GDPR for photographers: how to store and share client photos

GDPR for photographers comes down to four habits: get separate written consent before you use anyone's photo for marketing, state in the contract how long you keep files, share galleries privately with an expiry date, and delete on a schedule and on request. If you do those four things and can prove it, you cover most of what the regulation expects from a working studio.

This guide walks through each habit with the details most guides skip: how to tag consent inside file metadata, how to check whether your gallery host is actually safe, and how to delete a client from backups, cloud sync and social posts in one pass. It is practical guidance from a working photographer's point of view, not legal advice. For your specific situation, talk to a lawyer who knows data protection.

One position up front: most photographers obsess over consent forms and ignore retention, yet the files you keep years after delivery create most of your real risk.

Why a client photo counts as personal data

A photo of a person someone can recognize is personal data. The moment you hold that image, plus the client's name, email and phone number, you are the data controller: the one who decides why the data exists and how it gets used. That responsibility stays with you even when the files sit on someone else's servers.

Photographers tend to think only about faces. The file carries more. EXIF data can reveal the exact GPS location of a family home or a newborn's nursery, the date and time of the shoot, and sometimes the camera's serial number. Drop a sample frame into an online EXIF viewer and see what your own exports reveal before they leave your computer.

The data also spreads further than you expect. One wedding produces copies on two memory cards, a laptop, an external drive, a cloud backup, a gallery host and maybe a retoucher's machine. Each copy is part of what you control.

Map where your files actually live. Write down every location for one recent session, including the old card you never formatted.

What consent for portfolio and social use should cover

Delivering photos to the client who booked you rests on the contract itself. Putting those photos on your website, Instagram or in a printed ad is a different purpose, and it needs a separate written consent from each person who appears. A line buried in the booking terms is weak; a standalone clause or form the client signs on its own is much stronger.

Good consent names the channels (website, social media, paid ads, competitions), says whether the client can be tagged or named, and explains how to withdraw. For children, a parent gives consent; the age threshold is set by each country, between 13 and 16, so for school-age portraits default to parental consent unless you know the local rule. Keep the signed form for as long as you keep the photo, because the form is your proof. You can build one quickly with an image release generator.

Wedding guests are the classic headache. Collecting forms from 150 people is unrealistic, so many photographers rely on legitimate interests for documenting the day and ask the couple, through the contract, to point guests to the photographer's privacy policy before the event. For marketing use of a guest's face, ask that guest directly.

Then link consent to the file. Add an IPTC keyword such as "consent-portfolio-2026" or "no-marketing" in your editing software. When a request arrives, a keyword search shows you every affected frame in seconds.

How long to keep RAWs and finished files

GDPR does not give a fixed number of months. It says you keep personal data only as long as your purpose needs it, and you must be able to explain that purpose. That is why the retention period belongs in your contract, in plain numbers.

A workable pattern looks like this. Keep RAW files until the client confirms the final selection plus a short buffer for reprint or re-edit requests, often 3-6 months. Keep final edited JPEGs for a stated period after delivery; a clause such as archiving final files for twelve months from the delivery date is common and easy to defend. Keep contracts and invoices as long as your accounting rules require, separately from the photos. Start from a photography contract template and fill in your own periods.

Why push back on the "keep everything forever" habit? Every old drive is a breach waiting to happen. A stolen bag with five years of family sessions affects hundreds of people, and the only reason those files existed was that nobody deleted them.

Portfolio images with valid consent are the exception: you can keep them as long as the consent stands.

Sharing galleries securely and checking your host

Email attachments and open download links are where client photos leak. A private gallery with a login and an expiry date limits who sees the images and for how long. Expiry periods of 30, 60 or 90 days cover most sessions; a client who needs longer can ask. If you are moving away from large file transfer services, compare the options in our page on WeTransfer alternatives or read about a private photo gallery.

"Use a secure platform" is the advice everyone gives and nobody explains. Ask your host these questions in writing. Where are files stored, and if outside the EU, what safeguards cover the transfer? Will they sign a data processing agreement? Does the account support two-factor login? When you delete a gallery, does the old link stop working, and when are files removed from their storage? Do previews strip GPS and EXIF data?

Secure your own side too. Encrypt your laptop and external drives, and lock the phone you use for client messages.

If a laptop, drive or card goes missing, you have 72 hours to notify the data protection authority, and you must tell affected clients when their rights are at risk. Encryption often decides whether a lost drive is a minor incident or a serious one.

Deletion requests, withdrawn consent and group shots

A client can ask you to erase their photos, and you have one month to respond. The right applies when consent is withdrawn, when the original purpose no longer exists, or when processing has become unlawful. In practice this means you must find every image of that person quickly, which is where metadata keywords and a client database pay off.

Withdrawn consent after you have posted is the most common case we see. Remove the photos from your website and social accounts, delete them from scheduled posts, and stop using them in new material. You cannot pull back a printed brochure already handed out, but you stop distributing it.

Group shots have no clean rule in the regulation, so set your own and write it down. A sensible one: if one person in a group photo withdraws marketing consent, you remove that photo from all marketing. The other people in the frame still have a right to their delivered gallery, because that rests on the contract with the client who booked you. Offer the objecting person a crop or retouched version only when it fully removes them.

Reply in writing, confirm what you deleted and where, and keep that confirmation without the photos.

A checklist you can run after every session

Use this as a routine. It doubles as your deletion workflow, which is the part most studios never write down.

1. Collect separate written consent for portfolio and social use before the shoot, and get a parent's consent for children; the age threshold varies by country between 13 and 16, so default to parental consent for school-age clients unless you know the local rule.
2. State the retention period for RAWs and final files in the contract, in months.
3. Tag every frame with a consent keyword in its metadata during import.
4. Deliver through a private gallery with a login and an expiry date of 30-90 days.
5. Set a calendar reminder for the end of the retention period on the day you deliver.
6. Delete culled RAWs once the client approves the selection, including rejected frames still sitting in your catalog.
7. Delete final files from your working drive, external backups and the gallery host when the period ends.
8. Check that cloud sync has not kept a copy in a trash or version history folder, and empty it.
9. Remove the client's photos from social posts, drafts and scheduling tools if consent is withdrawn.
10. Ask any print lab or retoucher you used to delete the files, and keep their reply.
11. Log the deletion date for that client without keeping the images.

How Picvelo Can Help

Picvelo covers the sharing and deletion parts of this routine. Clients view photos after logging in to a private client gallery, and previews are re-encoded from the original, so they carry no EXIF or GPS data. The activity history shows when a client last opened the gallery, which helps you decide when the retention period can safely end. When it does, or when a client asks for erasure, delete single photos, a whole gallery or a client with all galleries; the old link stops working. Two-factor login protects the account, see the activity tracking page for details.

What to do next

Start with your last five clients. Open each folder, check whether you have written portfolio consent, and add a metadata keyword to every frame so you can search by status. Next, rewrite the retention clause in your contract with real numbers of months and send the updated version with your next booking. Then put one recurring calendar event on the first Monday of each month: run the deletion checklist for every client whose retention period ended. Finally, email your gallery host the five security questions above and keep their answers on file.

FAQ

Do I need consent from every wedding guest?

Usually not for documenting the day. Two groups need more care. Children among the guests need a parent's consent before you use their photos anywhere beyond the couple's gallery. Vendors such as the planner or florist who ask for images for their own marketing need consent from every recognizable person in those frames. Tag approved frames with a "vendor-share" keyword, then filter by it so you only ever send those.

How long can I keep RAW files?

As long as your contract says. The harder case is a client who returns after the RAWs are gone and asks for a re-edit. Tell them politely that the files were deleted on the date the contract states, and offer to work from the final JPEG where possible. The signed clause protects you. A 3-6 month buffer covers most requests, since re-edits usually come within the first weeks after delivery.

What if a client withdraws consent after I've already posted the photos?

Remove your own post first, then check who shared it. If a venue reposted your Instagram photo or uses it on its website, ask the venue in writing to take it down and give a clear deadline, such as seven days. Log both actions with dates: your own removal and the request to the third party. You control only your accounts, so a documented request shows you acted.

Can I use client photos in my portfolio if the contract doesn't mention it?

It is risky. Delivering photos rests on the contract, while portfolio and social use is a separate purpose that needs separate written consent from each identifiable person. Without it, you have no proof the client agreed. The simple fix is to send a short consent form now, naming the channels you want to use, and to add a standalone consent clause to future bookings.

What should I do if I lose a memory card or laptop with client photos?

Work through this in the first hour. Revoke all cloud sessions for the lost device from another computer. Change passwords for your gallery host, email and cloud storage. List the affected sessions from your client database. Check whether the device was encrypted, which decides whether the loss likely puts people at risk and needs notifying within 72 hours. Keep a written incident log even when you do not notify.