DAM fundamentals
Rights and licence management in DAM
Quick answer
Rights management in DAM means recording, for every asset, who owns it, what the licence allows (channels, territories, duration) and which model or property releases apply, then enforcing those terms automatically through expiry dates, usage restrictions, alerts and audit trails. It stops expired or unlicensed assets from reaching websites, retailer portals and campaigns.
Key takeaways
- Model licences as reusable records linked to many assets, so one contract change updates hundreds of files at once.
- Capture five rights field groups at ingest: ownership, licence terms, scope, releases and AI or data mining permissions.
- Expiry in the DAM only protects channels that pull assets live from the DAM or its CDN; downloaded copies need a separate takedown process.
- Article 4(3) of Directive (EU) 2019/790 lets rightsholders reserve text and data mining rights in machine-readable form, which a DAM can express through IPTC and XMP metadata.
Rights management is the DAM capability with the clearest financial downside when it fails. A DAM should record ownership, licence terms, scope and releases for every asset, then enforce them automatically through expiry, permissions and alerts. Unlicensed-use claims for a single stock or agency image commonly run from several hundred to several thousand euros (practitioner estimate), and a withdrawn model release can force a campaign offline.
What rights metadata a DAM must capture
Rights data falls into five groups, and a gap in any one of them creates exposure. Capture them at ingest, when the contract and the photographer are still easy to reach.
| Field group | Example fields | Standard mapping |
|---|---|---|
| Ownership | Copyright owner, creator, credit line | IPTC Copyright Notice, Creator, Credit Line |
| Licence terms | Licence type (royalty-free, rights-managed, buyout), contract ID, cost | Custom fields linked to a licence record |
| Scope | Channels, territories, start and end date, print run | Custom fields or PLUS licence properties |
| Releases | Model release status and ID, property release status | IPTC Model Release Status, Property Release Status |
| AI and data mining | TDM permission, AI training restrictions, digital source type | IPTC Data Mining property (since version 2023.1) |
The so what: model licences as separate records linked to many assets. When a photographer's contract for a 400-image shoot is extended by a year, one edit updates all 400 files. Per-asset text fields cannot do this and drift out of date. See the metadata and taxonomy guide for the layered model.
Model releases, GDPR and personal data
Photos and videos of identifiable people are personal data under the GDPR (Regulation (EU) 2016/679). The release records the legal basis, which is either contract or consent. Where the basis is consent, the person can withdraw it at any time under Article 7(3), so the DAM must find every image of that person within hours.
Link each release to the assets it covers and store it as a retrievable document. Face recognition can help locate assets, but it involves biometric data and needs its own legal review. The GDPR and DAM guide covers retention and data subject requests.
Enforcing licences: a five-step process
Enforcement works only when it is automatic and reaches the channels where assets are used. A practical process looks like this:
- Capture at ingest. Make licence type, owner and end date mandatory for all bought-in assets.
- Alert before expiry. Notify the asset owner 30 to 60 days ahead so the licence can be renewed or the asset replaced.
- Restrict at expiry. Block downloads and new shares automatically and flag the asset in search results.
- Withdraw from channels. Assets embedded via DAM or image CDN URLs can be swapped or removed centrally; downloaded copies need a takedown checklist per channel.
- Audit. Log every download and share so you can prove where an asset went.
AI training, text and data mining and Directive 2019/790
AI has added a new rights dimension. Article 4(3) of Directive (EU) 2019/790 allows rightsholders to reserve text and data mining of their content in an appropriate manner, such as machine-readable means for content published online. Article 53(1)(c) of the EU AI Act (Regulation (EU) 2024/1689) requires providers of general-purpose AI models to respect such reservations.
For brands this works in two directions. Outbound, you can express reservations on your own published assets through the IPTC Data Mining property or the W3C TDM Reservation Protocol. Inbound, many stock and agency licences now restrict use of their images in generative AI workflows, so the DAM must carry that restriction and block those assets from AI tools.
Choosing a DAM for rights-heavy content
Rights requirements separate DAM products more clearly than search or storage. Test four criteria in demos: licence records linked to many assets, automatic enforcement at expiry, rights reporting by channel and territory, and rights-aware connectors that refuse to publish restricted assets. Ask vendors such as Orange Logic, Keepeek and FotoWare to demonstrate these with a scenario from your own contracts.
What to do next
- Audit 100 random published assets and record how many have a traceable licence and release.
- Define the five rights field groups and decide which are mandatory for bought-in assets.
- Model licences as linked records and migrate existing contracts into them.
- Write a takedown checklist per channel for assets that leave the DAM.
- Add AI and data mining restrictions to your AI governance policy and DAM metadata.
Frequently asked questions
What is the difference between DRM and rights management in a DAM?
DRM (digital rights management) in the narrow sense means technical copy protection, such as encryption on streamed video. Rights management in a DAM means tracking licence terms, releases and expiry dates as metadata and enforcing them through permissions and workflows. Most marketing DAMs focus on the second.
How does a DAM handle expired image licences?
A DAM stores the licence end date as metadata, sends alerts to asset owners typically 30 to 60 days in advance and blocks download or delivery after expiry. Assets embedded via DAM or CDN links can be withdrawn centrally. Copies already downloaded to other systems need a takedown checklist.
Do model releases fall under GDPR?
Yes. A photo or video of an identifiable person contains personal data under the GDPR (Regulation (EU) 2016/679). The release documents the legal basis for use, and if that basis is consent, the person can withdraw it under Article 7(3), so the DAM must be able to find and withdraw every affected asset quickly.