The short answer
Images that identify a child are personal data, so you need a valid lawful basis before taking, publishing or storing them — consent, public task or legitimate interests. Consent to publish, not just to film, is what matters for marketing and social media, and families must always have a workable opt-out. Restrict staff access to CCTV and stored footage to named roles, and give photographers a brief that excludes children whose families opted out.
Key takeaways
- A recognisable image of a child is personal data; before taking, using or sharing it you must have a lawful basis under data protection law.
- Consent is only one possible lawful basis; many public bodies rely on public task and private operators on legitimate interests, always offering an opt-out.
- Consent to film is not consent to publish — state the specific purpose and platforms, and refresh or renew consent when the use changes.
- A child must never be excluded from an activity because the family withheld photo consent; use discreet markers and careful framing instead.
- Access to CCTV and stored images should be limited to named, authorised staff, with logging and defined retention periods.
Decide the lawful basis before you press record
Under data protection law, a photograph or video in which a person can be recognised is personal data. That triggers the same principles that apply to any personal information: a valid lawful basis, transparency, security, retention limits and respect for individual rights. Whether you run a school, club, camp, sports facility or event venue, you should make this decision deliberately rather than assume consent is the default.
Consent is the most intuitive basis but not always the best one. Public bodies carrying out official duties often rely on public task for administrative images such as ID cards and registers. Private operators and uses that go beyond public functions — newsletters, websites, promotion — usually consider legitimate interests, which requires a balancing assessment. Whichever basis you use, tell families up front what you will do with images and give them a real way to opt out. Consent itself must be freely given, specific, informed and unambiguous, and it can be withdrawn at any time.
- Public task: administrative and safeguarding images needed to run a public body (ID cards, registers, dietary alerts).
- Consent: parents or guardians agree to a specific use after clear explanation; withdrawable at any time.
- Legitimate interests: marketing and promotion after a balancing assessment, always with an opt-out.
Consent to film is not consent to publish
A common failure is treating a blanket 'photography allowed' notice as permission to feature children in marketing. Separate the acts: consent to capture an image and consent to publish it are different decisions. A parent may happily allow a photo of their child on the class blog yet object to the same image on the venue's public Instagram feed or in a prospectus.
Document precisely what families agree to: the purpose (news, records, marketing), the platforms (website, social media, newsletter, printed materials, parent app) and how long images will be kept. When the intended use changes — a school moves from classroom photos to a promotional video, or a club adds livestreaming — the existing consent may no longer cover it, so seek new permission. Keep clear records of who gave consent, when, how, and what they were told, and refresh opt-in or opt-out choices regularly, such as once a year.
- State purpose and platforms explicitly in the consent form or opt-out notice.
- Renew or top up consent when the use changes or a new technology or platform appears.
- Record who gave consent, when and how, and note withdrawal dates.
Publishing responsibly and honouring opt-outs
Before any image goes online, check whether the families pictured have restrictions, including safeguarding cases where a child must not be publicly identified. Publish images that focus on the activity rather than close-ups of an individual child, use wide shots or side-on angles, avoid pairing names with faces, strip location metadata and consider lowering resolution to limit misuse.
Social media needs extra caution: content can be copied, screenshotted, indexed by search engines and reused by platforms under their terms. Some organisations therefore publish children's images only in a password-protected parent area. Whatever you publish remains effectively irreversible once shared, so verify consent for each family before posting rather than relying on consent collected at the start of the year for an unrelated later purpose.
- Check the opt-out list and safeguarding register before every publication.
- Prefer activity-focused, wide and side-on images; remove metadata and avoid naming children.
- Use a protected area (parent portal) for routine sharing where practical.
Controlling staff access to CCTV and stored footage
When your site runs CCTV or staff record sessions, the footage of children is personal data and needs a defined purpose, a lawful basis and strong access controls. Letting any employee, contractor or volunteer pull up footage 'to have a look' creates a genuine data-breach and safeguarding risk.
Restrict viewing to named roles — for example the site director, the designated safeguarding lead and the data protection officer or responsible manager — and log each access. Store recordings on organisation-owned, encrypted systems with set retention periods, and prohibit transfer to personal devices or personal cloud accounts. If footage is used for internal purposes such as staff training, confirm separately that families agreed to that use; a consent form that only covers promotional photos rarely authorises training recordings.
- Publish an access list of named staff roles and log every viewing of footage.
- Keep recordings on secured organisation equipment with defined retention and deletion.
- Seek separate consent for internal uses such as training that go beyond the stated purpose.
Handling contractors, parents and personal devices
Personal cameras complicate any policy. Under most data protection regimes, parents taking photos for their own family album or sharing privately with friends fall outside the law, and you cannot fully stop this as a matter of data protection. But you may set site rules banning or restricting photography where it disrupts an event or risks a child who should not be identified.
External photographers and videographers need a written brief and a contract that assigns data-protection responsibility, limits capture to consented children and specifies how images are handed over and deleted. Where a parent publicly posts an image that endangers a child, ask them to take it down and point to your site policy. Make the rules known before key events rather than reacting afterward.
- Give professional photographers a brief listing families who opted out and what is in scope.
- Write contracts clarifying who is responsible for the data captured by external suppliers.
- State site rules for personal photography and livestreaming before events.
Designing the process across a large site
On big territories — campuses, stadiums, parks, cultural centres — continuous filming makes manual tracking of individual consents impractical. Design the consent and access framework up front: identify zones where photography is allowed or banned, place notices where cameras operate, and route all publishing through a named responsible person who consults the opt-out register.
Invest in staff training so employees recognise when they need to check consent, how to respond to a withdrawal, and whom to escalate a safeguarding concern to. Audit your practice periodically: compare what your policy says about filming, publishing and access with what actually happens on the ground, including which staff can reach footage and which images were posted.
- Map photography and CCTV zones on the site plan and post visible notices.
- Route all publishing through one responsible role that checks the consent register.
- Audit actual filming, posting and access behaviour against the written policy at least yearly.
Put it into practice
Photo-and-video readiness audit for sites working with children
Run this audit before a season of events, at the start of the school year, or after introducing new cameras or platforms. Mark every item that is not yet in place; the gaps become your action plan.
- We have a written photography and filming policy that is shared with parents, staff and visitors.
- We have chosen and documented a lawful basis for taking, using and publishing images (public task, consent or legitimate interests).
- Our consent form separates filming from publishing and states purpose, platforms and retention period.
- Families can opt out or withdraw consent easily, and withdrawal does not exclude a child from any activity.
- We keep a register of consent, opt-outs and withdrawals, refreshed at least once a year.
- A named responsible person checks the register before every publication, including social media.
- Published images are activity-focused, avoid close-ups, do not pair names with faces and have metadata removed.
- Children who must not be identified (safeguarding cases, opt-outs) are marked discreetly and excluded from framing.
- CCTV and stored footage can be viewed only by named, authorised staff, and every access is logged.
- Recordings are stored on organisation-controlled systems with defined retention and deletion procedures.
- Staff never take or store children's images on personal devices or personal cloud accounts.
- External photographers work under a written brief and contract with clear data-protection terms.
- Site rules for personal photography and livestreaming by parents and spectators are published before events.
- We train staff on consent checks, withdrawal handling and escalation of safeguarding concerns.
- We periodically audit whether actual filming, publishing and access match our written policy.
Questions people ask
Is parental consent always required before publishing photos of children?
Not always. A recognisable image of a child is personal data, so you need a lawful basis — consent, public task or legitimate interests. Under UK guidance, public bodies often rely on public task for administrative and safeguarding images, while marketing uses usually sit on legitimate interests with an opt-out. Consent is still the clearest basis for promotional use, and best practice is to collect it or provide an opt-out even when another basis applies.
How should we handle a family that refuses to allow photos of their child?
Respect the decision and never exclude the child from activities because consent was withheld. Note the refusal in a register shared only with relevant staff, and mark the child discreetly — for example with a badge or sticker known to the photographer — so group shots can be framed without featuring them centrally. Regularly refresh these lists and confirm them before each event.
Can we rely on consent collected at enrolment for later social media posts?
Often not. Consent is specific: it covers the purpose, platforms and retention you described when it was given. If you later post images for marketing on a new social platform, livestream an event, or use footage for staff training, check whether the original consent covers that use. If it does not, obtain new consent or rely on a different lawful basis. Review and refresh permissions regularly.
Who in our organisation should be allowed to view CCTV footage of children?
Access should be limited to named roles with a genuine need — typically the site director or manager, the designated safeguarding lead and the data-protection officer or equivalent. Each viewing should be logged, recordings stored securely on organisation equipment with defined retention periods, and access denied to general staff, contractors and family members. Review the access list whenever roles change.
Can we stop parents from photographing our events?
As a site owner you may set rules that restrict or ban personal photography where it disrupts an event or risks a child who should not be identified. Data protection law generally does not cover private, family-album use, so such restrictions rest on your site rules rather than on data-protection grounds. Publish the rules in advance, and if a parent publicly posts an image that endangers a child, ask them to remove it and point to your policy.
What should we include in a contract with an external photographer?
The contract should clarify who is responsible for data protection, restrict capture to children whose families consented, specify the permitted purposes and platforms, require secure handling, and set how images are delivered and deleted. Give the photographer a written brief listing any families who opted out and how to identify them without isolating the child, and inform families in advance that a professional photographer will attend.
Sources and further reading
Sources were checked when this page was generated. Confirm changing dates, rules and prices with the original publisher.
- Прокуратура Калининградской области: о размещении в сети «Интернет» фотографий ребёнкаГенеральная прокуратура Российской Федерации
- Уполномоченный разъясняет: фото ребёнка без согласия родителейУполномоченный при Президенте РФ по правам ребёнка
- Родитель может запретить публикацию фото с его ребёнком в публичном пространствеГАРАНТ.РУ
- Data protection in schools: taking and using photos and videos, and using CCTVGOV.UK (UK Government)
- Photographing and filming children: images guidanceNSPCC Learning
- PIPEDA Findings #2025-005: investigation into a swimming pool’s consent requirementsOffice of the Privacy Commissioner of Canada
- Taking photographs: data protection advice for schoolsInformation Commissioner’s Office (UK)