Do They Have the Right to Use My Photo on Website?

Why your photo counts as personal data

Under UK data protection law, a photograph of you is personal data if someone could recognise you from it. The UK GDPR and Data Protection Act 2018 protect this information in the same way they protect your name, address or date of birth.

This means any organisation wanting to put your photo on their website needs to follow data protection rules. They cannot upload an image of you just because they happen to have one.

The law applies regardless of who took the photograph or the circumstances. It makes no difference whether the image came from a professional shoot, a company event, your personnel file, or a casual snapshot at a work function. Once an organisation wants to publish it online, the same protections apply.

Organisations often rely on consent for using your photo, but other legal bases may apply depending on the context. These include legitimate interests, contractual necessity, or legal obligations. For many workplace and commercial uses, consent remains common because it provides clear evidence that you agreed.

It is also worth noting that copyright law operates separately from data protection. The photographer typically owns the copyright to an image, which can affect how it may be used and distributed regardless of consent or personal data considerations.

What counts as valid consent

Consent under UK data protection law has to meet specific standards. A vague agreement or a clause buried in a contract will not usually be enough.

For consent to be valid, it must be:

• Freely given: you should not feel pressured or obligated to agree. Making consent a condition of employment or receiving a service will usually invalidate it.
• Specific: you need to know exactly where and how the photo will be used. A general statement about marketing purposes is not enough.
• Informed: the organisation must explain clearly what they plan to do with the image before you agree.
• Unambiguous: there should be a clear action showing you agree, such as ticking a box or signing a form. Silence or pre-ticked boxes do not count.

You also have the right to withdraw consent at any time. If you change your mind, the organisation should remove your photo without penalising you or making the process difficult. They may need reasonable time to action this, but they cannot refuse or charge you for it.

Separate consent is needed for different purposes. Agreeing to have your photo in an internal staff directory does not mean you have agreed to appear on the company website or in promotional materials. Each distinct use requires its own permission.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

When organisations might use your photo without consent

Consent is a common basis for publishing photos on websites, but it is not the only one. In some situations, an organisation may rely on a different lawful basis under data protection law.

Legitimate interests is one alternative. An organisation might claim they have a genuine business reason for using the photo that does not override your rights. The critical factor is the balancing of the organisation's interests against your own rights and freedoms. The organisation would need to carry out this balancing test and be able to demonstrate their reasoning if challenged.

Public interest, journalistic, artistic, literary, or academic purposes may also apply in limited circumstances. News reporting, for example, can sometimes justify using photographs without consent where there is a genuine public interest in the story. Artistic projects or academic research may benefit from similar exemptions. These provisions do not give organisations a blanket right to use any photo they like, but they do create some exceptions.

Photos taken in genuinely public settings can be more complicated. Street photography or images of crowds at public events may not always require individual consent, depending on the context and how the photo is used. However, if an organisation then uses such an image to promote a product or service, your rights may still apply.

If an organisation claims they do not need your consent, they should be able to explain their lawful basis clearly. You can ask them to set this out in writing.

What to do if your photo is used without permission

If you find your photograph on a website and you did not agree to it being there, you have options.

Start by contacting the organisation directly. Put your request in writing, whether by email or letter, and keep a copy. Be specific about which image you mean, where it appears, and what you want them to do. State clearly that you are making a request under UK data protection law. Many cases are resolved at this stage without further action.

Under UK GDPR, you may have the right to request erasure of your personal data in certain circumstances, though this is not an absolute right. It may depend on conditions such as whether the data is still necessary for the purposes for which it was collected. If you never gave consent, or if you have withdrawn it, the organisation may need to remove the image depending on the circumstances. They should respond to your request within one month.

If the organisation refuses to remove your photo, or ignores your request, you can complain to the Information Commissioner's Office. The ICO is the UK's data protection regulator and can investigate complaints about how organisations handle personal data. You can submit a complaint through their website at ico.org.uk.

Before the ICO will usually get involved, they expect you to have raised the matter with the organisation first and given them a chance to respond. Keep records of your correspondence in case you need to show what steps you took.

In more serious cases, or where you have suffered distress or financial loss, you may be able to claim compensation. This might require legal advice, and you should consider whether the matter justifies that step.

The ICO website has detailed guidance on your rights and how to make a complaint. GOV.UK also provides information on data protection rights for individuals.

The Next Step