Event Photography Notice: What to Tell Attendees Under GDPR, with Sample Wording

Ireland’s Data Protection Commission (DPC) answers a question every organiser has asked: can you take promotional photographs of attendees without their consent? Its answer has two parts. At large events, put up written notices that say photos will be taken, why, and how the images will be used. At smaller events, seek consent, for example with coloured lanyards that show who is happy to be photographed.

That answer separates two things organisers often merge. Permission is the legal reason you may take and use a picture. Information is what you tell people before the camera comes out. A sign at the door covers the second. It never creates the first.

Our argument: a photography notice informs, it does not permit. It works only as one of three matching parts: a lawful basis chosen for each use, clear information before and during the event, and a way for attendees to say no. We show you how to build all three, with wording you can adapt.

This article gives general information for organisers in the EU and the UK. It is not legal advice, so have your final texts reviewed.

What a photography notice does, and what it cannot do

Start with why a notice is needed at all. Under the General Data Protection Regulation (GDPR), personal data is any information relating to an identifiable person (Article 4(1)). A photo or video in which someone can be recognised falls under that definition. Taking, storing and publishing it all need a lawful basis from Article 6.

The notice has a different job. Article 13 requires you to tell people who you are, what you do with their data and which rights they have, at the time you collect it. The notice is how you meet that duty for cameras.

What it cannot do is produce consent. The European Data Protection Board (EDPB) is explicit in its Guidelines 05/2020 on consent, adopted on 4 May 2020. Silence, inactivity or simply carrying on with a service is not consent (paragraph 79), and neither is accepting general terms and conditions (paragraph 81). So the familiar line “by entering this venue you consent to being photographed” promises something the law does not recognise.

And if you call it consent, attendees may withdraw it at any time (Article 7(3)). A notice informs. It does not sign for anyone.

The UK GDPR follows the same structure, but the Data (Use and Access) Act 2025 has amended it since February 2026, so check current guidance from the Information Commissioner’s Office (ICO), the regulator to follow for UK events.

Sources, accessed on 11 November 2026: GDPR, DPC on promotional photographs, EDPB Guidelines 05/2020, and the ICO on legitimate interests, privacy information and photos in schools, plus the Department for Education’s guidance on photos and videos in schools.

Choose the lawful basis before you write the notice

If the notice cannot create permission, something else has to. Picture the freelance photographer who arrives at eight in the morning and asks: who am I allowed to shoot? You can only answer if you have decided, for each kind of image, what you rely on.

For most organisers the choice is between legitimate interests (Article 6(1)(f)) and consent (Article 6(1)(a)). The ICO describes legitimate interests as a three-part test: a legitimate purpose, processing that is necessary for it, and a balance against the person’s interests. The DPC applies the same logic to events: the use must match what attendees would reasonably expect and have a minimal effect on their privacy.

Two rows need a comment. For wide shots, consent is the wrong tool. The DPC points out that it is hard to obtain from everyone in a large group shot. Legitimate interests fits better, as long as the use stays within what people expect. A recap gallery is expected. A billboard is not.

The last row concerns services that send attendees every picture they appear in. Recital 51 of the GDPR says photos become biometric data only when specific technical means allow a person to be uniquely identified. Face matching does exactly that, a trade-off we discuss in our article on facial recognition at events.

Whichever basis you choose, name it in the notice. Offering an opt-out does not turn legitimate interests into consent, as the UK Department for Education’s data protection guidance for schools puts it.

What the notice has to say

With the basis chosen, the content of the notice follows from Article 13. Attendees should be able to find these points:

• Who you are: the organiser’s name and contact details, plus your data protection officer if you have one.
• Why and on what basis: the purposes, such as recap, website and social media, and the lawful basis. For legitimate interests, name the interest itself.
• Who receives the images: your photographer, sponsors, exhibitors or the press.
• How long you keep them: a period, or the rule you use to decide.
• Their rights: access, erasure, complaint to the supervisory authority and, where you rely on consent, withdrawal.
• The right to object: Article 21(4) requires you to present it clearly and separately from other information.

No door sign can carry all of that, and it does not have to. The ICO describes a layered approach: a short notice with the key points, linked to the full version. It also lists signage, “for example an information poster in a public area”, and oral information among the ways to deliver privacy information. For an event, that gives you four layers: two or three sentences in the registration form, a reminder in the joining instructions a week before, a sign at the door and the registration desk, and two sentences from the host on stage.

Notice wording you can adapt

With the layers set, you need the words. The following texts are starting points. Replace the parts in square brackets.

For the registration form:

We will take photographs and video at the event. We use them to report on the event on our website, in our newsletter and on social media. We rely on our legitimate interest in documenting and promoting the event. You can object at any time by emailing [address] or by speaking to the registration desk on the day. Full details are in our privacy notice at [link].

For the door sign:

Photography and filming. [Organiser] is taking photos and video at this event for our event report, website and social media. Prefer not to appear? Pick up a [red] lanyard at the registration desk or tell our photographer. Questions and objections: [email address]. Full privacy notice: [short link or QR code].

For the host on stage, at the start of the day and before each recorded session:

Our photographer and film team are with us today, and this session is being recorded for our event report. If you prefer not to appear, take a seat in the marked rows on the [left] or pick up a [red] lanyard at the registration desk.

For a portrait, testimonial or advert:

I agree that [organiser] may use the photo or video taken of me on [date] for [specific purpose, for example adverts and social media posts promoting the 2027 event]. My consent is voluntary. I can withdraw it at any time by emailing [address].

The consent text is narrow on purpose: one person, one image, one purpose. Record who agreed and when, because you must be able to demonstrate consent (Article 7(1)).

Give attendees a real way to say no

The wording promises an opt-out, and one that only works by email is of little use in a conference hall. Coloured lanyards, which the DPC suggests for recording consent at smaller events, also work as a visible opt-out. An attendee with a red lanyard is not photographed in close-up, and your team removes any wide shot in which that person is clearly recognisable.

Seating is the second tool. Imagine a delegate whose employer does not allow her to appear in public images. She should still be able to sit in row three. The EDPB gives a close parallel: a film crew records in an office, and employees who do not want to be filmed get equivalent desks elsewhere and are not penalised (Example 5 of the consent guidelines). For your room, that means a block of good seats that the cameras leave out. A corner by the door does not count.

The same idea covers recorded sessions: offer a way to submit questions in writing, so nobody’s voice ends up in the recording against their wishes.

People who are given a choice rarely complain.

Brief everyone who holds a camera

Back to the photographer at eight in the morning. The answer to that question fits on half a page:

• Subjects: wide shots are fine, close-ups of individual attendees only after a quick word with them.
• Lanyards and seats: what the colours mean and where the camera-free seats are.
• Off limits: people eating, private conversations, screens, documents and badges in close-up.
• Handover: where the images go, and when the photographer deletes the raw files.

Your contract should also say in which role the photographer works. A photographer who shoots only on your documented instructions can be your processor, which calls for a contract under Article 28. One who decides on other uses, such as a portfolio, is a controller for those uses (Article 28(10)).

Other people bring cameras as well. Exhibitors and sponsors are responsible for their own photos and video, and one paragraph in the exhibitor manual makes that clear. Attendees who take pictures for purely personal use are outside the GDPR (Article 2(2)(c)). You can still set house rules in your conference code of conduct, which should already cover photographing people who have asked not to be photographed.

After the event: selection, retention and takedown requests

The notice makes promises, and the week after the event is when you keep them. Before anything is published, one person checks the selection against three questions. Is anyone with a red lanyard recognisable? Is a single attendee so prominent that you would need consent? Would the person be unhappy with how they look? If any answer is yes, leave the image out.

A missing photo costs you nothing.

Then decide what happens to the rest. A simple rule works well: the selection stays, and everything else is deleted after a fixed period. If sponsors receive images, your notice must have said so. The selected images then feed the post, email and video described in our guide to the event recap.

Sooner or later an attendee writes and asks you to remove a picture. Where you rely on legitimate interests, that message is an objection under Article 21. You must stop unless you can show compelling legitimate grounds, and for a gallery photo you rarely can.

The three working days above are a working suggestion; the law asks for erasure without undue delay (Article 17(1)). Printed material is the hard case. In the Department for Education’s school example, a pupil withdraws permission after the prospectus is printed: the school stops using the photo in future versions but cannot recall copies already distributed.

Solution: In Converve, registration and the participant profile are separate building blocks with their own field sets and their own consents. That gives the photography notice a fixed place, in the step where attendees sign up. The platform is hosted in Germany. For the questions to put to any vendor, use our checklist for GDPR-compliant event software.

Frequently Asked Questions

Do I need consent to photograph attendees at an event?

Not for every picture. For wide shots used in a recap, organisers can rely on legitimate interests under Article 6(1)(f) of the GDPR if attendees are told in advance and can object. Ireland’s Data Protection Commission describes this route for large events. Portraits, adverts, images of children and face matching need consent.

Is a sign at the entrance enough?

As one layer of information, yes. As consent, no. The EDPB’s Guidelines 05/2020 state that silence or simply proceeding with a service does not count as consent (paragraph 79). Use the sign for the key points and link it to the full privacy notice.

Do the same rules apply in every European country?

The core is the same, because the GDPR applies across the EU and the UK GDPR follows its structure, although the UK has amended it through the Data (Use and Access) Act 2025. Two things differ. Article 85 asks each member state to reconcile data protection with freedom of expression, so the rules for journalists are national. Some countries also protect a person’s image in a separate law. In Germany, section 22 of the Art Copyright Act (Kunsturhebergesetz) allows images of a person to be published only with consent, with exceptions in section 23; how this interacts with the GDPR outside journalism is disputed. Have your notice checked for each country you work in.

What do I do when someone asks me to remove a photo?

Treat it as an objection under Article 21, or as a withdrawal of consent under Article 7(3). Remove the image from live channels, delete it from your archive, tell partners who received it and confirm to the attendee.

Conclusion: decide first, then photograph

Event photos become a problem when the door sign is asked to do a job it cannot do. A photography notice informs. Permission comes from the lawful basis you choose for each use, and trust comes from the choice you give attendees on the day.

So settle three things before the first picture: which basis covers which image, where attendees read the notice, and how they say no. Then the photographer who arrives at eight gets a clear answer, and so does the attendee who later asks you to take a picture down.

Would you like registration, attendee information and meeting scheduling for your event on one platform? Then get in touch with Converve.