Do I have to blur faces in a video for GDPR, and is blurring enough?

Under the GDPR a video in which a person can be recognised is personal data, so sharing it needs a legal basis such as consent or a legitimate interest. Blurring the faces of everyone you have no basis for is the usual way to share the video anyway: a blurred face is generally no longer personal data. It is not the whole job, because voices, names, uniforms and the place can still identify people.

When blurring is the practical answer

Sharing a recording with a client, an insurer, a public authority or a court where bystanders appear.
Publishing marketing or event footage filmed in a public place.
Handing over CCTV or dashcam footage after a subject access request, where other people must be protected.
Training material or research footage that leaves the organisation.

How to do it

Keep the original on the device or on controlled storage. Do not upload it to a cloud editor just to blur it; that is a new processing step with a new processor.
Blur or pixelate every face you have no basis for. In Anonimo, faces are grouped by person: tap the people with consent, everyone else is covered in every frame, on the iPhone.
Export at full resolution with Pro so the shared file is usable, and share only the blurred file.
Note what you did and when. Your record of processing should mention the blurring.

What blurring does not do

It does not remove voices. A person who speaks can be recognised by voice and by what they say.
It does not remove names, badges, licence plates, tattoos or distinctive clothing.
It does not change the context: a small team filmed in their own office is identifiable to colleagues even blurred.
A light Gaussian blur on a well-known face is weak; pixelation or an emoji hides more. We do not claim any cover is irreversible.

If you want this done automatically on your iPhone, Anonimo finds every face in a video, groups them by person, and blurs everyone except the people you pick. Nothing leaves the phone.

Trade-offs

Blurring on the device avoids adding a processor; a cloud blur service is itself a GDPR question.
Pixelation hides more than a soft blur; a soft blur looks better in marketing footage.
Blurring everyone is simplest; keeping consented people visible needs a record of who consented.

Questions

Is a blurred face still personal data under the GDPR?

Usually not on its own, if the person can no longer be identified by reasonable means. Other elements of the video can still make it personal data; see the country pages for the regulators' own guidance.

Does the GDPR apply to my holiday videos?

Filming for purely personal or household use is outside the GDPR. Publishing to the open internet generally is not, so the rules on consent and image rights of your country matter then.

Can I use a cloud tool to blur faces for GDPR?

You can, but the upload is itself processing of personal data by another company, which needs a contract and a legal basis. Blurring on the device avoids the question.