Managing consent and GDPR in media libraries

Managing consent and GDPR compliance in media libraries is one of the biggest challenges facing Communications and DAM Managers, and it’s made trickier by frequent changes and amendments to existing data protection regulation. Introduce AI to the mix and things only get harder.

In this blog, we’re going to cover what you should already be doing and how some recent changes to data regulations should impact how you deal with subject access requests.

READ MORE: Charity GDPR compliance: What you need to know

When a photo counts as personal data

An image is considered to be ‘personal data’ under GDPR when they contain an identifiable individual. This covers the majority of photographs of people in a professional or commercial context, and organisations processing these types of images must:

• identify a lawful basis
• meet transparency obligations
• honour the rights of data subjects

An image could become personal data either directly or indirectly. Direct identification occurs via visible faces, name tags or other obvious identifiers, while indirect identification occurs via things like distinctive clothing, unique tattoos or recognisable backgrounds. Note that anonymous crowd shots where no individual faces can be distinguishable typically fall outside of the scope of GDPR.

In some cases, images can also become biometric special category data under Article 9 of GDPR. This applies if and when facial recognition software analyses images for the purpose of access control, when images are processed for automated identification systems, or when biometric templates are created.

Consent is not your only lawful basis, and often not the best one

When managing GDPR for media libraries, consent can often seem like the safest option. However, because that consent can be withdrawn at any time, relying entirely on this lawful basis can create uncertainty for a charity media library supporting fundraising, campaigns and annual reports.

With this in mind, other lawful bases might be more appropriate. For example, legitimate interest might cover some routine uses where people would reasonably expect their image to be used and the impact on their privacy is limited. The important thing is to choose and document the right basis before collecting or using the image, rather than switching later when consent becomes inconvenient.

Note that this article offers practical guidance but not legal advice, and your organisation should assess its own purposes, risks and obligations before deciding on a legal basis under GDPR.

Matching the right basis to each type of asset

The ideal lawful basis for a photo depends on the context, the intended use and the potential impact on the individual. Here are some example situations you might come across:

• Staff photos: Legitimate interests may suit routine internal communications or team pages where use is expected and proportionate. For promotional campaigns, consent may be more appropriate.
• Event attendees: Legitimate interests may cover some general event photography if attendees are informed, expectations are reasonable and suitable safeguards are in place. However, photos of individuals or promotional case studies may call for specific consent.
• Beneficiaries: Consent is usually the best legal basis for identifiable stories used in fundraising, particularly when people in those images might be vulnerable or face risks from being identified.
• Children: Images of minors require extra care from the organisation. You should consider the child’s wishes and understanding of the potential implications, appropriate parental involvement and consent, but note that consent doesn’t eliminate your safeguarding obligations.
• Historic collections: Archiving in the public interest may be relevant in qualifying circumstances, with appropriate safeguards, but it’s not an automatic basis for every image a charity wants to retain.

Recording consent when images are captured

Consent management in DAM starts at the point of capture, so provide photographers and field teams with a simple process to record consent when images are created. This should include digital forms or consent records that capture:

• the date the image was created
• person’s identity or reference ID
• agreed uses
• any restrictions on usage
• the name of the person recording consent

This process should build in the charity’s safeguarding procedures for images of children or vulnerable people.

Next, link each record to the actual files in your Digital Asset Management system. Metadata fields can be used to store all of this information, while you can group images by photo session, location or assignment so a consent record can be linked to the relevant image batches, while still identifying individuals where permissions differ. This keeps the evidence connected to the assets, reducing the risk of a photograph being reused without its consent conditions.

Checking consent before an asset is reused

Consent management in DAM should make it easy for Stories Managers to check whether an image is safe to reuse before it goes into a fundraising campaign, social post or report. Each asset should carry its consent status, expiry or review date, as well as any usage restrictions in its metadata. This might include permission for website use but not printed materials, or approval for a specific campaign only.

Make this usage information clearly visible in the resource record, rather than require people to locate separate consent documentation. For example, someone browsing the library for a campaign image should see a clear status such as ‘Approved for use’, ‘Restricted’ or ‘Under review’.

This can be supported by permissions and asset workflows, with downloads and publication-ready file versions restricted when consent has expired. Some DAM systems, including ResourceSpace, will flag assets approaching expiry dates so you can act before the deadline is reached, helping to prevent accidental misuse while giving staff confidence that the images they choose are appropriate for their intended purpose.

Handling a withdrawal of consent appropriately

In the event that someone withdraws consent, your first task is to identify the assets affected and stop any further use that relies on that consent. In the DAM, start with the linked consent record to find the person's known images, before using facial recognition (if possible) to find potential matches across the rest of the media library. However, make sure you interrogate any suggested matches manually, rather than assume they’re images of the same person.

Once you've confirmed the matches, DAM audit trails and download histories can help you to find where assets have been used or shared. You can then notify the relevant internal teams and partners that future use of those assets needs to stop and, where appropriate, that they should be removed.

Note that it might be hard to find assets that have already been downloaded or shared externally, and remember that withdrawal is not retrospective. You don’t generally have to recall printed materials already distributed, but you should stop further use and assess if anything does need to be removed or replaced.

The new duty to handle data protection complaints from June 2026

Following the introduction of the Data (Use and Access) Act 2025 (DUAA), organisations must respond to valid subject access requests that are reasonable and proportionate, not just searches without any practical limit.

A subject access request (SAR) is a request made by an individual, or on behalf of an individual, for information they are entitled to receive under Article 15 of the UK GDPR. This generally includes confirmation of whether the organisation processes their personal information, a copy of that information, and anything else related to the data processed and stored.

The DUAA 2025 amended the UK’s data-protection framework to state that a data controller is only required to provide information it’s able to supply based on a reasonable and proportionate search. However, this doesn’t mean:

• Organisations can choose not to search hard-to-access systems
• Archived information can be ignored
• Emails can be ignored
• Broader requests can be rejected
• The cost of searching or inconvenience involved is an acceptable barrier
• The controller gets to decide what it would prefer the requester to receive

Ultimately, each SAR should be judged in context, with relevant considerations being:

• the wording and scope of the request
• the length of the relationship with the individual
• the volume and location of likely personal information
• the accessibility of archived or legacy systems
• the time, cost and technical effort involved
• the likelihood that a particular system contains relevant information
• the sensitivity and importance of the requested data
• the potential effect on the individual if information is missed
• whether the requester has helped identify dates, people, topics or accounts. 

Bringing consent, search and permissions together in one place

A centralised Digital Asset Management system like ResourceSpace gives your organisation a single source of truth, connecting each image or video to the information needed to manage it responsibly.

ResourceSpace's customisable user controls mean we can provide more granular permissions, strengthening our consent and data protection processes. And most importantly, it's simple for our teams to use!

Consent records linked directly to assets make it easier to check what someone agreed to and whether restrictions apply, while expiry dates help you to identify permissions that need attention before a campaign goes live. In the event that someone withdraws their consent to the use of images they feature in, advanced AI features like facial recognition can help to find all of the assets containing that person, while audit trails will help you to trace where files have been used.

Although no DAM system can make every GDPR decision for you, bringing consent, search and permissions together makes difficult decisions easier to make, allowing your creative teams to spend less time chasing records and more time creating compelling stories.

To find out more about how ResourceSpace can transform your consent management practices, book a discovery call with one of our DAM experts below.