Online Image Sharing and the Protection of Personal Data

Understanding the Risks of Posting Personal Images and Videos

Private images or videos identifying a natural person should not be posted via social media or any other online platform without the prior consent of the data subject.

Publishing personal data on such platforms exposes individuals to risks of their fundamental data protection rights and may cause real damage and harm to affected data subjects, including loss of control over their personal data. The disclosure of such content may constitute an infringement of General Data Protection Regulation (GDPR), unless the processing is carried out by a person in the course of a purely personal activity or household activity, commonly referred to as the household exemption.

Accordingly, pictures or videos shared strictly on a one to one basis through private messaging services, and which are not further disseminated or made publicly available, may fall outside the scope of GDPR. However, this position changes where the information is shared beyond a strictly personal context. Where content is posted on an open social media profile, shared within large groups, made accessible to an unrestricted audience or used for purposes that extend beyond personal or household activity, the GDPR is likely to apply.

When the GDPR applies and the Household Exemption

Before posting any material online, including photographs or videos that contain personal data, careful consideration must be given to the purpose of the processing and the applicable legal basis. Where a person uploads an image or video identifying a natural person on a publicly accessible social media profile, that processing must satisfy one of the lawful bases set out under Article 6(1) GDPR. In many social media contexts, the most appropriate lawful basis will be the consent of the individual appearing in the image. Such consent must be freely given, specific, informed and unambiguous.

Special Considerations for Children & Sensitive Content

Particular caution is required when posting images of children, as children benefit from specific protections under the GDPR and related data protection principles. On Data Protection Day 2026, the Office launched a public awareness campaign focused on children’s online safety and data protection to highlight the risks associated with sharing images or personal data of children on digital platforms and to encourage safer online practices. This campaign is designed to equip children with knowledge about what personal data is, who can see that data online and how to protect it.

To access the campaign resources and guidance, follow the link here.

Equal care must be exercised where content is captured in private settings or where images reveal special categories of personal data, such as information relating to health, religious beliefs, political opinions or other sensitive matters. The publication of such material significantly increases the potential risk of harm and may trigger stricter legal requirements under the GDPR.

Rights and Remedies under the GDPR

In the absence of a valid lawful basis, the upload of such content may constitute an infringement of data protection rules. The affected individual has the right to request the deletion of the content, initially from the person or organisation who uploaded it, and, where necessary, from the relevant social media platform. The right to erasure, commonly known as the ‘right to be forgotten’, applies where the processing is unlawful or where consent has been withdrawn and no other lawful basis exists.

In addition, data subjects may exercise further rights under the GDPR, including the right of access to their personal data, the right to rectification of inaccurate information, the right to restrict or object to processing and the right to seek compensation for material or non-material damage suffered as a result of an infringement. They may also lodge a complaint with the competent Supervisory Authority and seek judicial redress before the courts.