Rules and ethics
Part of Before you publish images, know the UK rules that apply to product photography
Product photography data protection in England: identifiable images, lawful basis, consent and retention
How UK GDPR applies to product photography in England: when an image is personal data, which lawful basis to pick, valid consent for models and retention.
What to take away
Product photography data protection means handling any image that identifies a living person, such as a model, a customer or an employee, under the UK GDPR.
- If someone in a photo can be identified, the image is personal data and the UK GDPR applies.
- Choose the lawful basis before the shoot, not after editing.
- Consent must be freely given, specific, informed and unambiguous, and easy to withdraw.
- Set a retention period, and delete files on schedule.
- File the paperwork with the image files so an audit can trace who agreed to what.
Does product photography count as personal data?
Information about an identifiable living individual is what counts. A plain shot of a kettle is not personal data. Add a hand holding it and the picture may identify someone.
Data is personal when an individual can be identified or identifiable, directly or indirectly, from one or more identifiers or from factors specific to them. A face, a tattoo or a name badge can be enough.
Identifiability is the test, not the subject of the shot. Customer photos reused in reviews, staff in warehouse shots and models in lifestyle scenes all need the check. If you cannot rule identification out, treat the image as personal data and record your reasoning.
Which lawful basis fits which person under UK GDPR Article 6
Pick a lawful basis for every use of personal data. Consent, contract, legal obligation and legitimate interests are among the options. Pick the basis for each group before the shoot, because retrofitting one after a complaint is weak ground.
| Person in the image | Likely basis | Why |
|---|---|---|
| Professional model | Contract, or consent for extra uses | The booking is a contract; extra uses need a release |
| Customer whose photo you reuse | Consent | No contract covers advertising use |
| Staff in a catalogue shot | Legitimate interests, or consent | Record a balancing test, and tell staff |
| Passer-by in a location shot | Avoid, or obtain consent | Identification cannot be ruled out |
Legitimate interests means the processing is necessary for your legitimate interests or those of a third party, unless the person's own interests override them. That needs a recorded balancing test. See the risk scenarios for cases that go wrong.
What valid consent looks like
Valid consent, as the ICO consent guidance explains, is freely given, specific, informed and unambiguous. People must be able to refuse consent without detriment, and must be able to withdraw consent easily at any time.
Look at whether the individual took a relevant action and whether it was freely given, based on objective facts. Freely given consent is also more difficult to obtain where there is an imbalance of power, particularly with employers. So treat staff consent with caution, and lean on a recorded balancing test where it fits.
A model release should sit alongside your commercial contracts. It should name the organisation, describe the images, list the channels, state the retention period and explain how to withdraw. Avoid open-ended wording that covers all media in perpetuity.
How long to keep the images
Keep personal data no longer than you need it. A policy setting standard retention periods is the safest route wherever possible, so write one for photography.
For example, your own policy might keep a campaign image for the campaign plus a 12-month archive window, then delete it. That period is an illustrative choice, not a legal limit.
Set a deletion date in your asset management system and give someone responsibility for it. If a person withdraws consent, stop using the image and remove it from live channels where you reasonably can.
Product-only shots hold no personal data, so they can sit under a different, longer rule. Keep the two groups in separate folders to make that easy.
If a person asks for their image
Expect people to ask what you hold about them through a subject access request. Aim to respond quickly, and always within one month of receiving the request. Know where every image of a person is stored, and who can find it.
Agree with the studio who answers such requests. A freelancer or agency that holds your raw files can slow you down, so put the response time into the vendor due diligence checks and the contract.
A pre-shoot checklist
Run this before any shoot involving people.
- Confirm whether any image will identify a living person.
- Choose and record the lawful basis for each person.
- Issue a release naming channels, retention and how to withdraw.
- Agree storage, access and deletion dates with the studio in writing.
- Name who answers a request for images within one month.
- File the paperwork with the shoot folder.
Add the sign-off step to your quality checklist, and to the wider UK rules and compliance guide for the rest of the shoot. Cover the studio's insurance in the product photography insurance review.
This is general guidance only. Individual cases need a qualified adviser.
Common questions
Do I need consent to photograph my own staff?
Not always. Legitimate interests can cover expected workplace images if you record a balancing test and tell staff how the photos will be used. Ask for consent when the use is promotional or unexpected, and make refusal safe.
Can I use a customer photo from a review?
Only with a lawful basis and a clear understanding of the use. A public review photo is not free to reuse in advertising just because it is visible, so ask first.
Does deleting an image remove it from search engines?
No. You can remove it from your own channels, but cached or copied versions may persist, so plan for that when you agree retention with a model or customer.
