A photo showing a specific person's face is personal data under GDPR — just like a name or an email address. For a private wedding, most people handle this with common sense; for a company event or conference, it pays to know a few specifics.
When GDPR actually applies to your event photos
If you're collecting photos only for yourself and family (a typical wedding), it usually falls under the "personal or household purpose" exemption, and GDPR doesn't apply in full. The moment photos get used commercially — on a website, on social media, in promotional material for next year's conference — it becomes processing of personal data that GDPR fully covers.
What a company event organiser should have in place
- Inform attendees in advance — state in the invitation or at registration that the event will be photographed and photos may be used for promotion.
- An option to opt out — a spot where someone who doesn't want to be photographed can stand, or a way to request removal of a specific photo after the event.
- A clear purpose — photos for an internal archive are a different case from photos for a public ad campaign; the purpose should be clear at the point of collection, not invented afterwards.
- A reasonable retention period — photos from a one-off event have no reason to stay stored indefinitely without a clear purpose.
Where your data physically sits matters more than it seems
Photos uploaded through a tool with servers outside the EU fall under a more complicated legal framework (transfer of personal data to a third country). A tool with data stored directly in the EU removes that complication — and it's one of the first things a compliance department asks about at company events.
A practical recommendation
When choosing a tool for collecting guest photos, it's worth checking three things: where the data sits, whether the provider has a data processing agreement (DPA) ready to sign, and how long photos are kept after the event. Pixelka has these answers published openly — you'll find the privacy policy and a DPA ready to sign right on the website, no need to request them.
This article is a general overview, not legal advice — for company events with a more sensitive audience (children, healthcare events, for example), we recommend a tailored consultation with a lawyer.