Company Event Photos: What GDPR Actually Requires

An Employee's Photo Is Personal Data

As soon as a person is identifiable in an image, that image counts as personal data under GDPR. Photos and videos from your seminar or annual party fall squarely within the regulation's scope: you need a legal basis to collect them, clear information for the people involved, a defined retention period, and real rights of access and deletion.

On top of that comes image rights, separate from GDPR: publishing an employee's photo (on LinkedIn, the intranet, a brochure) requires their consent, which companies typically formalize through a written agreement or a dedicated clause.

Where Common Practices Go Wrong

The "Annual Party" WhatsApp group checks nearly every wrong box: photos end up on the personal phones of dozens of colleagues, with no oversight, no retention period, and no real way to withdraw them. An open shared folder is not much better: there is no way to know who uploaded what.

Voluntary collection flips the logic: each participant chooses for themselves what they send to the album. No one is photographed without their knowledge by a system the employer set up, which greatly simplifies the analysis: the employee becomes an active participant in the collection, not just its subject.

The Checklist for a Compliant Event Album

A clean setup brings together: clear information at the moment of upload (who is organizing it, for what purpose, for how long); a private album accessible only to participants via the link or QR code; hosting within the European Union; moderation by the organizer before anything is shared further; permanent removal of any content on an employee's request; and complete deletion on an agreed date.

For external distribution (social media, careers page), keep your usual individual consent process: a centralized album actually makes this easier, since you know exactly who took each photo and can track approvals.

The Bonus: Your DPO Becomes an Ally

Framed this way, the event album stops being a risk to manage and becomes a compliance improvement over the informal free-for-all: voluntary collection, a closed circle, European hosting, scheduled deletion, and a documented record. That is exactly the case to bring to your DPO, processing record in hand, before your next seminar.