Good practiceDepartment for Education (DfE) data-protection guidance

Pupil photo and video policy

A statement explaining how the school uses photos and videos of pupils: the lawful basis it relies on, how to opt out when a photo is taken or later, and who can access images. Publishing it is encouraged.

Check this on my website

Who it applies to

Published on
The school's own website
School type
Academies and maintained schools
School stage
All stages, from early years to sixth form
Does not apply to
No school types are excluded

When is it due?

Renewal
No fixed date

The official sources set no renewal date. Keep it accurate whenever it changes.

What's needed

Publish a statement or policy on the use of pupil photographs and video, explaining how consent is sought and withdrawn, on the privacy or policies page.

What it must contain

9 parts
  • Explains how to opt out of pupil images being usedMust
  • States the lawful basis the school uses for pupil images, clearly and transparentlyMust
  • Says parents and carers are reminded before key eventsShould
  • Says objections to pupil images are answered fairly and transparentlyShould
  • Explains how to opt out of appearing in a photo when it is takenMust
  • Explains how to change your mind later about appearing in photosMust
  • Explains how images will be usedGood practice
  • Explains who can access the imagesGood practice
  • Explains how consent for images is managedGood practice

What the official sources say

Set out in 2 official sources:

Data protection in schools: taking and using photos and videos, and using CCTV

Updated 23 March 2026

  • The school updates its photo and video policy and its privacy notice to explain: – how images will be used – who can access them – how consent is managed

    Good practice§ Example: using new technology

  • If you rely on legitimate interests as your lawful basis, you must give pupils, parents or carers a clear way to opt out of appearing in photos or videos. Explain how they can: – opt out when the photo is taken – change their mind later

    Must§ Using legitimate interests as a lawful basis

Show 3 more from this source
  • You should explain these rules in your school’s photo and video policy, and remind parents and carers before key events.

    Should§ Taking personal photos and videos at school events

  • You should explain this clearly in your school’s privacy notice and respond to objections in a fair and transparent way.

    Should§ Using public task as a lawful basis

  • Your privacy notices must clearly explain how to opt out and what lawful basis you are using, so it is clear and transparent.

    Must§ Using legitimate interests as a lawful basis

ICO: taking photos at school events (for the public: schools)

Version 2026-03-23

  • Regardless of the lawful basis relied upon, we recommend that the school allows pupils the opportunity to opt-out from their image being used.

    Good practice§ Photographs taken by the school

Questions schools ask

Does every school have to publish the pupil photo and video policy?

The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.

When does the pupil photo and video policy need to be published?

Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.

What must the pupil photo and video policy include?

Explains how to opt out of pupil images being used; States the lawful basis the school uses for pupil images, clearly and transparently; Says parents and carers are reminded before key events; Says objections to pupil images are answered fairly and transparently; Explains how to opt out of appearing in a photo when it is taken; Explains how to change your mind later about appearing in photos; and 3 more parts listed above.

Where does the requirement for the pupil photo and video policy come from?

It is set out in Data protection in schools: taking and using photos and videos, and using CCTV and ICO: taking photos at school events (for the public: schools).

Changes to the official sources

Dated change notes published by the Department for Education on the sources above.

  1. 23 March 2026 · Data protection in schools: taking and using photos and videos, and using CCTV

    New section added.

We last checked these sources on 21 September 2026.

Is this on your school's website?

We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.

Check this one requirement free, or scan your whole site against every requirement.

Any format works: .co.uk, .sch.uk, .org.uk or .com.

We email the result here. Privacy notice

Free: check up to 3 requirements a year, results by email. Paid: every requirement checked, re-checked after you fix it, and monitored all year.

Or scan your whole site free →
Official wording that does not apply to schools (3)
Unlike for photos, consent is not appropriate as a lawful basis for CCTV
Data protection in schools: taking and using photos and videos, and using CCTV§ Considering which lawful basis to use (CCTV)Version 2026-03-23gov.uk ↗
Data protection law doesn’t apply to the use of personal data for ‘purely personal or household activity’. This means that the law doesn’t prevent you from taking photos or videos for personal use (see below for further guidance on personal use).
ICO: taking photos at school events (for the public: schools)§ Does the data protection law stop me taking photographs of my children at school?Version 2026-03-23ico.org.uk ↗
However, if you post photos or videos to a public account, viewable by an indefinite number of people, this is likely to go beyond personal use. In this instance, you will need to be aware of your obligations under data protection law.
ICO: taking photos at school events (for the public: schools)§ Personal use and social mediaVersion 2026-03-23ico.org.uk ↗

Official sources last checked 21 September 2026 · register version 1.0.4