School photo consent forms

The rule: a photo of a pupil is personal data, and consent is one basis among several

A photograph or video in which a pupil is identifiable is personal data, so a school needs a lawful basis under Article 6(1) of the UK GDPR before it takes, uses or shares it. The Department for Education's chapter Taking and using photos and videos, and using CCTV in schools, first published on 23 March 2026 in its Data protection in schools manual, puts it this way: “Photos and videos of individuals who can be identified are classed as personal data under data protection law. This means you must have a valid lawful basis before taking, using or sharing them.” It names three bases to consider: public task, consent and legitimate interests.

The ICO's advice to schools, Taking photographs: data protection advice for schools, says which of those it expects: “In most cases, we'd expect publicly-funded schools to be looking at public task. Independent and other schools can look at either public task (if they can point to a relevant legal function or power) or legitimate interests.” It adds that consent gives people “full control over and responsibility for their data including the ability to change their mind”, so that “in some cases, consent may not be the most appropriate option.”

Why a maintained school or academy cannot simply choose legitimate interests:

• The bar. The last subparagraph of Article 6(1) of the UK GDPR says that legitimate interests, and the recognised legitimate interests added by the Data (Use and Access) Act 2025, “shall not apply to processing carried out by public authorities in the performance of their tasks.”
• Who is a public authority. Section 7 of the Data Protection Act 2018 adopts the freedom of information list of public authorities, which in Schedule 1, Part IV of the Freedom of Information Act 2000 includes the governing body of a maintained school and the proprietor of an academy in respect of its academy functions.
• Only when performing a public task. Section 7(2) narrows it: such a body “is only a "public authority" or "public body" for the purposes of the UK GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it.” So the bar covers a state school's public tasks, not everything it does. The ICO says legitimate interests “can be relied on when you're doing something outside the scope of any public functions”; for a state school that is the exception, and the ICO's own worked example of a school prospectus uses public task, not legitimate interests.

The DfE's Data (Use and Access) Act 2025 compliance checklist for schools confirms the same for the new basis: “Public authorities cannot rely on recognised legitimate interests to carry out their statutory functions. Public task will usually remain the most appropriate lawful basis where schools are carrying out their statutory functions.”

The point that matters most for the form is that an opt-out is not consent. The DfE says: “Offering an opt-out doesn't mean you're relying on 'consent' as a lawful basis under data protection law – you should consider this to be the same as pupils, parents or carers giving you their permission.” The ICO blog uses almost the same words. A school can ask families' permission, and honour a refusal, without making consent its lawful basis.

The DfE chapter is guidance for maintained schools and academies in England, and the DfE says independent schools “may also find it useful”. The UK GDPR applies across the UK, and the ICO addresses its blog to “small schools in England, Wales and Northern Ireland, and small independent schools in Scotland”. GDPR in schools covers the wider law, the data protection officer and subject access.

Which basis for which use

One form usually covers several uses, and they do not all rest on the same basis. Sorting them is the first job, because it decides which lines of the form are a choice and which are a notice.

• ID cards, registers and the management information system (MIS). The DfE says public task can cover administrative photos – ID cards, registers, seating plans, PE peg and drawer labels. A family can still object, and the school must consider each objection; the DfE's worked example offers a coded card or a label without a photo instead.
• Lessons, displays and records of pupils' work. These are part of a school's educational function, so a publicly funded school will usually look to public task, as the ICO expects, with a clear explanation in the photo and video policy.
• The prospectus, the website and promotional or marketing material. The ICO's worked example uses public task for a prospectus, which it describes as providing “relevant information to students and parents as part of the school admissions process”, and still expects an opt-out: “If you want to use student photos for promotional purposes, we would still generally expect you to offer an opt-out to parents (or the students themselves if they're old enough to make their own decisions).” Many schools instead treat website and newsletter photos as genuinely optional and ask consent; either can be right, provided the form says which. The DfE says legitimate interests “may be appropriate in some cases” for uses such as newsletters, websites and prospectuses, with a legitimate interests assessment and a clear way to opt out. Read with section 7(2), a state school can rely on it only for something outside its public tasks; an independent school not performing a public function may use it more widely.
• Social media. The DfE: “Social media often requires extra care. Many schools choose to collect specific consent for posting on platforms such as Facebook, Instagram or X.” Where the school chooses consent, that line of the form must meet the consent standard in full. Social media policy for schools covers the accounts themselves.
• Class and individual photographs by an external photographer. The ICO advises telling families before the photographer comes and giving an opt-out, and keeping a record of who opted out. The DfE says: “If you use an external photographer, ensure the contract clearly defines who is responsible for data protection.” In practice that means settling whether the photographer acts as the school's processor or as a controller in its own right when it sells prints to families.
• Parents filming the nativity or sports day. Outside the school's basis altogether. The ICO's Taking photos in schools page says: “Data protection law doesn't apply to the use of personal data for 'purely personal or household activity'.” A school may still set rules on photography at its events, but the ICO's advice to schools says a ban on photography at a school play “wouldn't be on data protection grounds”.

Whatever the basis, the ICO's public page recommends an opt-out: “Regardless of the lawful basis relied upon, we recommend that the school allows pupils the opportunity to opt-out from their image being used.” In practice that makes most of the form a set of opt-outs, with consent reserved for the uses the school has decided are genuinely optional.

Writing the form where consent is the basis

Article 4(11) of the UK GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement”. The DfE repeats the four tests: where a school relies on consent, it must be freely given, specific, informed and unambiguous. On a paper or online form that means:

1. Say what each line rests on. Separate the uses the school carries out as a public task, with the opt-out and how to use it, from the uses it is asking consent for. A family should be able to see which is which.
2. One choice per use. Website, newsletter, social media and any other optional use each get their own yes or no. A single blanket signature is not specific.
3. Nothing pre-ticked. Consent needs a clear affirmative action; an empty box left unticked is a no.
4. Where, and for how long. Say where images will appear, whether names will appear beside them, and that they are kept in line with the school's retention schedule. The law sets no fixed period for photos.
5. Refusal costs nothing. A pupil whose family says no still takes part in the trip, the play and the team; otherwise consent is not freely given.
6. How to withdraw. Article 7(3) of the UK GDPR requires the family to be told, before consenting, that consent can be withdrawn, and says “It shall be as easy to withdraw as to give consent.” Name the person or address, and accept a withdrawal by the same route the form came in.
7. Who signs. The parent or carer for younger pupils; the pupil, as well or instead, once they can understand how their image will be used.

Outside Scotland, there is no fixed age for a pupil's own consent. The ICO's public page says: “Data protection law doesn't specify an age at which a child is considered capable to exercise their own rights, although 12 years old is typically given as a guideline. However, this should be considered on a case-by-case basis.” The DfE says: “When pupils reach an age where they can understand how their images may be used (often at around the age of 13), it is good practice to ask them directly for consent in addition to or instead of parental or carer consent.” In Scotland, section 208 of the Data Protection Act 2018 presumes that a pupil of 12 or over can consent unless the contrary is shown. The DfE also asks schools to consider safeguarding factors in that judgement. The age of 13 in Article 8 of the UK GDPR applies only to online information society services offered directly to a child, not to a school's photographs.

For reception classes, paragraph 3.6 of the EYFS framework for group and school-based providers requires safeguarding policies to cover “How mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting.” Social media policy for a nursery covers that duty in early years settings.

The DfE adds: “It is recommended that you publish a clear photo and video policy alongside your privacy notice.” The form, the policy and the privacy notice should describe the same uses on the same bases.

The record of consent and the list of pupils who must not appear

Where consent is the basis, Article 7(1) of the UK GDPR puts the burden on the school: “Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.” The DfE spells out what that record holds: “You must keep clear records of consent, including who gave it, when, how it was given, and what they were told.” A copy of the form as sent, kept with the replies, answers the last part.

Opt-outs need a record too. The ICO says: “Keep a record of which students have opted out and make sure staff are aware.” Many schools hold both in the MIS against each pupil – the DfE notes, of refreshing consent each year, that “Modern MISs can make this easier” – but a record only works if the person about to publish a photo checks it. The ICO also asks schools to make sure photos can be retrieved if someone requests their information, because a pupil's images fall within a subject access request like any other personal data.

Where the images are stored matters as much as the form:

• School devices and school systems. Move images from school cameras and tablets to secure school storage promptly, and delete them under the retention schedule.
• Not personal phones. The DfE: “Staff should avoid using personal devices to take or store school photos unless explicitly authorised under your school's policy and should ensure any images are transferred securely and deleted promptly.” Its reason is that personal phones and tablets can back up automatically to personal cloud accounts.
• A safeguarding matter as well. Paragraph 509 of Keeping children safe in education 2026 lists “taking photographs of children on their mobile phone, contrary to school policy” as an example of a low-level concern about an adult; the low-level concerns guide covers how those are recorded.
• The school's own accounts. The DfE advises limiting access to school social media accounts to trained staff, without relying on a single person.

Withdrawal, objection and renewal

A family can withdraw consent at any time. Article 7(3) of the UK GDPR provides that “The data subject shall have the right to withdraw his or her consent at any time” and that withdrawal does not make earlier use unlawful. The DfE: “Once consent is withdrawn, you must stop using the individual's data and delete it, unless you have a separate lawful basis to keep or use it.” Its example of a parent who first agrees to website use and later opts out reaches the same result: the school “must remove the image from the website, social media and future materials”, and group photos may need editing or replacing.

Printed copies are the exception. The DfE: “If a pupil withdraws permission after a printed prospectus has already been distributed, the school cannot re-call the copies, but must stop using the photo in future versions.” The ICO's worked example reaches the same answer – no recall of existing paper copies – with a caveat: the school should “consider any child welfare issues”.

Under public task the right is to object rather than to withdraw. Article 21(1) of the UK GDPR gives a right to object, on grounds relating to the person's particular situation, to processing based on public task or legitimate interests, and the school must stop “unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject”. The DfE: “You must consider each opt-out request carefully in line with the right to object in data protection law.” It gives the limit: “even if a parent or carer objects, the school may lawfully continue using the photo if it is necessary and proportionate for a public task such as safeguarding or identification (for example, ID cards or MISs).” The DfE's examples of continued use are ID cards and MISs; in the ICO's prospectus example the school stops using the photo. A promotional photo will rarely meet the test, and for an ID photo a coded card can resolve the objection anyway.

Renewal is practice, not law:

• Annual refresh. The DfE: “Many schools choose to review and refresh consent regularly – for example, every academic year – to make sure records are up to date.” The law sets no period, but an annual form also catches pupils who have reached an age to decide for themselves.
• New purposes. The DfE: “If you plan to use images for a new or different purpose, check whether the original consent applies. If it does not, you may need to rely on a different lawful basis or obtain new, valid consent for this particular purpose.”
• New platforms. The DfE: “If you introduce new systems or platforms, carry out a data protection impact assessment (DPIA) to identify and reduce privacy risks.” DPIA for schools covers when one is required.
• Start of the year. The ICO suggests telling families at the start of the year which key events will be photographed and how to opt out.

The withdrawal that arrives as a message

The form comes back through the office, but the withdrawal often does not. A parent texts the class teacher on a Sunday to say they no longer want their child's picture on the website. A foster carer tells a teaching assistant at the gate, then confirms by message, that a pupil must not appear in anything public. A member of staff shares the sports day photos in the year group's staff chat, on personal phones that back up to personal clouds.

Each of those is part of the record this guide has described. The withdrawal is the moment the school's duty to stop starts: the image comes off the website, social media and future materials. The message about a pupil who must not be identified belongs on the list the designated safeguarding lead keeps. If they sit on one teacher's phone, the office does not act on them, and the school cannot show later when it was told.

ComplyChat is designed to keep those conversations where the school can find them. Staff, and parents added by their mobile number, talk in channels the school controls; a mobile number verified by SMS is an identity, so a parent needs no account on the school's systems; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the school's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat is not a photo library and does not manage photo consent or hold a consent register: the record of consent belongs in the MIS or the system your policy names.

A question for the next leadership meeting: if a parent said tomorrow that they withdrew photo consent last term, could the school show when they said it, to whom, and what was taken down?

Questions people ask

What should I write in my photo consent form?

A school photo consent form should list each use separately – displays, newsletters, the website, social media – say which the school carries out as a public task with an opt-out and which it is asking consent for, where images will appear and for how long, and how to say no or withdraw later. The DfE says the school must keep a record of who gave consent, when, how it was given and what they were told.

Is it illegal to take pictures of children in school without consent?

No, not in itself. The DfE says: “You do not always need permission from a pupil, parent or carer to take a photo or video, but you should check permissions before using, storing or sharing it,” and the ICO expects publicly funded schools mostly to rely on public task rather than consent. Parents filming a school play for the family are outside data protection law, which does not apply to purely personal or household activity.

Can someone use a picture of my child without my permission?

A school can use a pupil's photo without consent where it has another lawful basis, such as public task for ID cards and registers, but the pupil or parent can object under Article 21 of the UK GDPR, on grounds relating to their particular situation, and the school must then stop unless it shows compelling legitimate grounds. If another parent posts a child's photo on a public account, the ICO's public page suggests asking them to remove it first: “We recommend allowing one month for a response. If they refuse or don't reply you can submit a complaint to the ICO.” It adds that it may contact the account owner, but “beyond this, it is unlikely that the ICO can take additional action.”

What age can a child give consent for photos?

In England, Wales and Northern Ireland, data protection law sets no age for photo consent in schools; in Scotland, section 208 of the Data Protection Act 2018 presumes a child of 12 or over can consent unless the contrary is shown. The ICO gives 12 as a typical guideline, judged case by case, and the DfE says it is good practice to ask pupils directly from around 13. The fixed age of 13 in Article 8 of the UK GDPR applies only to online information society services offered directly to a child.

How often should schools renew photo consent?

The law sets no renewal period. The DfE says many schools review and refresh consent “for example, every academic year”, and that a new or different use of images needs a check that the original consent covers it.

What happens if a parent withdraws photo consent?

Article 7(3) of the UK GDPR lets a family withdraw consent at any time, and it must be “as easy to withdraw as to give”. The DfE says the school must then stop using the image and delete it unless it has a separate lawful basis to keep it. In its example of a parent who opts out, the image comes off the website, social media and future materials, but printed prospectuses already distributed need not be recalled.

Official guidance and your next step

Start with the Department for Education's chapter Taking and using photos and videos, and using CCTV in schools, first published on 23 March 2026, which carries worked examples; the ICO's Taking photographs: data protection advice for schools (August 2025); and its page for families, Taking photos in schools, which says: “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.” On 30 September 2026 the Information Commission took over from the Information Commissioner as the regulator, still known as the ICO. The law is in Articles 4, 6, 7, 8 and 21 of the UK GDPR, sections 7 and 208 of the Data Protection Act 2018, and Schedule 1, Part IV of the Freedom of Information Act 2000. Also cited are paragraph 509 of Keeping children safe in education 2026, paragraph 3.6 of the EYFS framework for group and school-based providers and the DfE's DUAA compliance checklist for schools. Quotations are from those pages as published on 28 October 2026.

This guide covers schools in England, with the UK-wide law noted, and is not legal advice. Your data protection officer, local authority or trust may publish a model photo and video policy and form to adapt.

Then do one thing: take this year's form and mark each line as public task, consent or legitimate interests. Any line marked consent that the school could not stop doing tomorrow probably needs a different basis – the DfE says that where a photo “is essential to perform a task, you need to consider if this is the most appropriate lawful basis to use” – and any line that calls an opt-out consent needs rewording.