GDPR for School Photography: Consent, Minors, and What’s Different

Date: 11/11/2026

Everything in event photography, plus a higher bar

School photography starts from the same place as general event photography — see GDPR for Event Photographers: What You Need to Know. A photo of an identifiable person is personal data, and commercial photography doesn’t qualify for the “purely personal” household exemption. What changes with school photography is the subject: children, who GDPR says merit specific protection because they may be less aware of the risks, consequences and safeguards involved, and of their rights, in relation to the processing of their personal data (Recital 38).

Consent is the practical default

Where general event photography can often lean on legitimate interest, school photography usually shouldn’t. When you weigh a business interest against a child’s interests, GDPR tells you to give particular weight to the child (Article 6(1)(f)) — and public schools, as public authorities, cannot use legitimate interest for processing carried out in the performance of their tasks (Article 6(1), second subparagraph). For photographing children and using their images — even a standard class or individual portrait — clear, specific consent from a parent or guardian is the practical standard, not something assumed from a general “photography will take place” notice. GDPR doesn’t mandate consent for every school photo, but it is usually the safest basis.

You may have heard about a “digital age of consent”. That rule (Article 8) applies when information society services (online services) are offered directly to a child — the age at which a child can consent on their own ranges from 13 to 16 across the EU, and in Cyprus it is 14 (Article 8, Law 125(I)/2018). It isn’t what governs a school photo shoot: there, the arrangement runs through the school and the parents, so parental consent remains the practical standard regardless of the child’s age.

What consent needs to cover

A parent signing off on school photos should know:

That photography is taking place and by whom (which photographer or company).
What the photos will be used for — individual or class portraits for purchase, a yearbook, the school website, prospectus materials or social media are all different uses and should be itemised, not bundled into one blanket “yes” — GDPR expects people to be able to consent to each purpose separately (Recital 43).
How long images will be kept, and by whom (the school, the photography company, or both).
How to say no to specific uses (happy with a class photo, not comfortable with website use) without opting out of everything — and that consent can be withdrawn later, as easily as it was given (Article 7(3)).

Working with schools as the photographer

In most arrangements, the school has the direct relationship with parents and is the controller for the collection of consent, while the photography business processes the images to fulfil that arrangement. That calls for a data processing agreement under Article 28 between you and the school covering how images are stored, used and eventually deleted — see Data Processing Agreements: What They Are and When You Need One. If you also sell prints directly to parents or reuse images for your own purposes, you become a controller for that part and need your own lawful basis and transparency towards parents. A processor that uses images for its own purposes outside the school’s instructions infringes GDPR and is treated as a controller for that processing (Article 28(10)), so the agreement should expressly cover and describe any such use.

Practical points worth confirming with any school before a shoot:

Who collects and stores the parental consent records — you or the school?
What happens with children whose parents didn’t consent — they need to be excluded from group shots or handled in a clearly different, non-published way.
What is the retention period for both proofs and final images? See How Long Can You Legally Keep Customer Data?
Who is the point of contact if a parent later asks for a photo to be deleted? See A Customer Asked You to Delete Their Data

The bottom line

School photography is a normal, valuable service — but it’s the one area of photography where you should assume you need clear, itemised parental consent rather than relying on general notice-and-opt-out. Getting that structure right at the start, in writing with the school, avoids awkward conversations later.

Working with schools and want your consent process checked? Let’s Talk GDPR.