GDPR Compliant Event Photography Software
TIME&SPACE · Event Technology
How to choose GDPR compliant event photography software, what the law requires for facial recognition, and the questions every organiser should ask a vendor.
Event photos are personal data. The moment a camera captures a guest's face, your event is processing information about an identifiable person, and that brings it under the General Data Protection Regulation. When the photos are matched to guests using facial recognition, the stakes rise sharply. Face data is biometric data, and biometric data sits in a special category that the law guards more tightly than almost anything else.
GDPR compliant event photography software is a delivery system that processes guest photos, including any facial recognition data, in line with the legal requirements set out in the General Data Protection Regulation. Choosing the wrong tool does not just risk a poor guest experience. It exposes the organiser, who is the data controller, to regulatory action and fines that reach up to 20 million euros or 4 percent of global annual turnover.
This guide explains what the law actually requires, why facial recognition changes the calculation, and the exact questions to ask before you trust a vendor with your guests' faces.
Why event photos fall under GDPR
GDPR applies whenever you process the personal data of people in the European Union. A photograph that shows a recognisable face is personal data. That has been settled for years.
The regulation defines several roles. The organiser who decides why and how photos are collected is the controller. The software vendor that stores and delivers those photos on the organiser's instructions is the processor. The relationship between the two must be governed by a written contract called a Data Processing Agreement, which Article 28 of the GDPR sets out as a requirement.
If your photography software cannot or will not sign a Data Processing Agreement, it cannot be used lawfully for an EU event. That is the first filter, and it removes a surprising number of consumer-grade gallery tools.
Facial recognition is biometric data, and that changes everything
Most event photo platforms now offer face matching so guests can find their own pictures with a selfie instead of scrolling through thousands of images. This is a genuine improvement in experience. It is also legally significant.
When software converts a face into a mathematical template used to identify a specific person, that template is biometric data under Article 9 of the GDPR. Article 9 covers special category data, which is processing that is prohibited by default. You may only process it if you meet one of a narrow set of conditions, and for event photography the only realistic condition is explicit consent.
Explicit consent is a higher bar than ordinary consent. The guest must be told clearly that their face will be analysed, why, for how long the data is kept, and they must actively agree before any biometric processing happens. A pre-ticked box does not count. Burying the notice in a terms link does not count. The European Data Protection Board guidance on consent is explicit that consent must be a clear affirmative action.
This is the single biggest reason to be careful with vendor selection. A platform that runs facial recognition without collecting proper explicit consent is processing prohibited data, and the organiser carries the liability.
What GDPR compliant event photography software must do
A genuinely compliant tool builds the legal requirements into the product rather than leaving them to the organiser. Look for the following.
It collects explicit consent at the point of face scanning. The guest sees a clear notice and actively agrees before any selfie is analysed. The consent is logged with a timestamp so you can prove it later, because the burden of proof sits with the controller.
It stores data inside the European Union. Transferring personal data outside the EU triggers extra obligations and is a common compliance gap with platforms hosted on default United States infrastructure. EU data residency removes that risk entirely.
It deletes biometric data on a defined schedule. Storage limitation is a core GDPR principle: you keep data only as long as you need it. Selfie and face data should be erased automatically after a short, stated period rather than kept indefinitely.
It honours data subject rights. Guests have the right to access their data and the right to erasure under Article 17. The software should make it straightforward to delete a guest's photos and face data on request.
It signs a Data Processing Agreement and documents its sub-processors. You need to know exactly which third parties touch the data and where they sit.
The questions to ask a vendor before you buy
Use this as a checklist when you evaluate any event photography platform. If a vendor cannot answer these clearly, treat that as a warning sign.
- Will you sign a Data Processing Agreement, and can I see it before I commit?
- Where is guest data physically stored, and is it inside the EU?
- Do you collect explicit consent before any facial recognition runs, and is that consent logged?
- How long do you retain selfie and biometric data, and is deletion automatic?
- How do you handle a guest's request to access or delete their photos?
- Who are your sub-processors, and where are they located?
- What happens to all event data when the event period ends?
These seven questions separate a tool that has taken compliance seriously from one that has bolted facial recognition onto a generic gallery and hoped for the best.
How TIME&SPACE handles it
TIME&SPACE was built for European events, so compliance is part of the architecture rather than an afterthought. Explicit consent is collected at the moment a guest scans to find their photos, and that consent is recorded. All data is stored in the EU. Selfie data is automatically deleted after 30 days, and the short-lived matching records expire within 72 hours. Guests can request deletion of their photos through a self-serve flow that satisfies the Article 17 right to erasure.
Organisers get the experience guests love, where a single selfie surfaces every photo they appear in, without inheriting a compliance problem. If you want the deeper background on consent specifically, read our GDPR consent guide for organisers, and if you are curious about how the matching works under the hood, see how face recognition finds your event photos.
The cost of getting it wrong
Regulators have shown they will act on biometric data misuse. Fines under GDPR scale to the seriousness of the breach, and special category data breaches sit at the serious end. Beyond the financial penalty there is reputational damage: an organiser whose event leaks guest faces or processes them unlawfully will struggle to attract attendees and sponsors next time.
Compliance is not the obstacle it is sometimes made out to be. With the right software it is largely invisible, handled by the platform, and the result is a guest experience that feels both effortless and trustworthy. That trust is worth more than the marginal convenience of a cheaper, non-compliant tool.
Frequently asked questions
Is facial recognition for event photos legal under GDPR? Yes, provided you collect explicit consent from each guest before their face is analysed. Facial recognition produces biometric data, which is special category data under Article 9, so explicit consent is the practical legal basis for an event.
Do I need a Data Processing Agreement with my photo software vendor? Yes. The organiser is the data controller and the software vendor is the processor. GDPR requires a written Data Processing Agreement between them. If a vendor will not sign one, you cannot use it lawfully for an EU event.
How long can event photos and face data be kept? Only as long as necessary for the stated purpose. Photographs are usually delivered for a defined window, while biometric selfie data should be deleted quickly. TIME&SPACE deletes selfie data after 30 days and expires matching records within 72 hours.
What if a guest asks to have their photos removed? Under the Article 17 right to erasure, you must delete their personal data on request. Choose software that offers a self-serve or simple admin route to remove a specific guest's photos and face data.
Does storing photos outside the EU break GDPR? Not automatically, but it adds obligations and risk. Transfers outside the EU require additional safeguards. The simplest path to compliance is to use software that stores all guest data inside the European Union.
Ready to run a compliant event? See TIME&SPACE plans and pricing or learn more about the platform for organisers. Be present. Together.
Founder, TIME&SPACE