How can I tell if a video conferencing tool is secure and GDPR-compliant?

No tool is "GDPR-compliant" on its own: compliance depends on how you, the organiser, use it. What you can check is whether a tool and its provider make compliance possible. A practical checklist:

Security

• Encryption in transit. Media and data should be encrypted between browser and server (for WebRTC tools this is standard: TLS plus DTLS-SRTP).
• End-to-end encryption (E2EE) is a further step where even the server cannot see the media. Some tools offer it as an option (plugNmeet does); note it can disable server-side features such as recording or AI captions.
• Access control: waiting rooms or guest approval, moderator roles, locking a room, and unique links. These prevent uninvited guests ("Zoom bombing").
• Updates: who patches the software, and how fast?

Data protection (GDPR)

• Where is data processed and stored? Ask for the server location, including backups and recordings.
• Data processing agreement (Article 28 GDPR) with the provider, and a list of sub-processors.
• Transfers outside the EU need a legal basis, such as the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or standard contractual clauses.
• Recordings: who can start them, how participants are informed, how long they are kept and how they are deleted. In BigBlueButton, recording is enabled per meeting and can be disabled server-wide.
• Minimum data: only collect what you need (for example, avoid unnecessary analytics).

Self-hosting open-source software gives you the most control over location and retention, but you also take on the security work. A managed service in the EU can be a middle ground if the contract covers the points above.