When a business must blur people in photographs

The general question — how data protection law treats photographs — is covered in our plain-language guide for small businesses. This page answers the narrower operational one: in a given situation, must you obscure the people in a picture, and what does obscuring actually achieve in law?

The only test that matters: is the person identifiable?

A photograph is personal data when a living individual can be identified from it, whether directly or indirectly, taking account of all the means reasonably likely to be used to identify them. Everything else follows from that sentence.

The half that gets missed is indirectly. Identification does not require a face. A photograph can identify someone through a name badge, a uniform with an employer's logo, a vehicle registration, a distinctive tattoo or mobility aid, a house number, a desk nameplate, or the caption underneath. It can also identify through combination: one person, in a particular role, at a particular small business, on a particular date.

So the practical rule for redaction is not "cover the faces". It is: cover everything that would let a reasonably determined person work out who this is. Very often that means the badge and the plate matter more than the face.

Anonymisation, pseudonymisation, and why the mode matters

If an image is genuinely anonymised — the individual can no longer be identified by anyone, by any means reasonably likely to be used — then it is no longer personal data, and the regulation stops applying to it. That is a clean and valuable outcome.

Pseudonymisation is different. It reduces the linkability of data while leaving it capable of being attributed to a person with additional information. Pseudonymised data is still personal data and stays fully within scope.

This distinction lands directly on the choice of obscuring mode. A blur or a pixelation attenuates the information: the pixels still encode averages of what was there, and researchers have demonstrated recovery of pixelated and blurred content where the set of candidates is constrained. That is much closer to pseudonymisation than to anonymisation. A solid fill replaces the pixels with a constant, and the original values are not present in the file in any form.

If your reason for redacting is a legal one, use a solid bar. It is the only one of the three that makes the "no longer identifiable" argument straightforwardly. The face tool and text tool both default to it, and the reasoning is set out in blur, pixelate, or black box.

Situations, answered

Photographs at a public event you organised

Legitimate interests is usually workable, provided attendees were told photography was happening — signage at the entrance, a line on the ticket, an announcement. Expectation is doing the work here. Someone who walked past a sign saying photographs would be taken for publicity has little basis to be surprised. Redact anyone who asked not to be included, and anyone whose inclusion is incidental and adds nothing.

Staff photographs on your website

Do not rely on consent from your own employees: the imbalance of power makes it difficult to argue it was freely given, and it collapses the moment someone leaves on bad terms and withdraws it. Legitimate interests, with a short balancing note on file, is the more defensible route — and take the photo down promptly when someone leaves and asks.

Customers visible in a shop or venue interior

This is the most common problem and the easiest to solve: photograph the space when it is empty, or redact the customers. A customer in your café did not enter into a publicity arrangement with you. If the photograph needs people in it to work, use staff who have agreed, or take it at an advertised event.

A tradesperson photographing completed work

The client's home is the sensitive thing, more than any person in the frame. Cover the house number, the street sign, distinguishing exterior features, any post or paperwork, and vehicles on the drive. Get the client's agreement in writing before publishing photographs of the interior of their home — it costs one line in the quote and prevents the entire argument.

Schools, nurseries and clubs

Consent from whoever holds parental responsibility, recorded, specific about where images will appear, and honoured promptly on withdrawal. Be aware that a school uniform plus a location narrows a child down very fast, so redacting a face while leaving a crested jumper and a school gate in frame achieves considerably less than it appears to. There is more at photos of children online.

Marketing photography with a model release

A model release is a contract about image rights. It is useful, and it is not the same thing as a lawful basis under data protection law — you still need one, and you still owe the individual the rights that attach. Treat the release as one document among several rather than as the whole answer.

CCTV stills

A separate regime with its own expectations about signage, retention, and access. Publishing a CCTV still of a suspected shoplifter is a well-known way for a small business to end up in trouble, because you are publishing an accusation about an identifiable person on the basis of your own untested judgement. Take advice before doing it.

Someone asks to be removed

People have a right to erasure and a right to object to processing based on legitimate interests. In practice, for a photograph, the answer is almost always to take it down — the image is rarely worth the argument.

Deal with the copies. A single photograph can exist on your website, on three social platforms, in a scheduling tool, in a printed leaflet, in a shared drive, and in an agency's asset library. Deleting the post is not deleting the data. Keep a note of where images are published so you can actually answer this when it happens.

Where the image remains useful without the person — a room shot with one customer in it — redacting them irreversibly and republishing is a legitimate response, provided they are genuinely no longer identifiable from the rest of the frame.

A short checklist before publishing

1. Is anyone in this image identifiable — from a face, a badge, a plate, a uniform, a location, or the caption?
2. If so, what is my lawful basis, and have I written down why?
3. Does the image reveal anything in the special category list — health, religion, trade union membership, ethnicity?
4. Have I redacted irreversibly, with a solid bar rather than a blur?
5. Have I checked the whole frame — background, reflections, screens, paperwork — and not just the obvious subject?
6. Do I know everywhere this image will be published, so I can remove it if asked?

Most of this is one careful look at each photograph before it goes out, which is less work than any of the alternatives.