GDPR for Photographers: Handling Client Data

Under GDPR, a photographer who handles personal data must know what they hold, have a lawful reason for holding it, keep it secure, keep it only as long as needed and respond when people ask about it. In practice that means an inventory, a short privacy notice, sensible retention periods and clear wording about images.

This is general information, not legal advice. GDPR applies in the EU, and the UK has a similar regime. Other countries have their own laws. Ask a local adviser or your data protection authority about your situation.

What personal data you hold

Start by listing it. You probably hold more than you think.

• Contact details. Names, emails, phone numbers, addresses.
• Event details. Dates, venues, names of family and guests.
• Financial details. Invoices, payment records. Card numbers should stay with your payment provider, not in your files.
• Photographs and videos. Images of identifiable people, including children and guests.
• Notes. Health or dietary information, accessibility needs, family situations. Some of this is sensitive.
• Inquiry forms and emails.
• Marketing lists.
• Website data. Analytics, cookies, form submissions.
• Team data. Freelancers and assistants' details.
• Contracts and signatures.

A simple table helps:

The retention periods above are examples. Your accountant can tell you how long financial records must be kept.

Lawful basis in plain terms

GDPR says you need a lawful basis for using personal data. In everyday terms, these are the ones most relevant to photographers.

• Contract. You need the data to deliver the service the client booked: contacting them, invoicing them, taking and delivering photos.
• Legal obligation. You must keep invoices and tax records.
• Consent. The person freely agrees, in a clear way, to something specific, such as receiving marketing emails or having their photo used on your website. They can withdraw it.
• Legitimate interests. Your business has a genuine reason, and it does not override the person's rights. Examples: keeping a backup of delivered work, or following up on a past client. You should weigh it and write down your reasoning.

Practical points:

• Booked clients. The contract usually covers the shoot and delivery.
• Marketing. Use consent. Ask separately from the contract, with a clear tick box that is not pre-ticked.
• Guests at events. You may photograph them as part of the client's event. Tell the client to let guests know, and respect anyone who says they do not want to be photographed.
• Children. Take extra care. A parent or guardian should agree to the use of their images.
• Sensitive data. If a client tells you about health needs, hold it only as long as necessary and keep it secure.

Our post on website terms and conditions covers how to present this to visitors, and photography contract mistakes lists wording problems to avoid. For another regional example, see India's DPDP Act for photographers.

Keeping and deleting

You should not keep data forever just in case.

1. Decide a retention period for each type of data.
2. Write it in your privacy notice. "We keep delivered photos for three years, then delete them."
3. Check your backups. Deleting from the main folder but not the backup defeats the point.
4. Delete on schedule. Put a yearly review in your calendar.
5. Handle requests. People can ask for a copy of their data, correction or deletion. Reply within the timeframe the law sets (often one month). Verify who is asking.
6. Secure what you keep. Strong passwords, two-step sign-in, encrypted drives for travel, limited access.
7. Plan for breaches. A lost laptop or a shared link sent to the wrong person may need to be reported. Know who to contact.

Exceptions apply. You may need to keep invoices for tax. If a dispute is ongoing, you may keep related records. Document the reason.

Some photographers keep a long-term archive of their best work, with client agreement. If that is you, say so in your contract and give clients a way to opt out. See also archive retention.

Galleries and consent

Delivering photos to a client is a normal part of the job. Sharing them more widely needs thought.

• Private galleries. Use passwords or private links.
• Guest access. If the client shares the gallery with guests, they decide who sees it.
• Facial recognition. Some gallery tools offer face grouping. Check the settings and your privacy notice.
• Portfolio and social media. Get written permission for public use. Make opt-out easy.
• Children. Be extra cautious about posting images of children publicly.
• Takedowns. If someone asks you to remove an image, act promptly.
• Third parties. If you use a gallery host, an email service or a cloud backup, they process data for you. Check their terms and where data is stored.

Our post on commercial photography contracts covers releases for commercial work, and the one on scope creep explains how to handle later requests, such as new uses of images.

Example wording

This is an example, not legal advice. Change it.

We keep your contact details and contract for seven years for accounting reasons. We keep your final photos for three years and then delete them unless you ask us to keep them for longer. We only use your images in our portfolio or marketing if you tick the box on your contract, and you can change your mind at any time by writing to us.

Where to get advice

You do not need to become a lawyer, but you should check your setup once.

• A local solicitor or privacy consultant can review your privacy notice and contract wording.
• The data protection authority in your country publishes guidance for small businesses, often for free.
• Your professional association may have templates and training.
• Your accountant can advise on retention for financial records.

Take notes about what you have, why you have it and what you do with it. If someone asks, that record is your first answer.

Client data in one place

The easier it is to find a client's data, the easier it is to answer a request. With ClickBook, the lead, proposal, contract, invoices and project notes sit with the client, so there is one place to look. Team roles limit what editors and freelancers see. See the demo.

Make a list, write a short notice, set retention and review it once a year.

Frequently asked questions

Does GDPR apply to me as a photographer?

It can, if you are based in the UK or EU, or if you offer services to people there. The UK has its own version. Check with a local adviser or the data protection authority where you work.

Do I need clients' consent to photograph them?

Consent is one lawful basis, but for a booked job you may rely on the contract instead. Marketing use of images usually needs a clear, separate agreement.

How long can I keep client photos?

There is no fixed number. You need a reason and a stated period. Many photographers keep originals for a set time and tell clients what it is.

What should a privacy policy say?

What you collect, why, who sees it, how long you keep it and how people can ask to see, correct or delete it. Keep it short and clear.