GDPR for Photographers: Client Galleries, Contracts and AI Tools

Every photograph of an identifiable person is personal data under the GDPR, which applies if you have clients in the EU. Galleries need access controls and an expiry that really deletes, the contract must say what you keep, for how long and who processes it, and AI tools should come with a processor agreement and a clear no-training term.

Photographs are not automatically special-category data, but they become biometric data when a tool processes them to identify a person, which is what face grouping and face search do. That makes gallery and AI settings more than technical details. Treat what follows as a working checklist rather than legal advice; the closing section lists the questions only a data-protection adviser can settle.

Follow me on Instagram@sagnikteaches

Who holds what: you, your gallery host and your editing tools

You decide why and how clients' data is used, which makes you the controller. Everyone you pass it to for a job is a processor: the gallery host, the cloud backup, the print lab, a second shooter and any AI culling or editing service. Article 28 requires a written contract with each processor covering instructions, confidentiality, security, sub-processors and deletion or return of the data at the end.

Connect on LinkedInSagnik Bhattacharya

The people in the frame are wider than the client. A wedding gallery holds the couple, their guests, children, family members and passers-by, and only the couple hired you. Beyond images you also hold names, addresses, payment details, timelines and often dietary or accessibility needs, which can reveal health information and deserve the same care.

Subscribe on YouTube@sagnikteaches

On images themselves, Article 4 defines biometric data as personal data resulting from specific technical processing of physical characteristics that allows or confirms unique identification, with facial images as an example. Recital 51 adds that photographs are not systematically special-category data and are biometric data only when processed through technical means that allow unique identification. An ordinary gallery sits outside that. A feature that groups every photo by face, or lets a guest find their pictures by uploading a selfie, does not, so treat it as a question for your adviser before you switch it on.

The table sets out the basis you would typically record for each purpose. It is a starting point to confirm with your adviser, not a ruling.

Copyright and licensing are a different subject from data protection, and the contract has to handle both. Ownership of AI-edited work is covered in photography copyright and AI. This page stays with personal data.

Client galleries: eight settings to check on whatever host you use

A gallery is where client images are most exposed, because a link can travel further than you intend. The examples below come from Pixieset's help centre, chosen because its pages state their defaults plainly. Look for the equivalent setting in your own host.

1. Make every client gallery private by default. Article 5 asks for security appropriate to the data. Pixieset's help says a collection password limits access to the entire collection, and that hiding a collection from the homepage does not disable its direct link. Hidden is not private. Check: open the gallery in a private browser window with no password and see what appears.
2. Send the link and the password by different routes. If both sit in one email, a wrong recipient gets everything. Email the link, text the password.
3. Separate what the client sees from what guests see. Pixieset's Client Exclusive Access creates separate viewing experiences for clients and guests within one collection, and clients can mark photos as private, which hides them from guests while you and the client still see them. Use that for getting-ready shots, family portraits and anything with children. Check: create a test guest view and scroll through it.
4. Keep downloads behind a PIN and cap them. Pixieset automatically sets a download PIN when downloads are switched on and lets you limit how many times a PIN can be used. Otherwise a shared link turns into a free file store.
5. Switch on automatic expiry, then add a deletion step. Pixieset says collections do not expire unless Auto-Expiry is on, and that at expiry a collection is set to Hidden and is not deleted or removed from the account. If you cancel the subscription, collections are kept for a period before deletion, and the help article does not say how long. So expiry closes the door, but the images are still there until you delete them. Put the deletion date in your calendar.
6. Look at what the host collects from visitors. If guests can register an email address to view or favourite images, that address is personal data too. Switch it on only if you need it and cover it in your privacy notice.
7. Find the host's data processing agreement. Pixieset's GDPR page describes you as controller of your clients' data and says its addendum covers how it processes that data on your behalf. The addendum is included in its terms automatically for qualifying controllers and does not have to be signed. The page says Pixieset has contractual commitments with sub-processors but does not name them. Check: search your own host's legal pages for "data processing" and note the date you found it.
8. Test the link as a stranger would. Before delivery, ask a friend to open it on a phone that is not signed in, and write down everything they can see.

Hosts differ on fees, AI features and storage, and Pixieset or Pic-Time for photographers compares two common ones. Whatever you choose, the privacy settings above matter more than the template.

How long a gallery, a final image and a raw file should live

The GDPR sets no retention period for photographs. Article 5 says data may be kept in identifiable form for no longer than necessary, and Article 17 gives people the right to have data erased when it is no longer necessary for its purpose or when consent they gave is withdrawn and nothing else justifies keeping it. There are exceptions, including legal obligations and legal claims, which is why your adviser should look at the records you keep as evidence. The practical job is to choose a rule for each stage, defend it, and write it into the contract.

Photographers have honest reasons to keep files: reprints, album reorders and disputes. They also have reasons to let go, since every extra file is another set of faces to protect. Here is a lifecycle you could adapt (illustrative periods).

Now the numbers. Say a wedding and portrait photographer shoots 28 weddings and 120 portrait sessions a year. A wedding produces about 2,400 raw files and 600 delivered images, and a session about 250 raw files and 40 delivered images. That is 97,200 raw files and 21,600 delivered images a year (28 x 2,400 plus 120 x 250, and 28 x 600 plus 120 x 40). Compare two rules once the studio has been running for five years.

Rule B holds 437,400 fewer files, a cut of about 74%. That means fewer faces at risk if a drive is stolen, a quicker search when a client asks for their data, and a smaller bill for storage. The price is that clients cannot ask for raw files after six months, so the contract has to say so, and anyone who wants them can buy them at delivery. Be honest about backups too: say in the policy that deletions reach backups within a stated period as rotating copies are overwritten, and ask your adviser whether your wording is enough.

Contract clauses that carry the data-protection load

A contract cannot make a poor practice lawful, but it is where you tell clients what Article 13 requires and where you record their choices. Short clauses in plain language beat a pasted privacy policy that nobody reads. The wording below is illustrative, with square brackets for your details, and your adviser should check it against where you trade.

Your information. I collect your name, contact and payment details, event
details, and the photographs and video I take. I use them to provide the
service you booked, to deliver and store your gallery and to keep accounting
records. Photographs of you and your guests are personal data and I am
responsible for them.

Who else handles it. Your images and details are handled for me by [gallery
host], [cloud backup], [print lab], [second photographer] and [accounting
app], each under a written agreement. Some providers process data outside the
EU under standard contractual clauses [confirm for each provider].

How long I keep things. Your online gallery stays open for [12] months. Raw and
unselected files are deleted [6] months after delivery. Final images are
archived for [5] years and then deleted. Backups are overwritten within [90]
days of a deletion.

AI-assisted tools. I use [tool name] to sort and edit images. It processes them
for me under a written agreement and does not use them to train its models
[confirm this for each tool]. If you do not want AI-assisted editing, tell me
before the shoot and I will edit by hand [at no extra charge / for a fee].

Using your images to promote my business (choose one):
[ ] You may use selected images on my website, social media and printed samples.
[ ] You may use selected images that do not show faces.
[ ] Please do not use any images of us for promotion.
You can change your mind at any time by telling me. I will stop future use and
remove images from my website and social accounts within [30] days. I cannot
recall printed samples already handed out or copies held by other platforms.

Guests and children. Please tell your guests that photographs will be taken.
I do not use images of children for promotion without the written permission
of a parent or guardian.

Three details earn their place. The three-way marketing choice makes "no" as easy to tick as "yes", which is what freely given, specific consent needs, and the withdrawal sentence reflects the rule that withdrawing must be as easy as giving. The retention clause turns an internal decision into a promise you can be held to, so do not write periods you will not keep. And the AI clause is only as true as your last read of each tool's policy.

A line that says a tool does not train on images becomes false the moment you adopt a tool whose policy says otherwise. Aftershoot's privacy policy reads, for example, as saying that the images and edits it collects are used to train its models. Recheck every tool before you copy that sentence into a contract, and see AI disclosure wording for photographers' contracts and galleries for ways to phrase the disclosure itself.

Children and guests: whose faces are in the gallery

Images of children are personal data like any other, but they call for more care, and so do images of people who never signed your contract. Article 8 sets 16 as the default age at which a child can consent to certain online services and lets countries lower it to no less than 13, so the rules differ from place to place. The safe studio rule is simple: take written permission from a parent or guardian for any use of a child's image beyond delivering the job to the family.

Four habits cover most of it.

• Put children's sets behind client-only access. Use the separate guest and client views your host offers, so that a guest link never opens family portraits.
• Leave names and identifying details off children's images. Captions, filenames and alt text should not combine a child's name with a school, club or address.
• Ask the booking party to warn the people being photographed. At a larger event, a short notice at the entrance saying who is photographing, for whom, and how to ask not to be included does more than any clause.
• Keep children's images out of AI tools unless the provider is your processor and does not train on uploads. That includes face grouping, which has no place on a child's gallery.

Choosing images for the portfolio is where most studios slip. Pick frames where guests are not identifiable, such as backs, hands, details and wide shots, unless you have asked. The same habit protects you when a couple later changes their mind about a social post.

AI tools in a photography workflow: five questions before you upload

Culling, retouching, generative remove and fill, album design and caption writing all send client images or details to someone else's servers unless the tool runs wholly on your machine. Each upload is a disclosure that needs a basis and a contract. Ask the same five questions of every tool, and write the answers in your record.

1. Is the vendor my processor under a written agreement? A privacy policy describes how the vendor treats the data it collects. It is not a processor agreement for your clients' images. Ask for the data processing addendum by name.
2. Does it train on what I upload? Policies word this differently, and the differences matter. The table shows three.
3. How long does it keep uploads, and what happens if I cancel? Find out whether you can export and delete before the account closes.
4. Where is it processed? If the provider handles data outside the EU, the contract needs a transfer mechanism such as standard contractual clauses.
5. Does the feature identify people? Spotting that a face is blurred or has closed eyes is one thing. Recognising whose face it is, or matching faces across a gallery, is biometric processing, so ask your adviser before using it and secure explicit consent if it goes ahead.

Here is how three vendors' own pages read this month. The comparison is meant to show that the wording varies, not to rank the tools, and policies change, so read the live pages before you decide.

Notice what each answer leaves open. A "no training" promise from Adobe about Firefly says nothing about a different vendor's tool, and a policy that names the vendor as controller leaves you asking what its arrangement is for your clients' images. The method for reading any privacy policy is set out in what to check in an AI tool's privacy policy and terms. When a policy is silent on a point, ask the vendor in writing and file the reply with your records.

General-purpose chatbots need the same reading. OpenAI's help says model-training sharing is on by default for personal ChatGPT Free, Plus and Pro workspaces, Anthropic's consumer plans have a Model Improvement setting, and the business plans of both are not trained on by default. For client images that means no uploading to a personal account, and not much upside from uploading to a business one when a written description would do. Which editing stage suits AI at all is covered in cull, edit or retouch first.

Captions and alt text without uploading client photos

The cheapest privacy gain in an AI workflow is to describe an image rather than upload it. Write a short description yourself, with no names, dates or places, and give the chatbot that. The words come back without a single client image leaving your machine.

Write three Instagram captions of under 30 words each for a wedding gallery
teaser. Details: outdoor ceremony, couple walking through confetti, golden-hour
light, a countryside barn venue (do not name it). Do not use names, dates or
places. Plain English, no hashtags, no emojis.

A plausible reply (illustrative) looks like this.

1. Confetti, golden light and two very happy people.
2. Walking out as newlyweds, one confetti shower at a time.
3. The barn doors opened and the whole room cheered.

Caption 3 invents an event. Nothing in the brief says the barn doors opened or that anyone cheered, and a couple who were there will notice. Replace it with something you actually saw. Before any of these captions goes live, check the couple's marketing choice in the contract, and strip location metadata from the exported file, since many export dialogs embed it by default. Alt text follows the same rule: "Two people walking hand in hand through a shower of confetti in warm evening light" describes the picture and names nobody. More ways to speed up captions, alt text and filenames are in AI for photographers' alt text, filenames and captions.

Two things that go wrong: a wrong gallery link and a take-down request

These two incidents are the ones a gallery business meets sooner or later. Rehearse them once on paper.

A gallery link goes to the wrong family

Say it is Monday at 20:00 and a photographer realises that the link and password for one family's session, which includes the children, went to a second family with a similar name. The second family replied: "Lovely photos, but who are these children?"

1. Contain it. Set the gallery to Hidden or change its password, ask the second family to delete the email, and get their confirmation in writing.
2. Note the time you became aware. Monday 20:00 starts the clock. Article 33 gives 72 hours, so the notification deadline, if one applies, is Thursday 20:00. The duty is to notify the regulator unless the breach is unlikely to result in a risk to people.
3. Assess the risk. Children's images, names in the gallery title and any location clues all raise it.
4. Tell the first family. Article 34 requires it when the risk is high, and it is the right thing to do either way.
5. Record the facts, the effects and your actions, and ask your adviser to confirm whether regulator notification was needed.
6. Fix the cause. Send links and passwords by different routes, check the recipient before you press send, and keep surnames out of gallery titles.

A guest asks you to take an image down

Eight months after a wedding, a guest emails asking you to remove a photograph of their child from your website. The couple's marketing consent does not cover the child, so the request is not one to argue with.

1. Day 0: acknowledge the request and keep the email.
2. Days 1 to 3: list every place the image appears (website, social posts and stories, host homepage, print samples, any directory listing) and remove it from each one you control.
3. By day 10: reply in writing saying what was removed and what you cannot recall, such as printed samples already handed out and copies held by platforms.
4. Record it: the date, the places, the reply and what you changed in future portfolio selection.

Article 12 allows one month to respond, with a possible extension. For a parent's request to stop promotional use of a child's image, treat that month as a ceiling and not a target.

What to put in front of your adviser, and what to ask

An adviser can do more in an hour if you bring the working documents: your contract template and privacy notice, the list of tools with the vendor statements you collected, the retention table, and a screenshot of your gallery privacy settings. The questions below are the ones a checklist cannot settle for you, because the answers depend on where you trade and what you shoot.

1. Which basis should I record for each purpose: delivery, accounting, portfolio use and guests' images?
2. Do my contract clauses tell clients enough, and what must I add for the place where I trade?
3. For each AI tool, is the vendor my processor, and are its transfers covered?
4. Does face grouping or face search in any tool I use count as biometric processing, and what consent would it need?
5. How long should I keep contracts and invoices, as against images, given accounting and insurance rules?
6. Do I need a record of processing, a registration or fee, or an impact assessment?
7. What should my breach and take-down procedures say, and who in my business does what?

File the evidence together: the signed contracts with marketing choices, each vendor's agreement with the date you checked it, the gallery settings screenshots, the retention table and the incident log, even if it is empty. When a client asks how you protect their images, the folder is the answer.

Photographer questions about GDPR and AI

Are photographs of people personal data under the GDPR?

Yes. Any information relating to an identified or identifiable person is personal data, and a clear photograph of a person qualifies. Photographs are not automatically special-category data. Recital 51 says they count as biometric data only when processed through specific technical means that allow unique identification, such as face recognition. Treat any face-matching or face-search feature as something to check with your adviser.

Do I need consent to put client photos in my portfolio?

Delivering a gallery to a client can rest on the contract, but using their images to promote your business is a separate purpose. The usual route is a clear, separate opt-in in the contract, with a way to withdraw later. Guests and children need extra care. Ask a data-protection adviser which basis fits your work and where you trade.

How long should a photographer keep client galleries and raw files?

The GDPR sets no fixed period. Data should be kept in identifiable form for no longer than necessary. Decide a rule for each stage: how long the online gallery stays open, how long raw files and final images are kept, and how long backups take to be overwritten. Put the rules in the contract, and remember that some hosts hide an expired gallery rather than delete it.

Can I upload client photos to an AI editing tool?

Only after checking the provider's terms. Ask whether it acts as your processor under a written agreement, whether it trains its models on your uploads, how long it keeps them and where it processes them. A privacy policy is not a processor agreement. If the answers are unclear, keep that tool away from images of children and from events with guests.

What should happen if a gallery link goes to the wrong person?

Contain it at once: hide the gallery or change its password, and ask the recipient to delete the email. Note the time you became aware, because notifying the regulator, where needed, is due within 72 hours, and tell affected clients if the risk to them is high. Record the incident either way and ask your adviser to confirm what applies.

Further reads

• Photography Contract Template: Let AI Draft It, Then Check Rights — Rights clauses to check in an AI-drafted contract.
• Is AI Culling Worth Paying for as a Wedding Photographer? — Whether AI culling earns its fee, before you upload anything.
• GDPR for Personal Trainers: A Checklist for Client Health Data and AI — The same duties for another client-facing business.
• Wedding Venue Instagram: Real-Wedding Posts and Couple Consent With AI — Couple consent for real-wedding posts.
• GDPR and AI Tools: What a Small Business Must Do — What a small business must do when it adds AI tools.
• Photographer Gallery Delivery: Reminders and Print Upsells With AI — Gallery delivery reminders, with the privacy side in mind.
• AI Agent for Photographers: Enquiry to Booking Without the Inbox — What an AI agent handles between a photography enquiry and a signed booking, where you approve, and the rules that keep it from overpromising.
• ChatGPT Prompts for Wedding Photographers: Timelines, Groups, Albums — Eight copy-ready prompts for the planning side of a wedding: timeline, family groups, album spreads, captions and proof-round replies, with sample outputs.
• Headshot Photography Business: Reach Corporate Clients With AI Outreach — Build a notes-based target list, draft three honest outreach emails with AI, and offer an on-site team day, with consent and spam rules covered.
• How to Use AI in a Photography Business: Start With Admin, Not Editing — Rank admin, marketing and editing by payback and risk, then start with three admin jobs: enquiry replies, shoot briefs and delivery emails.
• ChatGPT for Photographers: What to Hand Over and What to Keep — Which photography business tasks ChatGPT can take over and which to keep, with a worked quote, alt text, a RAW-file reply and a weekly time sum.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the text of the GDPR (Articles 4, 5, 6, 7, 8, 12, 17, 28, 33 and 34) and Recital 51; Pixieset help centre articles on gallery privacy, expiry and GDPR; the privacy policies of Aftershoot and Imagen AI; Adobe's statement on generative AI and user content; OpenAI and Anthropic privacy and business-data pages.