GDPR for Event Photographers: What You Need to Know

Date: 04/11/2026

A photo is personal data the moment someone is identifiable

It surprises a lot of photographers: a photo of a recognisable person is personal data under GDPR, exactly like a name or an email address (Article 4(1)). That doesn’t mean you need signed consent from every guest at a wedding or conference before you lift the camera — but it does mean you need a lawful basis (Article 6(1)) for taking, keeping and using those images, the same as any other business handling personal data.

The “purely personal” exemption doesn’t cover you

GDPR does not apply to processing done by an individual in the course of a purely personal or household activity (Article 2(2)(c)) — the classic example is a guest taking photos at a family birthday party and keeping them private. The moment photography becomes a business activity — you’re hired, paid, or operating as a company — that exemption no longer applies, and GDPR does.

Who is responsible then depends on the arrangement. A photographer who decides how and why images are taken and reused — for example in their own portfolio — is a controller. A photographer who only shoots and delivers images strictly on a client’s instructions may be acting as that client’s processor. Often it’s a mix, which is why it’s worth spelling out in your contract who is responsible for what.

Choosing your lawful basis

Two bases cover most event photography:

Legitimate interest can cover general event photography — capturing the atmosphere of a wedding, conference or party — provided three conditions are met: you have a legitimate interest, the photography is necessary for it, and guests’ interests and rights don’t override it. Document that assessment so you can show compliance (Article 5(2)), be transparent about it (event signage, a line in the invitation), and give people a straightforward way to object.
Consent is the safer, and often more defensible, basis for anything more targeted or commercially significant — a close-up portrait used in your own marketing, a photo featured on your website or social media, or any image used for a purpose beyond documenting the event itself.

Take extra care with children, who are at most weddings and parties: GDPR singles out children as needing particular care when you weigh your interests against theirs (Article 6(1)(f)).

Practical steps that cover most situations

Be visibly transparent at the event — a sign at the entrance or a line in the invitation (“Professional photography will take place at this event”), linked to a full privacy notice explaining who you are, the purposes, your lawful basis and legitimate interest, how long you keep images and people’s rights (Article 13).
Get specific permission for anything beyond documentation — using a shot in your portfolio, on your website or in an ad: in practice consent is usually the safest basis here, because it is hard to show that a guest’s interests don’t override yours.
Have an easy opt-out — someone who doesn’t want to appear should be able to say so, and you should be able to honour it (framing around them, removing specific shots). Under legitimate interest, people have the right to object (Article 21); under consent, they can withdraw it at any time (Article 7(3)).
Handle deletion requests properly — if someone later asks you to remove a photo of them from your marketing, you must erase it if you relied on consent, or if they object and you have no overriding grounds, subject to limited exceptions (Article 17). See A Customer Asked You to Delete Their Data.
Apply retention rules to raw files too — an old hard drive of unedited event photos is still personal data, and should be kept no longer than necessary (Article 5(1)(e)). See How Long Can You Legally Keep Customer Data?

What this doesn’t mean

None of this is a reason to stop offering event photography — it’s the same expectation every other business already meets. Photograph the event, be upfront about it, get specific permission for anything beyond that, and respect a request to stop or delete.

Photographing events and want a simple, compliant setup? Let’s Talk GDPR.