Photography and filming consent at events

Photographs and video of identifiable people at an event are personal data, and the organiser that takes them, posts them on social media, uses them in next year's brochure and hands the files to a sponsor needs a basis for each use, a notice that attendees saw before the camera appeared, an opt-out that works, a release from the speakers and a different approach entirely for children. The documents are the notice for the registration page and the venue, the release for speakers and performers, the consent form for children and the policy that tells the organiser's team and its photographers what they may do. Drafting for the business, I deliver the privacy notice, the cookie notice and guidance on consent in five working days for a fixed £595.

Who this is for

Conference and event organisers, training providers, membership bodies, venues, schools and clubs running events, and businesses whose marketing team photographs every gathering, in England and Wales.

What matters in photography and filming consent at events

Photographs of people as personal data and the basis an organiser needs

An image of an identifiable person is personal data under Article 4 of the UK GDPR, so photographing and filming attendees is processing that needs a lawful basis, which for general event coverage (crowd shots, the room, the stage) is usually legitimate interests under Article 6(1)(f) with the interest stated (recording and promoting the event) and the balance recorded, while using an identifiable image of a particular person to promote the organiser's business is where consent becomes the sensible basis, because the person's expectation and the organiser's use diverge; Article 13 of the UK GDPR requires the business, as controller, to tell attendees before the images are taken, and the Information Commissioner's position is that consent is not always needed for event photography but notice always is.

The notice at the event and the opt-out that works

The notice should appear on the registration page and in the confirmation (so that the attendee knew before they came), on signage at the entrance and in the room (so that they are reminded), and in the organiser's privacy notice, stating that photography and filming will take place, the uses, who else receives the images, how long they are kept, and how to opt out; the opt-out should be real (a coloured lanyard or sticker that the photographer is briefed to respect, a seating area off camera, the ability to ask for an image to be removed afterwards), because a notice that says 'by attending you consent' is neither consent nor a notice, and an opt-out the photographer does not know about is not an opt-out.

Speakers, performers and the release that is a contract

Speakers, panellists and performers are filmed as the content of the event, and the organiser needs more than a notice from them: a release in the speaker agreement granting the organiser the right to record, reproduce, distribute and edit their session (a copyright and performers' rights licence under the Copyright, Designs and Patents Act 1988, since the speaker's talk and the performer's performance are their own), stating the uses (the recording sold or shared, the clips on social media, the slides), the credit, any payment, the territory and the term, and the position on the speaker's own materials and their right to approve edits; the release is a contract rather than a data protection consent, and it can be relied on without the withdrawal that consent carries.

Children, vulnerable people and the consent that must be sought

Where children attend, the organiser should obtain the parent's consent before photographing or filming them for any use beyond the record of the event, name the child only with consent, never publish an image with the child's name and school or club together, and brief the photographer to avoid children not on the consent list; adults who lack capacity need the consent of the person able to give it, and events for people in sensitive circumstances (health, recovery, faith, legal advice) should default to no photography of attendees at all, with consent sought individually where images are wanted.

Livestreams, social media and the use the notice did not mention

A livestream broadcasts attendees in real time with no opportunity to remove them, so the notice must say the event is streamed and the camera positions should avoid the audience where the opt-out cannot be honoured; posting images on social media discloses them to the platform (a controller for what it does with them, under its own terms) and to the world, and the notice should say which platforms; the organiser's use of images in later marketing, a sponsor's use in its own marketing, and the sale of images are uses that need to be in the notice or need consent; images already published can be removed on request, and the policy should say that the organiser will remove them within a stated period.

Photographers, videographers and the data they walk away with

A commissioned photographer or videographer holds the images as the organiser's processor under Article 28 of the UK GDPR (where the organiser instructs and owns the use) or as a controller for their own portfolio (where the contract allows it), and the photography contract should say which, assign or license the copyright to the organiser as needed (the photographer owns the copyright under the 1988 Act unless the contract says otherwise), require secure storage and deletion of the raw files after a stated period, prohibit the photographer's own use of attendees' images without the organiser's agreement, and provide for the photographer to be briefed on the opt-out; the privacy notice drafted alongside covers the organiser's own processing, how an individual exercises the rights of access, correction, erasure, restriction, portability and objection, the one-month limit on the response, and the right to go to the Information Commissioner's Office, and registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018 is required where the fee applies, and the notice can state it.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need everyone's consent to photograph our conference?

Not for general coverage, where legitimate interests with notice before the event and at the venue is the basis, with a real opt-out. Consent is the sensible basis for using an identifiable person's image in your marketing, and parental consent is needed for children.

Does 'by attending you consent to being photographed' work?

It does not. It is not consent (there is no choice) and it is a poor notice. The notice says what will happen and how to opt out, and the opt-out is briefed to the photographer.

Who owns the photographs our photographer takes?

The photographer, unless the contract assigns or licenses the copyright to you, which it should. The contract also sets whether the photographer may use the images themselves and when the raw files are deleted.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Children's data for a club or activity business
• Privacy notice for a membership organisation

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.