GDPR and Event Photos: Consent, Sharing and Storage Explained

Whether you're organizing a corporate conference, a trade show, a wedding, or a private celebration, photos are an essential part of the experience. They capture memories, support marketing efforts, and help guests relive special moments. But they also involve personal data, making privacy an important responsibility.

Many event organizers ask the same questions: Can I share event photos? Do I need consent? How can I stay GDPR compliant? The good news is that GDPR doesn't prevent event photography—it simply requires transparency, appropriate safeguards, and responsible data handling.

This guide walks through the decisions that actually come up: which legal basis applies to your event, what to write in the invitation, how long to keep the gallery, and what to do when someone asks to be removed.

This is practical guidance from running event galleries, not legal advice. For a large corporate event, or anything involving works council agreements, talk to a lawyer.

Why GDPR Matters for Event Photos

Under the General Data Protection Regulation (GDPR), photographs can qualify as personal data whenever people can be identified. That means collecting, storing, sharing, or publishing event photos may fall under GDPR requirements.

This applies to:

• Corporate conferences
• Company parties
• Weddings
• Charity events
• Trade fairs
• Sports events
• Private celebrations

The goal isn't to stop photography—it's to protect people's privacy while allowing organizers to document memorable moments.

When a photo is not personal data

Not every event photo carries an obligation. A wide shot of a full dance floor where nobody can be picked out, a close-up of the cake, a detail of the table setting — none of those identify anyone, and GDPR does not reach them.

The line is identifiability, not whether a face is visible. Someone recognizable from behind by their wheelchair, their tattoo or their uniform is still identifiable. Treat the question as "could a person who knows them recognize them here", not "is the face sharp".

The private household exemption, and why it usually does not help

Art. 2(2)(c) GDPR excludes processing "in the course of a purely personal or household activity". A wedding is close to that line — but the exemption is read narrowly. Once photos go into a gallery that dozens of guests can open, most practitioners treat it as processing that GDPR covers, and behave accordingly.

For anything organized by a company, an association or a paid photographer, the exemption clearly does not apply.

Choosing Your Legal Basis

Every processing operation needs a legal basis under Art. 6(1). For event photos, two are realistic, and picking the right one changes what you have to do.

Legitimate interest — the usual choice for organizers

Art. 6(1)(f) covers processing necessary for a legitimate interest, provided the attendees' rights do not override it. Documenting your own event is a recognized legitimate interest. It fits the situation where you cannot practically obtain individual consent from 200 people arriving over three hours.

Using it means you owe attendees two things: information before the event, and a genuine ability to object.

Consent — required when the stakes are higher

Art. 6(1)(a) consent is the safer basis when photos will be published beyond the event: on your website, in marketing material, on social media. It must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give.

Consent obtained under pressure is not consent. An employee asked in front of their team whether they mind being photographed for the company website is not in a position to say no freely — which is exactly why relying on employee consent is fragile.

The German extras: KunstUrhG and § 26 BDSG

In Germany two further rules sit alongside GDPR. §§ 22–23 KunstUrhG govern publishing a person's likeness and still matter for public distribution. And for employee photos, § 26 BDSG applies: consent in an employment relationship has to be documented in writing or electronically, and the works council usually has a say before photos of staff are used.

Common Privacy Mistakes

Many organizers unintentionally create privacy risks by using consumer tools that weren't designed for event photo sharing.

Common mistakes include:

• Sharing photos in public cloud folders
• Sending images through messaging apps without access control
• Keeping photos forever without a deletion policy
• Not informing guests that photography takes place
• Using weak passwords or public links

These issues can reduce trust and create unnecessary compliance risks.

The mistake that is hardest to undo

A public link is the one that cannot be walked back. Once an unlisted cloud folder has been forwarded into three group chats, you no longer know who holds it, and revoking it later does not retrieve what has already been downloaded.

Anything that is genuinely private has to be private from the first minute. Retrofitting access control onto a link that has already circulated does not work.

Best Practices for GDPR-Compliant Event Photography

A privacy-first workflow doesn't have to be complicated.

Inform Guests Tell attendees that photography will take place before and during the event. Include this information in invitations, registration pages, or signage at the venue.

Limit Access Only authorized guests should be able to view event photos. Password-protected or invitation-only galleries are significantly safer than public links.

Store Data Securely Choose providers that use encrypted storage and secure connections. Access controls and audit logs provide additional protection.

Define a Retention Period Don't keep photos indefinitely. Decide how long images will remain available and communicate this clearly to participants.

Respect Guest Requests Provide an easy way for guests to contact you if they have questions or wish to exercise their privacy rights.

What to actually write in the invitation

Art. 13 requires you to inform people at the point their data is collected. For an event that means the invitation or the registration page, not a sign discovered at the door. Four sentences are enough:

Photographs will be taken during this event and made available afterwards in a private gallery for attendees. The gallery is run by [organizer] and access is limited to invited guests. Photos are deleted after [period]. If you would prefer not to appear, tell a member of staff at the registration desk or write to [address], and we will remove any image of you.

If you intend to publish beyond the gallery — website, social media, print — say so explicitly, and collect consent rather than relying on legitimate interest.

How long to keep the gallery

There is no statutory number. Pick a period you can justify and then hold to it, because a retention policy you announce and ignore is worse than none.

Periods that hold up in practice:

• Weddings and private celebrations: 12 to 24 months. Long enough for people to download what they want, short enough to be a real limit.
• Corporate events and conferences: 6 to 12 months. Business purpose is usually exhausted well inside a year.
• Photos used in marketing: as long as the consent covers, and no longer. Consent withdrawn means the image comes down.

Whatever you choose, an automatic expiry date beats a note in a calendar.

When someone asks to be removed

Art. 17 gives people the right to erasure, and at an event this is rarely a formal letter — it is someone catching you at the bar. Handle it the same way regardless:

1. Find every photo showing them, including group shots where they are in the background.
2. Delete them from the live gallery, and from any download archive you have prepared.
3. Confirm to the person that it is done.
4. Tell the photographer, if a professional holds a separate copy.

Point 4 is the one that gets missed. A deletion that leaves the images on a photographer's hard drive is not a deletion, and if you commissioned the shoot you are usually the controller and answerable for it.

Why Dedicated Event Galleries Are Better

Many organizers rely on WhatsApp, Dropbox, Google Drive, or social media. While convenient, these platforms were not built specifically for secure event photo sharing.

A dedicated GDPR compliant photo gallery — one you can create in minutes — offers:

• Private galleries
• Guest upload permissions
• QR-code access
• Controlled downloads
• Expiring links
• Better privacy controls
• Professional appearance

For businesses, this demonstrates professionalism and reduces legal uncertainty.

Questions worth asking a provider

Before an event, four answers decide whether a platform is workable:

• Where is the data stored? Servers in the EU remove the international-transfer question entirely. Outside it, you need to know which transfer mechanism applies.
• Is there a data processing agreement? Art. 28 requires one with any provider processing personal data for you. A provider that cannot produce one is not an option for a company event.
• Are the photos used for anything else? Training AI models, marketing, "improving the service" — read what the terms actually permit.
• Can you delete on demand, completely? Including from backups, within a stated period.

Corporate Events vs. Private Events

Corporate events often require stronger privacy controls because employee data, customer information, and company branding are involved — see our page on photo sharing for corporate events. Wedding organizers and private hosts have different priorities. They want guests to share photos easily while keeping memories private.

In both cases, secure event photo sharing creates a better experience and protects everyone involved.

The corporate checklist

For a company event, three things are worth settling before anyone picks up a camera:

• Works council. In Germany, photographing employees usually triggers co-determination. Agreeing the terms in advance is quicker than unpicking it afterwards.
• A no-photo option that costs nothing socially. A different lanyard colour works better than asking people to speak up, because it does not require anyone to object in front of colleagues.
• Who is the controller. You, the agency, or the photographer. Write it down. When a deletion request arrives eight months later, this is the question that stalls everything.

The short version

GDPR does not stand between you and your event photos. It asks you to say what you are doing, limit who can see the results, keep them no longer than you need, and act when someone asks you to stop.

A private gallery with a stated expiry date and an access list covers most of that by default — which is the real argument for a purpose-built tool over a shared folder.