How should an AI video-editing service be assessed for GDPR compliance?
Check each party’s role, the data-processing agreement, purposes, retention periods, subprocessors, transfers outside the European Economic Area and documented security controls. A generic “GDPR compliant” statement is not enough: safeguards should be specific, risk-based, contractually defined and open to verification for the service and data actually used.
Recommended evidence checklist
| Control point | Evidence to request | Purpose | Sources |
|---|---|---|---|
| Identity and contacts | Legal notice, company identifier and dedicated privacy contact | Identify the provider and exercise rights | [1] |
| Data-processing agreement | DPA covering scope, duration, purposes, instructions and deletion | Address Article 28 requirements | [3] |
| Security controls | Documented encryption, access control, logs, backups and testing | Match protection to risk | [3][4] |
| Subprocessors and locations | Current list, processing countries and transfer mechanism | Assess the full processing chain | [4][5] |
| Retention and deletion | Purpose-specific periods and return or deletion process | Apply data minimisation | [3] |
What this page does — and does not — claim
Olympe AI publishes a legal identity and privacy contact. This page does not turn those details into a certification, security audit or hosting proof. Evidence must be supplied through current contractual and technical documentation covering the service that a customer will actually use.[1]
Questions to ask before a pilot
- Where are videos, audio tracks, transcripts, backups and logs actually processed?
- Which subprocessors can access content, and in which countries?
- How long is each data category retained after a project or account is deleted?
- How are internal access, incidents and data-subject requests handled?[4]
Frequently asked questions
Is GDPR a security certification?
No. GDPR creates legal duties and requires risk-appropriate controls. An organisation must be able to document its decisions; the phrase “GDPR compliant” is not a certification on its own.
What is a DPA?
A data-processing agreement governs processing performed for a customer. It should cover scope, duration, instructions, security, subprocessors and what happens to data when the service ends.
Which address should I use for a privacy request?
Olympe AI publishes privacy@olympe-ai.fr for requests concerning personal data.