UK GDPR checklist for school photographers
Tick off, project by project.
Before photo day
- Data processing agreement signed with the school or academy trust (Article 28 UK GDPR)
- Processing agreements with the gallery platform and the photo lab in place
- Consent forms with separate purposes handed to the school
- Consent forms collected and documented
- List of pupils without consent received and shared with the team
- Record of processing activities updated for this project (Article 30 UK GDPR)
- Privacy notice on your own website up to date
On photo day
- Pupils without consent are not photographed
- No pupil's name next to a photo on posters or in messages (safeguarding)
- Memory cards and laptop encrypted or secured
- No photos on helpers' private devices
- No transfer over insecure channels such as messengers or unencrypted email
After photo day
- Photos transferred only over an encrypted connection
- Online gallery reachable only with a personal access code
- Order deadline and deletion date communicated to parents and carers
- Photos deleted after the season (deletion period: [Number of weeks] weeks)
- Deletion documented, backups included
Technical measures
- SSL encryption for gallery and shop
- Payments through certified providers, no card data on your own systems
- Regular backups with access protection
- Team access rights limited to what is needed
- Two-factor login for every account with photo access
In an emergency: data breach
- Report to the ICO within 72 hours where the breach is likely to result in a risk (Article 33 UK GDPR)
- Inform those affected if there is a high risk (Article 34 UK GDPR)
- Document the incident, its cause and the measures taken
Notes for the United Kingdom
Authority: Information Commissioner's Office (ICO). Consider registering and paying the data protection fee if you process personal data as a business.
Schools and academy trusts have a data protection officer. Agree the processing agreement with them.
Safeguarding: follow the school's policy on images of pupils. Never publish a pupil's name with a photo.
Template, not legal advice. Review the list with your privacy adviser.