Photographs of customers and staff used without a record

Aug 29
3 min read

Updated: 2 days ago

Introduction

A business photographs a job, an event or its team, and the images go onto the website and social media. Everybody was there, nobody objected, and the pictures are used for years afterwards in brochures, adverts and posts.

Then somebody asks to be removed. A former employee whose photograph still appears, a customer whose circumstances have changed, or somebody who never realised the image would be used commercially. At that point the business discovers it has no record of what anybody agreed to and no system for finding every place the image was used. Removal then becomes a search rather than a deletion. The brochure printed two years ago is still in circulation and cannot be recalled.

1. Photographs of customers and staff are personal data

The starting point.

An image of an identifiable person falls within data protection frameworks, which means the usual questions apply: what is your basis, what were people told, how long will you keep it, and how do they exercise their rights.

2. Ask permission and record it

The practical requirement.

Who agreed, when, and to what use. A photograph taken with agreement for an internal record is not the same as agreement to appear in advertising, and the difference matters when somebody objects.

3. Be specific about the uses

One permission does not cover everything.

Website, social media, printed brochures, paid advertising, press and third-party use are meaningfully different. Asking about each takes a moment and prevents nearly every dispute that follows. People object to unexpected uses far more than to being photographed.

4. Treat staff photographs carefully

The imbalance affects consent.

Employees may not feel able to refuse, which weakens consent as a basis. Ask genuinely, make refusal consequence-free, and be clear about what happens to images when they leave.

5. Deal with images of customers on your premises

Where it is least considered.

Photographing a busy shop, a class or an event captures people who did not choose to appear in your marketing. Signage, an announcement, or simply photographing so individuals are not identifiable are all workable approaches. What does not work is assuming that presence implies permission.

6. Take particular care with children and vulnerable people

Additional obligations everywhere.

Parental permission, and specific consideration where there may be safeguarding reasons that images should not circulate. This applies to any business photographing families, classes or events.

7. Keep a record of where each image is used

The part that makes removal possible.

A removal request means finding every instance: website, social platforms, printed material, paid adverts and third-party sites. Without a record this is close to impossible, and partial removal is what causes complaints.

8. Have a route to withdraw permission

Simple and known.

People change their minds, and circumstances change for reasons they are not obliged to explain. A stated process, honoured promptly, resolves what would otherwise become a public complaint.

9. Review what is still in use

Periodically.

Images of former staff, closed premises and old customers circulate for years. An annual check of the website and main channels removes material that is out of date, unpermitted or simply no longer representative. It also catches images of premises and services the business no longer has.

Store the permissions with the images rather than separately. A folder of photographs and a folder of consent forms that cannot be matched to each other is functionally the same as having no record at all, and this is how most businesses currently hold both.

Conclusion

Treat images as personal data with a permission record attached.

Ask permission and record who agreed, when and to what, be specific about each intended use rather than seeking a blanket agreement, take particular care with staff where refusal may feel difficult, address customers photographed incidentally on your premises, obtain parental permission for children and consider safeguarding, keep a record of everywhere each image is used, provide a simple route to withdraw permission, review periodically what is still in circulation, and store permissions alongside the images themselves.