Event Photos and GDPR: A Practical Guide for Hosts

The Short Answer

Start with the intended audience and use: a family album, an employee recap, and a public advertisement are different activities. Identify who decides why and how the photos are used, check whether GDPR applies, and document the appropriate lawful basis and information for attendees. The overview below explains the decisions to discuss with your privacy adviser for a business or public event.

When event photographs fall within GDPR

An identifiable face or a combination of details can make a photograph personal data. GDPR territorial scope is not simply a question of someone being an EU resident: Article 3 covers processing connected with an EU establishment and specified offering or monitoring activities involving people in the EU.

Article 2(2)(c) excludes processing by a person in the course of a purely personal or household activity. A wedding album shared within family and friends may fall within that exemption. Public distribution, a photographer’s business processing, or venue marketing needs its own assessment; the private nature of the celebration does not exempt every participant’s use.

For a company event, identify the organization or other party deciding the purposes and means of processing. Responsibilities depend on that role and the arrangement with photographers and service providers. A guest who contributes a photo does not thereby grant every other party permission to reuse it.

Before the event: record purpose, access and a lawful basis

Write down the purpose, intended audience, retention period, removal contact, and whether photos will appear on a venue screen. Give attendees clear information before collection and an accessible way to raise concerns. A sign announcing photography provides information; attendance alone is not a substitute for valid consent.

Choose an appropriate lawful basis for the specific activity. Consent has conditions, including being freely given and withdrawable; workplace power imbalances deserve particular care. Legitimate interests requires an assessment of purpose, necessity, and competing interests. Obtain advice where the context, audience, or proposed reuse makes that assessment uncertain.

Separate gallery participation, in-room display, and external publication. Before using an image in an advertisement, consider the people depicted, the photographer’s rights, the notice given, and the permission or other basis for that particular use. Include service-provider and international-transfer checks in your organization’s review.

Handle access and deletion requests accurately

Provide an obvious contact and record when a request arrives. Under Article 12, information about action taken is generally due without undue delay and within one month. A necessary extension of up to two further months has conditions, including notifying the requester within the first month.

Article 17 sets grounds for erasure and exceptions. Assess the request rather than promising every image must be deleted within a fixed 30-day period. Where erasure applies, act without undue delay and consider recipients and copies covered by your obligations.

Removing an image from the gallery cannot recall a screenshot or a file someone has already saved. Explain what action you took and address copies under your control; do not promise deletion from every recipient’s device.

What Capture controls help you manage

Capture events are unlisted and reached through a QR code or link. Access information can be forwarded. Hosts manage approval, guest participation, and photos in the iPhone app; QR-code regeneration is also available there. Review who should retain access when changing a code.

Browser guests enter a display name without completing a registration form. The service still processes data needed to run the gallery, including guest identifiers, membership and upload timestamps, and optional comments or captions. The privacy policy explains service providers, technical information, and website analytics.

Use host moderation and a clear removal contact as part of your event plan. Review Capture’s privacy policy and any provider documentation required by your organization. These features support a workflow; they are not a certification that your event or reuse plan complies with GDPR.

What This Means for You

• Family sharing: keep the intended circle clear and reassess before public or commercial reuse.
• Business events: document purpose, audience, responsibility, lawful basis, notice, retention, and a request-handling contact.
• Gallery setup: test guest access and approval; tell attendees if contributions may appear on a screen.
• Afterward: review each proposed reuse, save permitted files in a controlled archive, and carry out your retention plan.