Should Employers Use Staff Photos – Even After They’ve Left?
We all know about Data Protection, or at least, we should. If you run a business and you’re using photos of people in your promotional material, you’re handling personal data. That means you’re legally bound by the Data Protection Act 2018 and the UK GDPR.
And if you get it wrong? The Information Commissioner’s Office (ICO) — the UK’s data protection regulator — can take action. This could include:
• Ordering the removal of unlawfully used images,
• Requiring you to change your data practices, and
• In serious cases, issuing fines of up to £17.5 million or 4% of your annual global turnover, whichever is higher.
So, if you’re using staff photos in your marketing — especially of people who’ve since left your organisation — here’s what you need to know.
Is a photo personal data?
Yes. Under the law, personal data means:
“Any information relating to an identified or identifiable living individual.”
That includes a photograph, if the person in it is clearly recognisable. This might be because of:
• Their face,
• A name badge or uniform,
• A distinctive location (e.g. workplace),
• Or other visual clues that link them to their identity.
Even if you don’t name the individual in a post, if others can reasonably identify them, the image still counts as personal data — and it’s protected by law.
What does this mean for businesses?
If you’re using staff (or customer) photos to promote your business, you must have a lawful basis to do so. For marketing purposes, the most appropriate basis is usually:
• Informed, freely given, and specific consent
That means:
• You’ve clearly explained how the image will be used,
• The person has actively agreed (ideally in writing),
• And they weren’t under pressure or misled.
What happens when someone leaves?
Consent doesn’t last forever. In particular, if an employee leaves, any consent they gave to use their photo:
• Should not be assumed to continue, and
• Should be renewed if you intend to carry on using the image.
Even if they initially agreed during their employment (e.g. via a contract or media release form), you need to ask them again. Continued use without this renewed consent could be unlawful.
Consent can also be withdrawn.
Importantly, consent can be withdrawn at any time — even if it was valid when first given. If someone contacts your business and asks for their image to be removed, you are legally required to:
• Stop using it,
• Remove it from websites and social platforms, and
• Avoid including it in future promotional materials.
What rights do individuals have?
If you’re a former employee or customer, and your photo is being used without your consent, here’s what you can do:
1. Ask the business to remove the image. Politely state that you no longer consent to its use.
2. Submit a Subject Access Request (SAR). You’re entitled to know what personal data the company holds about you, including photos.
3. Contact the ICO. If your request is ignored or refused, you can lodge a complaint with the Information Commissioner’s Office. The ICO can step in to enforce your rights and hold organisations accountable.
A reminder to employers
If you’re a business owner or employer:
• Always get clear, written consent before using someone’s image.
• Be specific about where and how the image will appear.
• When someone leaves your organisation, refresh or renew their consent — or stop using the photo.
• Respect any requests to withdraw consent, and act promptly to remove the image if asked.
Handling personal data responsibly isn’t just about ticking legal boxes — it’s about trust, professionalism, and showing respect for the individuals you’ve worked with.
While I’m not legally trained, this advice comes from years of experience working within the Data Protection Act — both in local government and as a professional photographer.
My aim is always to respect the people I photograph and ensure their image is used in a way that honours their rights.