GDPR and Event Photos: Consent, Storage, and Privacy-First Photo Sharing
Event photography sits at the intersection of creativity and privacy law. Every photo you take at an event contains personal data — faces, locations, and sometimes sensitive moments. As privacy regulations tighten globally, event photographers and organizers need to understand their obligations and implement privacy-first practices.
GDPR for event photos, in short: treat photos of identifiable people as personal data. Choose a lawful basis and tell people at registration and at the venue that the event is photographed. Store photos securely, limit access to the people who need them, keep them only as long as your stated purpose requires, and have a simple way to handle deletion requests. This is practical guidance for photographers and organizers, not legal advice.
Understanding the Legal Landscape
GDPR (European Union)
- Photos containing identifiable faces are personal data under GDPR.
- You need a legal basis to process this data — typically "legitimate interest" for event photography.
- Individuals have the right to request deletion of their photos.
- Data must be stored securely and not retained longer than necessary.
India's Digital Personal Data Protection Act (DPDPA)
- Consent is required for processing personal data, including photographs.
- Special provisions for children's data — relevant for school events.
- Data fiduciaries must implement reasonable security safeguards.
Consent Management at Events
Implicit consent
- Include a photography notice on event invitations and registration forms.
- Display signage at the venue: "This event is being photographed. By attending, you consent to being photographed."
- This is generally sufficient for most events under "legitimate interest."
Explicit consent
- For sensitive events (medical conferences, support groups), get written consent.
- For children's events, get parental consent before photographing.
- Include an opt-out mechanism: "If you do not wish to be photographed, please inform the event staff."
Privacy-First Photo Sharing Practices
- Access controls: Use PIN-protected galleries so only authorized people can view photos.
- Private links: Share gallery links only with the people they are for. A PIN keeps the photos private, but the event name and cover photo appear on the link preview, so choose the cover with that in mind.
- Download controls: Choose whether viewers can download original files or only view.
- Expiry dates: Set gallery access to expire after a reasonable period.
- Deletion requests: Have a process for removing specific photos when requested.
AI Face Recognition and Privacy
AI face recognition raises specific privacy considerations:
- Opt-in model: Kamero's face recognition is opt-in — guests choose to take a selfie to find their photos. No one is tracked without their action.
- Purpose limitation: Face data is used to match guests to their own photos, and not for any other purpose.
- Transparency: Clearly communicate how face recognition works, including where the selfie is stored: "Take a selfie to find your photos. Your selfie is stored on our servers against your account, and deleting it erases the stored photo from our servers and object storage."
Children's Events: Extra Precautions
- Get parental consent before photographing children at school events.
- Use PIN-protected galleries with access limited to parents and staff.
- Do not share children's photos on public social media without explicit parental permission.
- Allow parents to request removal of their child's photos.
- If guests can upload photos, use Kamero's guest upload moderation to review those photos before anyone else can see them.
Data Security Best Practices
- Encrypted transfer: Ensure photos are transferred over encrypted connections (HTTPS/FTPS).
- Secure storage: Use platforms that store photos on encrypted cloud infrastructure.
- Access logging: Track who accesses the gallery and when.
- Data retention policy: Define how long photos are stored and when they are deleted.
- Vendor assessment: Ensure your photo sharing platform meets security standards.
GDPR and Photo Storage: Where and How Long
Photos tend to outlive the reason they were taken, so decide three things about storage before the event:
- Where the photos live: keep them in one gallery platform with access controls rather than spreading copies across personal drives, chat groups, and USB sticks. Every extra copy is another one to secure and delete.
- Who can open them: limit access to guests, the client, and staff who need it. Use a PIN or private link for anything that should not be public.
- How long you keep them: pick a period that matches your purpose, write it in your notice, and delete or archive when it ends. If you keep raw files after delivery, include them in the same retention period.
How Kamero Handles Event Photo Privacy
Kamero is designed to comply with GDPR requirements. Whether your event complies still depends on how you collect, share, and keep photos, and on what you tell your guests, so use these controls alongside your own notice and policies:
- Face data stays within one event: face vectors are isolated to each event and are never matched across events.
- No identity linking: face data is indexed against random IDs and is not linked to a guest's name, email, or phone number. There is no human review of photos or selfies.
- Deletion: face data is deleted when its photo, album, or event is deleted, or in a scheduled clean-up shortly after the event expires. When a guest deletes their selfie, the stored image is erased. A numeric signature is kept so shared and purchased links keep working, and the guest can email dpo@kamero.ai to have it erased too.
- Event deletion: deleting an event permanently removes its photos, face recognition data, guest registration details, and download history.
- Optional face search: guests who do not want to use face recognition simply do not take a selfie and use an event PIN or a link instead. They can also ask for their face data to be removed from the event.
- Access controls: PIN-protected events, Face-based Privacy so each guest sees only photos they appear in, Guest Registration before viewing, and download settings including view-only galleries. See the download permissions guide.
- Security: TLS 1.3 in transit, AES-256 encryption at rest, photo URLs that cannot be guessed, and audit logs of uploads, deletions, settings changes, access, and downloads.
Photos stay available until the event pack validity or the subscription ends, with a 7-day grace period after expiry. For specific GDPR or CCPA questions, contact Kamero's support team, and read the GDPR compliance page and privacy policy for the full terms.
Practical Checklist for Event Organizers
- Include photography notice in event registration and invitations.
- Display signage at the venue about photography.
- Provide an opt-out mechanism for attendees who do not want to be photographed.
- Use a privacy-first photo sharing platform with access controls.
- Get parental consent for children's events.
- Have a process for handling photo deletion requests.
- Define and communicate your data retention policy.
- Ensure your photographer and photo sharing platform comply with applicable privacy laws.
Frequently asked questions
Are event photos personal data under GDPR?
Yes, when a person can be identified in them. A photo with a recognizable face is personal data, so collecting, storing, and sharing it needs a lawful basis, a clear notice to the people photographed, secure storage, and a way to handle requests to see or delete their photos.
How long can you store event photos under GDPR?
GDPR does not set a fixed period. It requires that personal data is kept no longer than needed for the purpose you told people about. Decide a retention period before the event, state it in your notice, and delete or archive photos when it ends. On Kamero, photos stay available until the event pack validity or the subscription ends, with a 7-day grace period after expiry.
Do I need consent to share event photos?
It depends on the purpose and the people involved. Many organizers rely on legitimate interest with a clear notice for general event coverage, and ask for explicit consent for children, sensitive events, and marketing use of identifiable people. Check the rules that apply to you, since this is practical guidance and not legal advice.
How do I choose a GDPR compliant photo sharing app?
Look for access controls such as PINs and private links, control over downloads, encryption in transit and at rest, audit logs, a clear retention period, and a way to honor deletion requests. For face recognition, check that face data is limited to the event and is not tied to people's identities. Kamero is designed to comply with GDPR requirements, and its support team answers specific GDPR or CCPA questions. Your own notice and retention policy still decide whether your event complies.
Can I post event photos on social media under GDPR?
Posting identifiable people publicly is a separate use from sharing a private gallery with attendees. Tell people in your notice if photos may be used on social media, avoid posting children or sensitive moments without explicit permission, and remove a photo quickly when someone asks.