Internal, open access

Photographic images

Photographic images of individuals and small groups can be defined as personal data and therefore fall within the scope of the Data Protection Act (DPA) 2018. However, there is some legal ambiguity about exactly which types of photographs and images of people constitute personal data. Some examples are given below by way of guidance. To err on the side of caution all University staff who deal with any photographic images of people should ensure that when they are processing this data they comply with the Data Protection Principles. To help you to do this some guidance on good practice in collecting and using photographs is given. These guidelines have been written based on recommendations given by JISC Digital Media. A checklist of the main questions to consider when processing photographic images is also given.

Further advice is available on the Copyright webpage, Image Release Forms which considers both Data Protection and Copyright laws.  

Examples of images that are personal data

Where an individual is the focus of an image the image is likely to be personal data. Examples include:

  • photographs of individuals that are stored with personal details, for example, for identity passes
  • photographs of staff or students published on notice boards along with some biographical details
  • individual images published in a newsletter

Examples of images that are not personal data

Where individuals are incidentally included in an image or are not the focus, the image is unlikely to contain personal data. Examples include:

  • where people are incidentally included in an image or are not the focus, for example at a busy open day, the image is unlikely to contain personal data
  • images of people who are no longer alive; the DPA only applies to living people so these images are not personal data

Photographs taken for purely personal use

Photographs taken for purely personal use are exempt from the Data Protection provisions; these would include photographs and videos taken by family members at a graduation ceremony.


Good practice in collecting and using photographs

Advice is given on the following:

Photographs of individuals

You should obtain the subject's consent in writing before photographing; this is the easiest and safest way of proving you have obtained the image fairly and in accordance with the individual's rights, both key elements of DPA compliance.

To get this consent, use the appropriate form from the Copyright webpage, Image Release Forms. These forms ensure that when you collect the image(s) you are not only acquiring consent, but also telling the subject what is being collected, why it is being collected and the limits on processing (use, disclosure and disposal).

If you wish to design your own image release form, please, speak to the Copyright department to ensure compliance with relevant laws. The "small print" or collection text should always include the following information:

  • a statement that the University processes and stores information in accordance with the Data Protection Act (DPA) 2018
  • an explanation of the main reason for collecting the image, the purpose of processing
  • a means of obtaining the consent of the individual where required, for example, when intending to publish their image or when taking it from or passing it to third parties
  • whether the image will be released to third parties and who those third parties are
  • where the image will be used
  • a means for the individual to opt out now or later if they wish
  • how long the image will be held, how it will be maintained and eventually destroyed
  • an explanation of how the individual can see the personal information about them being held

A step by step guide to creating such forms is given on the Copyright webpage, however please, liaise with prior to using any self-created form.

Photographs of large groups

It will usually be enough for the photographer to verbally ask permission to take the photograph to ensure compliance with the DPA. Anyone not wishing to appear on a group photograph will then have the opportunity to opt out. This approach can be used when photographing, for instance, a seminar.

Photographs of small groups

For photographs taken of a small group of individuals best practice would be to seek consent before photographing begins. When acquiring this consent, it is important to ensure that individuals are informed what the images will be used for (for example where they will be published and who will have access to them).

In most cases, verbal consent is all that will be required although photographers may wish to use the  to be signed by the subject(s), to ensure that they have appropriate consent.

Using photographs on the web

If you wish to use photographs of individuals on a website, the information is potentially being disclosed beyond the EEA and, consequently, it is essential that the explicit consent of the individuals concerned is obtained. You can use the  to obtain this consent.

When displaying/disclosing personal information in either of these ways, you have a duty, under the DPA, to keep the information up-to-date. Also, you must provide the staff/students with a means of opting out at a later stage even if initially they gave their consent. See the for a sample form to collect permission to use photographs on the web.

Photographs and sensitive personal data

The DPA defines sensitive personal data as a class of data with special rights. This data can only be used in appropriate circumstances, such as a medical context or in the pursuit of equal opportunities.

If you suspect the images you are about to process could be sensitive personal data, please contact us, for guidance.

Exemptions from the Data Protection Act

The DPA provides some exemptions from the Act's provisions if, for instance the image is being processed for journalistic, literary and artistic purposes, or for research purposes. It is difficult to provide generic guidance here as each case must be dealt with on a case by case basis.

If you believe the images you are processing could fit these exemptions, please contact us for guidance.

Using images without the consent of the subject

Using images of people who have not given their consent can expose the University to the risk of a legal claim or damage of reputation. If you do not have the consent of the subject then consider using a different (more reliable) image.

If you suspect the images you are about to process are without the consent of subjects, please contact us for guidance.

Storage of photographic images

Under the DPA photographs (as personal data) must be kept secure.

Checklist when processing photographic images

Some questions to consider when processing photographic images:

  • For what purpose was the photograph originally taken? Bear in mind that if it was taken for one purpose (for example, personal use) it cannot then be used for another (for example, business use) without the explicit consent of the individuals concerned
  • Is the image sensitive personal data? If it is, do you have the data subject's explicit consent?
  • When photographing with small groups and individuals, has an image release form been used?
  • When photographing large groups, have the individuals been given a chance to opt out of the photograph?
  • Has the subject been told how the image will be used?
  • Are you using the image according to how the subject was told it would be used?
  • Are you authorised to process the image?
  • Has the Data Protection Officer been notified that you are processing images for a particular purpose?
  • Are you sure that the image will be held securely?
  • If you do not have the subject's consent to process their image, what is the purpose of this image?
  • Do you know how long to keep the image for, and when and how to dispose of it?

Things to do now


Contact IMPS

Report an

Find out if you need to do a DPIA here:

Page navigation


Search Form

A-Z lists