• Photographs of students are personal data, and a school is responsible for how they are captured, stored and shared.
• A clear consent position, gathered once a year, covers almost every routine use.
• A reputable photography partner should be able to show you where images are held and for how long.
• Parents have the right to ask for a photograph to be removed, and that request should be simple to make.

Every autumn, schools across the country photograph tens of thousands of students. The images are used in yearbooks, on identity cards, in local press and on the walls of the school for decades afterwards. Each of those uses sits within data protection law, and the responsibility for getting it right rests with the school.

This paper sets out, without jargon, what the law expects and how a school can meet it with very little extra work.

The starting point is consent. A single, well written consent form at the beginning of the school year, covering the ordinary uses of a photograph, is enough for the great majority of cases. Problems arise when consent is vague, out of date, or never gathered at all.

The second point is retention. Images should not be kept forever by default. A school should know how long its photography partner holds files, and be able to ask for them to be deleted.