Photos of children at nursery: consent and UK GDPR

A photo of a recognisable child is their personal data, so UK GDPR applies. It does not follow that you need consent for every picture. The ICO’s advice to schools is that public task (for public bodies) or legitimate interests (for most private settings) can cover photos a setting takes for its own purposes, provided parents are told what you do and are offered an opt-out. Consent is the right basis for optional uses, such as your website or social media, and only where you will genuinely stop if a parent says no.

The EYFS adds one requirement of its own: your safeguarding policy must say how mobile phones, cameras and other devices that can take and share images are used in your setting (paragraph 3.6 of the group and school-based framework, 3.7 of the childminder framework).

Do you need parental consent to photograph children?

Not for everything. UK GDPR offers six lawful bases, and the ICO is clear that consent is only one of them. Its guidance on schools names two others that fit photographs:

• Public task. For a public body using its legal duties or powers. A maintained nursery school or a school nursery class will usually be here.
• Legitimate interests. Wider, and available to private, voluntary and independent nurseries and childminders. It covers uses people would reasonably expect or that you can justify, and the ICO says it can include promotion.

The ICO draws a distinction worth pinning up in the office. Offering an opt-out is not the same as relying on consent. You can use legitimate interests and still let parents opt out, and the ICO generally expects you to offer that opt-out for promotional use.

Consent carries a specific promise: the parent has real control and can change their mind. The ICO says that if you would carry on processing on another basis after someone refused or withdrew, asking for consent was misleading and unfair. So do not ask for “consent” to learning-record photos if you would take them anyway.

Legitimate interests for children comes with a harder balancing test. The ICO’s guidance on children says you must take extra care, and where your interests and the child’s are seriously mismatched, you should assume the child’s win. A photo for a learning journal passes easily. A photo of a child in a nappy on a public page does not.

A note on timing: the ICO has flagged that some of its lawful basis guidance is under review after the Data (Use and Access) Act 2025. Check the ICO pages when you next review your policy.

A sensible split for most settings

This is a common and defensible approach, not a rule. Take legal advice if you are unsure.

Use	Likely basis	What parents get
Learning records and observations	Legitimate interests (private) or public task (maintained)	Clear information, with the reason explained
Photos shared with that child’s own family	Legitimate interests or public task	Information, and an opt-out
Wall displays inside the setting	Legitimate interests or public task	Information, and an opt-out
Website, prospectus, social media, press	Consent	A separate yes or no for each
Photos passed to a third party (a local paper, a council newsletter)	Consent	A separate yes or no, asked each time if possible

What should a photo consent form say?

Write it in your own words, keep it to one side of paper, and build it in this order:

1. Who is asking. Your setting’s name and who to contact about photos.
2. What you do without asking. Say plainly which photos you take for your own purposes, why, and the basis you rely on. Explain the opt-out.
3. The optional uses, one per line. A separate tick box for each: website, social media, printed marketing, local press. Leave them unticked by default. Never bundle them into a single “I agree”.
4. Names with photos. A separate question if you ever put a first name alongside an image.
5. Not a condition of the place. Say that saying no makes no difference to their child’s care.
6. How long. Say how long you keep photos and what happens when the child leaves.
7. How to change their mind. One sentence on how to withdraw, and that it takes effect straight away.
8. Who signs. A parent with parental responsibility, with their name and the date.

Review the form with each family at least once a year, and whenever circumstances change. A child who becomes looked after, or a family fleeing domestic abuse, may need every photo of them removed from anything public at once.

What happens when a parent withdraws consent?

The ICO says withdrawing consent must be as easy as giving it. When a parent withdraws:

• stop all new use from that moment
• remove the child’s photos from places you control, such as your website, social media and wall displays
• tell every member of staff the same day, and update whatever list or system shows who can be photographed
• record the date and what you removed

In a related example about a school prospectus, the ICO said an objection did not oblige the school to recall paper copies already handed out. Printed material that has already gone out is unlikely to be recoverable. Anything online is within your control, so take it down.

Can parents take photos at nativity plays and sports days?

Data protection law does not stop parents taking photos or videos for their own use. The ICO also says private posts shared with friends and family are generally outside the law, but posts to a public account seen by anyone are likely to go beyond personal use.

Settings can still set their own rules, and the ICO confirms this. Most allow filming and ask three things: film only your own child where you can, keep other children off public social media, and respect any family who has asked for their child not to be filmed. If a child must not appear anywhere, for example for safeguarding reasons, plan the event around them rather than relying on parents to remember.

What about staff using their own phones and cameras?

The EYFS does not ban personal phones. It requires your safeguarding policy to explain how phones, cameras and other image-taking devices are used. What you decide is up to you, and most settings decide the same thing:

• Setting devices only. Photos of children are taken on devices owned by the setting, never on personal phones. Once a photo is on a personal phone, you cannot check it has gone, and a lost phone is a data breach.
• Personal phones stored away from the children, in a locker or office, with an agreed place to take urgent calls.
• Named exceptions for outings, where staff may need a phone for emergencies but not for photos.
• Visitors, contractors and students covered by the same rule.

The UKCIS online safety guidance for early years practitioners, referenced in the EYFS, tells staff not to use their own devices to share content on the setting’s behalf. It also warns that young children sometimes photograph intimate parts of their own bodies. Staff who come across an image like that must not save, forward or print it, and should go straight to the designated safeguarding lead.

Storing and deleting photos

The EYFS requires confidential records about children to be held securely and seen only by people with a right or professional need to see them (paragraph 3.96 of the group framework, 3.95 for childminders). The ICO’s early years advice adds that you should keep information only as long as you need it.

In practice:

• store photos in one place, not across memory cards, tablets and personal cloud accounts
• lock devices with a passcode, and switch off automatic backup to personal accounts
• delete photos that were not used, rather than keeping every burst of twelve
• decide a retention period for photos after a child leaves, write it in your policy, and follow it
• give families their child’s photos when they leave, so you do not need to keep them “in case”

Photos that include other children

Every recognisable child in a photo is personal data about that child. A group shot sent to one family is also a disclosure about the others.

• Before sharing a group photo, check the status of every child in it, not only the one you are sharing it for.
• If one child cannot be shared, crop them out or choose a different photo. Be wary of relying on a blurred face: other parents often recognise a child by their clothes, hair or the way they stand.
• Do not put other children’s names in captions.
• When a parent asks for a copy of their child’s information, apply the ICO’s early years advice on footage that shows other people: disclose it only with their consent or where it is reasonable to do so without it, and otherwise remove or disguise them.

Photo policy checklist

• Your lawful basis for each use of photos is written down
• Parents are told, at registration, what photos you take and why
• Optional uses have separate, unticked consent boxes
• Your safeguarding policy covers phones, cameras and other devices, as the EYFS requires
• Photos are taken only on setting devices
• Every member of staff can quickly check who must not be photographed or shared
• Withdrawal is easy, acted on the same day, and recorded
• Group photos are checked child by child before they are shared
• Devices are locked, and photos stored in one secure place
• A retention period is set and followed
• Rules for parents at events are written down and repeated before each event
• Staff know what to do if they come across an indecent image of a child