Compliance and Europe
GDPR and DAM: personal data, model releases and retention
Quick answer
Under the GDPR, Regulation (EU) 2016/679, any photo or video showing an identifiable person is personal data, so a DAM must record a lawful basis and release for each such asset, enforce expiry and erasure, and treat facial recognition as biometric processing under Article 9. As of October 2026 the proposed Digital Omnibus changes to the GDPR remain unadopted.
Key takeaways
- Images and videos of identifiable people are personal data under GDPR Article 4(1), so every such asset needs a documented lawful basis and, usually, a linked release.
- Face recognition used to identify people in a DAM processes biometric data under Article 9 and generally requires explicit consent and a data protection impact assessment.
- Consent from employees is rarely freely given according to EDPB Guidelines 05/2020, so staff imagery often needs a contract or legitimate interest basis plus an opt-out route.
- GDPR fines reach EUR 20 million or 4% of global annual turnover, whichever is higher, for breaches of the core principles, including storage limitation.
- The Digital Omnibus proposal of 19 November 2025 would amend the GDPR, but as of September 2026 the Council had no negotiating mandate and the current text still applies.
A DAM that stores images or videos of identifiable people is a GDPR processing system, and it needs the same controls as a CRM: a lawful basis per asset, linked releases, expiry, erasure and access logging. Most DAM compliance gaps sit in three places: releases kept outside the DAM, face recognition switched on without assessment, and assets that never expire. Fixing those three covers the majority of practical risk for European marketing teams.
Which assets in a DAM contain personal data
Personal data in a DAM extends well beyond portraits. The General Data Protection Regulation, Regulation (EU) 2016/679, defines personal data in Article 4(1) as any information relating to an identified or identifiable person, which includes faces, voices, names in captions and GPS coordinates in embedded metadata.
| Data in the DAM | GDPR angle | Required control |
|---|---|---|
| Photos and videos of identifiable people | Personal data, needs a lawful basis (Article 6) | Release linked to the asset, with usage scope and expiry |
| Face recognition and person clustering | Biometric data for identification (Article 9) | Off by default, explicit consent, DPIA |
| Embedded metadata (EXIF GPS, names, IPTC credits) | Personal data | Strip or filter on export |
| User activity and audit logs | Employee personal data | Defined retention period |
| Signed release forms and ID copies | Personal data, often sensitive in context | Restricted access, separate retention |
The so-what for DAM owners: personal data should be a searchable metadata state, so the team can find every asset showing a given person within minutes when a request arrives.
Model releases and lawful basis for images of people
A model release combines two legal layers that teams often confuse: national image rights and the GDPR lawful basis. Image rights come from national law, such as portrait rights under Articles 19 to 21 of the Dutch Auteurswet, Section 22 of the German Kunsturhebergesetz (KUG) and the French right to one's image based on Article 9 of the Civil Code. The GDPR basis is separate: consent under Article 6(1)(a), contract under Article 6(1)(b) for paid models, or legitimate interest under Article 6(1)(f). Consent can be withdrawn at any time under Article 7(3), so contract is usually the more stable basis for commissioned shoots. Store the release as a linked record in the DAM with scope (channels, territories, duration) and expiry, following the approach in rights and licence management in DAM.
Employees, events and consent
Employee imagery needs the most care. The European Data Protection Board states in Guidelines 05/2020 that consent in an employment relationship is rarely freely given because of the power imbalance. Many organisations therefore rely on legitimate interest for internal communications imagery, with a clear objection route, and reserve consent for external campaigns. Event photography needs visible notices at the venue and a process to remove individuals who object. When an employee leaves, a workflow should route their imagery to review automatically.
Facial recognition, AI tagging and biometric data
Face recognition that identifies or groups specific people processes biometric data under GDPR Article 9, which is prohibited unless an exception such as explicit consent applies. Generic object or scene tagging carries far lower risk. Before enabling face features in any DAM, including platforms such as FotoWare or Bynder, run a data protection impact assessment, limit the feature to consented collections and confirm where the AI processing runs, as covered in AI auto-tagging governance. Self-hosted options such as ResourceSpace keep processing in-house but leave the assessment duty unchanged.
Retention, erasure and the 2026 Digital Omnibus
Storage limitation under Article 5(1)(e) means every asset with personal data needs an end date. Practical retention rules tie expiry to the release term (typically 2 to 5 years for campaign imagery, a practitioner range), archive with restricted access afterwards, and delete on erasure requests under Article 17 within the one-month response window of Article 12(3). Breaches of the core principles can be fined up to EUR 20 million or 4% of global annual turnover under Article 83(5). The Commission's Digital Omnibus proposal of 19 November 2025 would amend the GDPR, including the personal data definition, but in September 2026 it was still in first reading without a Council mandate, so plan against the current text. Embed these rules in your DAM governance model.
What to do next
- Add a "contains identifiable people" metadata field and backfill it across the existing library.
- Move releases into the DAM as linked records with scope and expiry, and block downloads of expired assets.
- Audit face recognition settings and run a DPIA before any biometric feature stays switched on.
- Configure export profiles that strip GPS and personal metadata from public renditions.
- Review your DAM vendor's data processing agreement, sub-processor list and EU data residency setup.
Frequently asked questions
Is a photo of a person personal data under the GDPR?
Yes, when the person is identifiable, directly or with other information such as a caption or file name. Crowd shots where nobody can reasonably be identified usually fall outside the definition. Treat any portrait, testimonial, event or employee photo as personal data.
Can a person withdraw consent for an image already used in marketing?
Yes. Under GDPR Article 7(3) consent can be withdrawn at any time, and withdrawal stops future processing without making past use unlawful. Printed materials already distributed can usually stay in circulation, but the asset must leave the DAM's active pool and digital channels within a defined period.
Is a DAM vendor a data controller or processor?
For the assets you upload, the DAM vendor is normally a processor acting on your instructions. GDPR Article 28 requires a data processing agreement covering security, sub-processors, international transfers and deletion at contract end.