GDPR and event photography: consent, opt-outs and what you can publish

Every corporate event with a camera in the room raises a data protection question, because a photograph or video of a person's face is personal data under UK GDPR the moment that person is identifiable. That does not mean you need everyone's written sign-off before you take a single frame, but it does mean the position needs thinking through properly rather than assumed away. Understanding GDPR and event photography in practical terms means separating two different questions: what basis are you relying on to take the images, and what are you allowed to do with them afterwards.

GDPR and event photography: consent, legitimate interests and the difference between them

Organisations generally rely on one of two legal bases when photographing people at events: legitimate interests, or consent. Which one fits depends heavily on how the images will be used. Photographing a conference for an internal report, an annual review or general record keeping often sits more comfortably under legitimate interests, because the use is limited, expected and proportionate. Using someone's image in external marketing, on the company website or in paid advertising is a different matter, and organisations are generally more cautious there, often preferring consent because the use is more visible, more permanent and less obviously expected by the person photographed.

Where consent is the basis being relied on, it has to be freely given. That has a very practical consequence for how you run the event: if someone declines to be photographed, refusing needs to be genuinely possible, not just a line in a policy document nobody reads. That is why an opt-out mechanism on the day matters so much. It is the difference between a policy that looks fine on paper and one that actually works in a room full of people.

Telling people in advance

People should know before they arrive that photography and filming will be taking place, what it is for, and how they can opt out. This normally happens in two places.

• A privacy notice at registration, explaining that photography or filming will take place, the general purpose (internal use, marketing, press, social media), how long images may be retained, and how to opt out or ask questions
• Signage on the day, at entrances and near any obvious photography or filming points, repeating the key message in a few lines that someone can read while walking past

Neither of these needs to be lengthy. The point is that nobody should discover after the event that they were photographed for a purpose they were never told about.

Making the opt-out work in practice

An opt-out only means something if the crew on the ground can actually act on it. The most reliable method we use is a visible marker, commonly a different lanyard colour or a badge sticker, given to anyone who does not want to be photographed. That marker needs to be briefed to every single crew member before doors open, not just the lead photographer, because a delegate who has opted out may cross paths with a videographer, a headshot operator or a social media team member at any point in the day. If the marker only lives in one person's head, it does not work.

An opt-out that only the photographer knows about is not an opt-out, it is a hope.

Marketing use needs more care than internal records

Treat the two uses differently. An internal highlights reel or an intranet gallery is generally lower risk. Putting someone's face on the front page of your website, in a paid social campaign or in a press release is a bigger step, and deserves a more deliberate basis, usually clearer consent, particularly for anyone who might reasonably object to being associated with your brand in public.

Children and vulnerable adults

Corporate events are not usually built around children, but they do turn up, at family days, award ceremonies and some hybrid public events. Extra care is needed here. Do not assume a parent or guardian's general presence at an event amounts to consent for photography of their child, and build a specific, clear process for this rather than relying on the standard adult opt-out.

Handling a removal request after the event

People can ask, after the fact, for images of themselves to be removed or for use to stop. Have a simple route for this. In practice that means someone owns the request, the photo or video library is searchable enough to find the relevant images, and there is a clear point at which any published use, a web page, a social post or a printed piece, gets taken down or amended. The slower and vaguer this process is, the more it looks like nobody is really responsible for it, which is its own kind of risk.

A short checklist

1. Registration privacy notice covering purpose, retention and opt-out
2. Signage at entrances and photography points
3. A visible, consistent opt-out marker, briefed to the whole crew before doors
4. A clear split between internal use and external marketing use
5. A specific process for children and vulnerable adults
6. A named owner for removal requests after the event

This is general information about how event photography and data protection usually work in practice, not legal advice, and it is not a substitute for advice on your own circumstances. The right basis for your event, and the right wording for your privacy notice, depends on what you are photographing, who is in the room and what you intend to do with the images afterwards. Anything material, particularly your privacy notice wording and your approach to marketing use, is worth checking with your own legal team or a solicitor before the event rather than after it.

If you have an event coming up and want to talk through how we handle consent, opt-outs and crew briefing on the day, send us your date, venue and brief and we will build it into the plan from the start.

← All twenty guides