Rules and ethics
Part of Before you publish images, know the UK rules that apply to product photography
How to handle product photography data protection before a shoot
A practical guide to product photography data protection: how UK GDPR applies to model and customer images, consent, retention and the checks to run before a shoot.
What to take away
Product photography data protection means handling any image that identifies a living person, such as a model, customer or employee, under the UK GDPR and the Data Protection Act 2018.
- If someone in a photo can be identified, the image is personal data and the UK GDPR applies.
- Choose the lawful basis before the shoot, not after editing.
- Agree consent wording, retention and deletion dates with the studio in writing.
- The Information Commissioner's Office publishes the UK GDPR guidance and resources that set out these duties.
- File the paperwork with the image files so an audit can trace who agreed to what.
One data protection statute covers England, Scotland, Wales and Northern Ireland.
Does product photography count as personal data?
A plain shot of a kettle is not personal data. Add a hand holding it and the picture may identify someone, bringing it inside the UK GDPR. Customer photos reused in reviews, staff in warehouse shots and models in lifestyle scenes all count.
Identifiability is the test, not the subject of the shot. A face, a tattoo or a name badge can be enough; if you cannot rule identification out, treat the image as personal data and record your reasoning.
What lawful basis should you rely on?
Consent suits models and customers because they can withdraw it. Legitimate interests can cover expected staff images if you record a balancing test. Contract rarely works for a model release on its own.
The basis must be chosen before the shoot. Retrofitting one after a complaint is weak ground. With consent, keep a dated record of what the person agreed to and where the image would appear.
What should a model or customer release cover?
A release should name the organisation, describe the images, list the channels and state the retention period. It should explain how to withdraw consent and what happens to already published images. Avoid open-ended wording that covers all media in perpetuity.
The release sits alongside your commercial terms, so pair it with the guidance in product photography commercial contracts before signing with a studio or freelancer.
How long can you keep the images?
Keep personal data only as long as you need it. A model image for a seasonal campaign might run for the campaign plus a short archive window, then be deleted. Product-only shots carry less risk and can stay longer.
Set a deletion date in your asset management system and give someone responsibility for it. If a person withdraws consent, stop using the image and remove it from live channels where you reasonably can.
What are the risks in paid visual marketing?
Consumer protection law also applies to images used in advertising. The Competition and Markets Authority enforces rules against misleading commercial practices, which can cover doctored or misdescribed product visuals.
Advertising codes add a further layer. The list of non-compliant online advertisers shows what follows when advertisers ignore rulings, so check it before briefing a campaign.
Data protection and advertising rules often meet on the same shoot, so the wider picture in the UK rules and compliance guide for 2027 is worth reading before writing a policy.
What should be in a pre-shoot checklist?
Run this before any shoot involving people.
- Confirm whether an image will identify a living person.
- Choose and record the lawful basis.
- Issue a release naming channels and retention.
- Explain how to withdraw consent.
- Agree storage, access and deletion dates with the studio.
- Check the brief against advertising and consumer rules.
- File the paperwork with the shoot folder.
For example, a retailer paying £400 a day for a studio session should still spend twenty minutes on this list.
Common questions
Do I need consent to photograph my own staff?
Not always. Legitimate interests can cover expected workplace images if you record a balancing test and tell staff how the photos will be used. Ask for consent when the use is promotional or unexpected.
Can I use a customer photo from a review?
Only with a lawful basis and a clear understanding of the use. A public review photo is not free to reuse in advertising just because it is visible, so ask first.
Who enforces data protection in England?
The Information Commissioner's Office enforces the UK GDPR and can issue fines and reprimands. Individual cases need a qualified adviser, because outcomes turn on specific facts and contracts.
Does deleting an image remove it from search engines?
No. You can remove it from your own channels, but cached or copied versions may persist, so plan for that when agreeing retention with a model or customer.
