Corporate event photos and GDPR: what you need to know.
As soon as someone is recognizable in a corporate event photo, GDPR applies. That doesn’t forbid photographing an offsite: it means you inform people, pick a legal basis and know how long you keep the photos. This guide sums up the essentials. It is not legal advice: for your own case, talk to your data protection officer or a lawyer.
Only the host needs the app, on iPhone. Your guests have nothing to install.
An identifiable photo is personal data
As soon as someone can be recognized — by their face, their badge, the context — the photo is personal data under GDPR. Taking it, storing it, sharing it, publishing it: each step is processing. Hence the usual rules: purpose, legal basis, informing people, retention period, security, people’s rights.
Legal basis: legitimate interest or consent
For internal use — intranet, newsletter, keepsake album — many employers rely on legitimate interest: photos are expected at an event and the impact is limited, provided people are informed beforehand and can easily opt out. It’s a balancing test, to be documented in your records of processing, not a default choice.
For external use — website, social media, press — consent is the safest basis: freely given, specific, informed, withdrawable at any time. Between an employer and an employee, the freedom of that consent is fragile: it has to be genuinely optional, with no consequence for refusing, and recorded.
Image rights: a separate layer in France
Image rights don’t come from GDPR but from the French Civil Code, under the right to privacy. Anyone can object to their image being published without their authorization, with exceptions — public events, groups where nobody is singled out, news coverage. Several other European countries have similar personality rights. The two layers stack: complying with GDPR doesn’t exempt you from image rights, and vice versa.
In practice: to publish a photo where someone is recognizable, get their authorization — in writing for external use, stating the media, the duration and the scope.
Informing participants, before the event
- In the invitation — one sentence: photos will be taken, by whom, for what use, how long they’ll be kept, how to opt out, and who to write to.
- At the entrance and on the tables — a notice at check-in and a line on the badge or the table card, with a link to the full privacy notice.
- A visible sign — a sticker on the badge or a lanyard in a different color for people who don’t want to appear. The list goes to the photographer and to whoever sorts the photos.
- The records — the processing is entered in your records: purpose, legal basis, retention, recipients, hosting, processors.
Retention, sharing, processors
Set a retention period tied to the use: a few months for an internal recap, longer for a documented archive selection. The rest gets deleted. Internal sharing and external sharing are two separate processing activities, each with its own legal basis and its own notice.
The photographer, the agency, the hosting platform are processors or controllers in their own right: you need a contract covering what they do with the photos, and you need to know where the photos are hosted. Hosting inside the European Union avoids the question of transfers outside the EU.
Right to withdraw and to erasure
A participant can object to the processing or withdraw consent at any time. You then remove the photo from everything you control and reply within a month. You can’t recall a printed brochure — hence the caution on external use. Make it easy to ask, and log the request.
With WeWere
WeWere is a shared disposable camera. Photos are hosted in the European Union (Supabase and Cloudflare R2) and visible only to the members of the event: nothing is public or indexed. Participants sign in with the Apple or Google account they already have, with nothing to install.
The host deletes a photo at any time and can remove a participant. The album stays online for 45 days after the event, then nobody can see it anymore; Keep one year keeps it online for one year instead. The file of a deleted photo is erased within 30 days. No ads, no data sold. The details are in the privacy policy. Informing participants, the legal basis and the records remain the organizer’s job. See the companies page, the guide on collecting offsite photos, and for several events a year, WeWere for companies.
Frequently asked questions
A group photo where nobody is recognizable — does this apply?
If nobody is identifiable, it’s not personal data. But identification is broad: a badge, a silhouette, a setting can be enough. When in doubt, apply the same rules.
Can we post the offsite photos on LinkedIn?
Yes, with the agreement of identifiable people — consent under GDPR and authorization under image rights — kept in writing and withdrawable. Favor wide shots and ask before tagging.
An employee asks for a photo to be deleted. What do we do?
Remove it from everything you control, reply within a month, log the request. With WeWere, the host deletes the photo immediately, and the file is erased within 30 days.
Where are the photos hosted with WeWere?
In the European Union, with Supabase and Cloudflare R2, visible only to the members of the event. Details in the privacy policy at /privacy.
Create a company event.
Create the event in the app, inform participants in the invitation, put the QR on the badges.
Download on theApp StoreUnlimited guests. Free up to 40 photos