2026, PDF), linked from panopto.com/data-processing-agreement, retrieved 7 October 2026
- Panopto Authorized User Privacy Policy (last updated 11 January 2024), retrieved 7 October 2026
- Panopto security capabilities, retrieved 7 October 2026
- Panopto AI statement, retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), recital 51, retrieved 7 October 2026
- Adequacy decisions, European Commission, retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), Article 35, retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 5: Prohibited AI practices, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
About this page
We read Panopto's data processing agreement, authorised user privacy policy, security page, AI statement and the relevant EU sources on 7 October 2026. The official Data Privacy Framework list API returned no results on that date, so DPF status comes from Panopto's own statements. Every statement about Panopto above comes from those pages, and our own view is labelled as Validemic's analysis. This page is not legal advice and does not say whether any particular use of Panopto complies with the GDPR. If you spot an error or Panopto has updated a document, please contact us and we will correct it.
Frequently asked questions
Is Panopto GDPR compliant?
No platform is GDPR compliant on its own. Panopto acts as a processor for its customers, publishes a data processing agreement with standard contractual clauses and a subprocessor list, lets customers select the hosting region and states that it complies with the EU-US Data Privacy Framework. Whether a university's use complies depends on its contract, region, settings and the information it gives students and staff.
Does Panopto store data in the EU?
Panopto's DPA lists Amazon Web Services as its hosting subprocessor, with processing in the United States, Canada, Ireland, Australia, Japan or Singapore as selected by the customer. A European university can therefore choose Ireland, but some subprocessors, such as optional captioning services and business tools, list the United States.
Which Panopto company signs the contract for European universities?
Under Panopto's DPA, customers in Europe, the Middle East and Africa contract with Panopto EMEA Limited, which the subprocessor list places in the United Kingdom. The European Commission renewed its adequacy decision for the UK in December 2025.
Does Panopto use lecture recordings to train AI?
Panopto's AI statement says it does not use customer data to train AI models without explicit permission. A university should still check which AI features are switched on and which subprocessors they use.
How long does Panopto keep recordings after a contract ends?
Panopto's DPA says it will delete or return personal data within 90 days after the agreement ends, where the customer cannot delete it itself. Backups and archives are destroyed within one year, and audit logs one year and one day after creation.