GDPR and event photos: what you need to know

Published: 26 July 2026

When collecting photos from participants at a wedding, celebration or company event, you are handling other people's faces and potentially personal data. This article explains the basic rules simply and practically. It is not legal advice; consult a professional about your particular situation.

Are event photos personal data?

If a photo depicts an identifiable person, it is their personal data and the GDPR applies. It does not matter whether it is a professional shot or a phone snapshot. What matters is whether the person can be recognised.

When GDPR does not apply

The GDPR does not apply to processing during purely personal or household activities. A private wedding or family celebration where photos are shared among family and friends without public publication generally falls within this exception. The boundary changes when photos are published to a wide audience or the event is organised by an organisation or company.

When you need consent or another legal basis

For company and public events, the household exception no longer applies and a legal basis is needed, most often consent from the people concerned or the organiser's legitimate interest. In practice, inform participants in advance that photos will be taken and where they will go, and respect anyone who does not want to be photographed. Sensitive situations require particular care.

Practical rules for organisers

Inform people in advance – for example, a sentence on the invitation or a sign at the entrance explaining that photos will be taken and collected in a shared gallery.
Collect only what you need – no unnecessary extra data.
Restrict access – keep the gallery private and accessible only to the relevant group.
Store securely – choose a service that protects photos and does not expose them to third parties.
Delete when no longer needed – data should not be retained longer than necessary.

Why photo storage location matters

Secure storage and data minimisation are easiest when the service cannot see photo content and the gallery is automatically deleted after a time. That is how FotoQRis designed: every photo is encrypted in the participant's browser, only unreadable data reaches the server and the operator cannot access the content. The gallery is accessible only through a private link or QR code and is automatically deleted with its encrypted files when it expires.

How FotoQR helps

Encryption on the device – even the service operator cannot see photo content.
Private access – only people you give the link or QR code to can open the gallery.
Automatic deletion – data is removed after expiry.
Organiser control – photo moderation and the ability to turn uploads or viewing off at any time.

FotoQR makes the technical side of photo protection easier, but the event organiser remains responsible for why photos are collected and with whom they are shared.

Create a private gallery