News top

What GDPR means for photographers?

The General Data Protection Regulation is effective as of 25th May 2018 and if you run a business, no matter how small, you have to comply with the new rules of data privacy. If you are professional photographer, wondering if GDPR applies for you – the shorter answer is YES, so you have to be prepared.

According to GDPR, pictures of people that can be identified are to be considered as personal data and have to be handled carefully. GDPR allows picture, if the purpose is journalistic, academic or artistic. In all other cases you need to think about your legal ground of possessing the photos – agreement or consent.

There are number of scenarios where you, as a professional photographer, have to ask your subjects for their explicit consent, to process photos containing their images. For example, if you have taken pictures of the staff for a company, you must have a consent with each of the individuals, i.e. it is not enough to have an agreement with the company. Make sure to have the data subject consent in writing, because it is hard to prove it, if it was said verbally.

It is crucial to inform your clients what you are doing with their images, so always be fair and transparent. It is also important to consider the period for which you will store the images – you need to inform your clients about it.

Another situation you have consider is when you are taking photos of children. GDRP is considering children data very seriously, so you need to obtain the parental consent, before taking photos. For example if you are hired to take photos on children birthday, don’t be afraid to ask how the consent forms are handled.

Last, but not least you must always inform the subjects that you are taking photo of, about their data privacy rights:

  • Right of access – if requested, you have to provide copy of the personal data you hold
  • Right to rectification – you have to make sure the personal data is up-to-date and accurate
  • Right to erasure – if requested, you are obligated to erase the personal data you hold, unless it is needed for legal purposes
  • Right to data portability – the data subject have the right to have its data available in structured format
  • Right to restrict processing – if requested, you must stop processing the personal data of the relevant individual
  • Right to lodge a complaint – the data subject has the right to file a complaint with the local data processing authority


Photos are just one topic in the scope of GDPR. However, the regulation applies to ALL organizations that handle personal data of individuals residing in the European Union. Are you prepared for a GDPR audit? Use GDRPQ – a comprehensive self-assessment tool to generate your compliance evidence report with an easy-to-update progress tracker and action plan.

Try it now on


A honlap utolsó módosításának időpontja: 2019.10.01