Photography sits in one of the most personal corners of GDPR. Unlike a website that collects an email address, a photograph captures something uniquely human — a face, an expression, a moment. Under GDPR, that has real legal weight. And the rules are more nuanced than most photographers realise.
This guide covers everything photographers need to know: when photos count as personal data, how consent works for different shoot types, the right to erasure, wedding and event photography specifics, social media, and practical templates to keep you compliant.
When Does a Photograph Become Personal Data Under GDPR?
GDPR defines personal data as any information relating to an identified or identifiable natural person. A photograph is personal data if the person depicted can be identified — directly from the image, or in combination with other information.
In practice, this means:
- A portrait of a named client: personal data
- A photo of a crowd where individuals are identifiable: personal data
- An abstract shot with blurred or unrecognisable faces: probably not personal data
- A landscape with no people: not personal data
The threshold is identifiability, not intent. If a reasonable person could look at the photo and identify the subject — from their face, distinctive features, or context — it's personal data under GDPR.
The Biometric Data Question
Here's where it gets more complex. GDPR Article 9 creates a higher tier of protection for "special category data," which includes biometric data processed for the purpose of uniquely identifying a natural person.
Facial recognition technology processes facial images as biometric data for identification purposes — and that clearly falls under Article 9's heightened protections. But what about ordinary photographs?
The ICO (UK) and the EDPB (EU) have both indicated that a standard photograph is not automatically biometric data under Article 9 — unless it's being processed through systems that extract biometric features for identification purposes. A photographer storing portrait files on a hard drive is not running a facial recognition system. The heightened biometric rules apply when the processing technology is doing identification work, not just image storage.
That said, if you're using AI tools to auto-tag photos by person, run facial recognition, or create searchable face databases — that shifts the analysis significantly. Those use cases almost certainly engage Article 9.
The practical takeaway: Standard photography and image storage falls under general GDPR rules. Facial recognition or AI-based face tagging engages special category protection and requires explicit consent or another Article 9 condition.
Legal Bases for Photography
For general GDPR compliance, you need a lawful basis to process personal data (including photographs). The main options for photographers:
Consent
The most common basis for commercial photography. The subject freely agrees to be photographed and for the images to be used in a specific way. Valid consent under GDPR must be:
- Freely given (no coercion)
- Specific (for a defined purpose and use)
- Informed (the subject knows who you are and what the images will be used for)
- Unambiguous (opt-in, not opt-out)
Legitimate Interests
A more flexible basis, but requires a balancing test: your interest in taking/using the photograph must outweigh the subject's privacy interests. This is the basis most commonly relied on for street photography and photojournalism — where obtaining consent from every subject is impractical.
Contract
If photography is part of a service you're contracted to provide (e.g., a wedding photographer hired by the couple), the contract provides a basis for processing images of the contracting parties — but not necessarily for other people who appear in the photos.
Public Interest / Journalism
Significant derogations exist for journalistic, artistic, academic, and literary purposes. GDPR Article 85 allows member states to provide exemptions, and both the UK and most EU countries have implemented these. Editorial and news photography operates largely under this exemption.
Consent for Commercial Photography: Model Releases
For commercial shoots — advertising, product photography, stock images — you need explicit model releases. A model release is essentially a written consent document that:
- Identifies the photographer and subject
- Describes the images being taken
- Specifies the permitted uses (advertising, social media, print, web, etc.)
- Covers the territory and duration of use
- States any compensation
Under GDPR, a model release must also include:
- What personal data is being processed (the images, and any other data collected)
- Who the data controller is (you, the photographer, or your client)
- How long the images will be retained
- The subject's right to withdraw consent and how to exercise it
- Information about the subject's right to access, rectify, or erase their data
A consent form that only addresses "permission to use the images" is not a GDPR-compliant model release. You need the privacy information embedded in, or provided alongside, the release.
One important caveat: If someone withdraws consent after the shoot, you must stop using the images going forward — but if images have already been published in a printed catalogue, there's no obligation to recall and destroy every copy. The right to erasure has limits around practical possibility and other legitimate interests.
Event Photography: Workshops, Conferences, Corporate Events
Event photography creates a challenging consent landscape. You're photographing potentially dozens or hundreds of people who may not have known they'd be photographed.
Best practice for event photographers:
- Ensure the event organiser informs attendees in advance that photography will take place (in the booking confirmation, event listing, or on signage at the venue)
- Display clear signage at the event entrance: "Photography is taking place at this event. Images may be used for [purpose]. Contact [email] if you have concerns."
- Provide a clear opt-out mechanism — a coloured lanyard, wristband, or simply asking to be excluded from shots
- Capture group shots, atmosphere shots, and speaker images differently from close-up individual portraits — the latter warrant more explicit consent
For internal corporate events where images will only be used internally, the legitimate interests basis is usually appropriate. For images that will appear in marketing materials, explicit consent from identifiable individuals is safer ground.
Wedding Photography and the Special Situation of Client Data
Wedding photographers handle an unusually rich set of personal data:
- Client contact details and contracts
- Payment information
- Shot lists, guest names, venue details
- Hundreds of photographs of named individuals — the couple, family, guests
The couple's contract gives you a lawful basis to process their personal data and to photograph the event. But guests are third parties — they haven't entered a contract with you.
Under the legitimate interests basis, wedding photography of guests is generally defensible: guests attending a wedding have a reasonable expectation that photographs will be taken. But there are limits:
- Intimate moments captured without knowledge (guests in distressing situations, changing, etc.) are a different matter
- Images of children require particular care — parental consent should be obtained before using identifiable images of children in portfolios or social media
- Guests who actively object to being photographed should be respected
Sharing images with vendors (the venue, florist, DJ) is common but creates data sharing obligations. If you're handing over a USB drive of images to another vendor, you're sharing personal data with a third party. Ensure your client contract addresses this, and ideally get the couple's explicit consent to share with named vendors.
Online galleries and cloud delivery:
- Your gallery platform is a data processor — ensure they have a Data Processing Agreement (DPA) with you
- Set appropriate access controls and link expiry on client galleries
- Don't leave client galleries publicly accessible indefinitely
Retention: How Long Should You Keep Client Images?
Photographers routinely keep images for years — and often indefinitely. GDPR's storage limitation principle requires you to keep personal data only as long as necessary for the purpose it was collected.
For photographers, reasonable retention periods might be:
| Image Type | Reasonable Retention Period |
|---|---|
| Commercial/advertising images | Duration of the campaign + 1-2 years |
| Wedding images | 5-7 years (couples may request reprints) |
| Event images (no ongoing use) | 1-2 years |
| Portfolio images | As long as used, with periodic review |
| Client contact/contract data | 6-7 years (legal/tax requirements) |
Document your retention policy. If you're a professional photographer, you should have a written policy stating what you keep, how long, and when you delete.
When images are no longer needed, delete them properly — from your hard drives, cloud backups, and editing software libraries.
The Right to Erasure for Subjects in Photographs
GDPR's right to erasure (Article 17) is one of the most complex rights as it applies to photography.
When does the right to erasure apply?
- The subject withdraws their consent (and consent was the lawful basis)
- The images are no longer necessary for the original purpose
- The subject objects under Article 21 and you can't demonstrate overriding legitimate grounds
- The images were processed unlawfully
When can you refuse an erasure request?
- You have a legal obligation to keep the data (e.g., accounting records)
- The processing is for journalistic, artistic, or literary purposes under Article 85 exemptions
- You can demonstrate compelling legitimate interests that override the subject's interests
The practical challenge: Erasing a person from hundreds of wedding photos is technically demanding. GDPR doesn't require the technically impossible — but it does require good faith efforts. If a guest asks to be erased from wedding photos, you should:
- Remove any online versions of identifiable images of that person
- Remove images from active marketing or portfolio use
- Where reasonably possible, delete or archive (with restricted access) images where they are prominently featured
- Document your response and the steps taken
Raw files, backup archives, and images where the person is a background figure in a group shot occupy greyer territory — document your reasoning.
Street Photography and Legitimate Interests
Street photography in public spaces is one of GDPR's most debated areas. The law varies by country, and the interaction between privacy rights and artistic freedom is genuinely unsettled.
The general position:
- GDPR applies to photographs of identifiable individuals even in public places
- There is no general "public space" exemption
- However, the legitimate interests basis can support street photography where images are used for artistic, journalistic, or documentary purposes
- Selling street photography commercially (e.g., stock photography of identifiable individuals) is riskier and may require model releases
The Article 85 derogations for journalistic and artistic purposes provide real protection for documentary and editorial street photographers. Most EU member states have implemented these exemptions, recognising the importance of photojournalism and artistic expression.
Practical guidance:
- Avoid photographing people in ways that could be considered intrusive or humiliating
- Don't photograph individuals in private situations visible from public spaces (through windows, etc.)
- If someone asks you to delete a photograph you've taken of them, consider doing so — even if not strictly required. The right to object is a real right, and starting an argument in the street is rarely worthwhile.
- Be especially careful with photographs of children in public spaces
CCTV vs. Photography: Key Distinctions
CCTV and photography are both covered by GDPR but treated differently in important ways.
CCTV (continuous surveillance recording):
- Requires a clear privacy notice (signage)
- Must have a documented DPIA (Data Protection Impact Assessment) in many cases
- Has strict retention limits (typically 30 days maximum in most contexts)
- Is regulated by specific ICO CCTV codes of practice in the UK
Photography (event-based image capture):
- More flexible consent/legitimate interests framework
- No mandatory DPIA unless processing at scale or using facial recognition
- Retention periods tied to purpose
The key distinction is the systematic nature of CCTV — it continuously records everyone who passes, without selectivity. Photography is selective and event-based. Both require a lawful basis and transparency, but the mechanisms differ.
Social Media Sharing of Event Photos
Posting photographs of identifiable individuals to social media is processing personal data. Before sharing:
- Clients/subjects you've photographed: Check your contracts and consent forms. If you have consent for portfolio use and the contract allows social media posting, you're generally fine.
- Guests and attendees: Ensure your pre-event communications informed them that images would be shared on social media, or tag/ask permission before posting close-up individual shots.
- Children: Don't post identifiable images of children without explicit parental consent.
- Tagging: Tagging someone in a social media post reveals their identity to a potentially wide audience. Apply the same consent principles as for publishing.
When images are shared to social platforms, those platforms become joint controllers of that data in many respects. Your privacy notice should reflect social media sharing practices.
Practical Template: GDPR-Compliant Model Release / Consent Form
Here's a template covering the key GDPR and consent requirements:
Photography Consent and Model Release
Photographer / Data Controller: [Your name / business name]
Contact: [email address]
Date of shoot: [date]
Location: [location]
Description of photographs: [Brief description of the shoot and images]
I consent to:
- [ ] Being photographed on the above date
- [ ] Use of my images in portfolio / website
- [ ] Use in social media (specify platforms): _______________
- [ ] Use in commercial / advertising materials
- [ ] Licensing to third parties
How my data will be used:
Your images will be stored securely by [Photographer name] and used only for the purposes you have consented to above. Your data will not be sold. Identifiable images will be retained for [X years / the duration of active portfolio use].
Your rights:
You have the right to access your personal data, to request correction or deletion, and to withdraw this consent at any time. Withdrawal of consent will apply to future use but cannot reverse publications already made. To exercise your rights, contact [email].
Data processing: Your images are stored on [cloud service / local storage]. Where third-party services are used, Data Processing Agreements are in place.
Signature: _________________________ Date: _____________
Name (print): _________________________
This template is a starting point. For complex commercial arrangements, consult a data protection specialist.
Checking Your Website's Privacy Compliance
If you run a photography business website — booking forms, client galleries, contact pages — you may be collecting personal data beyond just photographs. Email addresses, enquiry details, payment information, and analytics data all count.
Run a free scan at app.custodia-privacy.com/scan to see what trackers and data collection tools your website is running, and whether your privacy disclosures reflect what's actually happening. Results in 60 seconds.
This post provides general guidance on GDPR and photography. It does not constitute legal advice. Privacy law varies across EU member states, and your specific situation may involve additional considerations. Consult a qualified data protection professional for advice tailored to your circumstances.
Top comments (0)