In short: Footage of an identifiable person is personal data, so UK GDPR applies. Get a signed release from anyone who is the focus of a shot, use clear notices for crowds and public places, get a parent or carer's written consent for children, and keep records. Consent can be withdrawn, so plan for takedowns before you shoot.
Footage of an identifiable person is personal data, so you need a lawful basis to film and use it, you must tell people what you are doing, and a signed release is the simplest way to cover both. This guide is for agencies and producers who film other people's staff, customers and the public. It is general information, not legal advice. Ask a solicitor or your client's data protection lead for anything specific.
What UK GDPR counts as personal data on film
Both Film London and the universities that publish consent guidance treat a recording of an identifiable person as personal data. Film London says even a simple image of an identifiable person may qualify. Glasgow includes photos and video where a person is the focus of a shot, audio recordings of individuals and their written words. UCL adds that whether personal data is present is not always clear-cut.
Blurring a face does not always settle the question. Film London points out that even if someone's face is obscured, they could still be identifiable in other ways. If you cannot get consent, decide whether the person is identifiable and whether they had a reasonable expectation of privacy, and think about speaking to your errors and omissions insurer.
The ICO lists seven principles for handling it: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability. The last one means the controller must be able to prove it followed the others. Work out who decides why the footage is made and how it is used, because that party carries the duty, whether it is the agency or the client.
Pick a lawful basis
There are six lawful bases under UK GDPR. For filming, two do most of the work.
Consent. The ICO says valid consent must be freely given, specific, informed and unambiguous, and given by a clear opt-in. Silence and pre-ticked boxes do not count. The request should be separate from other terms. It must name the controller, the purposes and what you will do with the footage, and say how to withdraw. You must be able to show that someone agreed, so keep the signed form.
Legitimate interests. The ICO sets a three-part test: a real purpose, processing that is necessary for it, and a balance against the person's rights and interests. You must complete it before you start. It is more likely to fit where people would reasonably expect the processing. It is less suitable where the person would be likely to object or the footage is sensitive.
Staff are a special case. The ICO warns that consent is unlikely to be valid where there is a clear imbalance of power between the person and the controller, and employers are the obvious example. If an agency films a client's staff, ask the client how participation is made genuinely optional, and have someone other than a manager collect the forms.
Release, consent and notice: what each is for
A release is the paperwork that records someone's consent to appear and to have the footage used. Film London says it need not be a long contract. A short signed statement can be enough, filed with the production's key documents.
Separately, the ICO's right to be informed means you must give people privacy information at the time you collect their data. That covers the purposes, how long you will keep it and who it will be shared with. On a shoot, the release and a short privacy notice can be one sheet.
A good release includes:
- who is filming and a contact address
- what the footage is for, and where it will be published
- how long the footage will be kept
- who it may be shared with, such as a client or a platform
- how to withdraw consent, and what happens next
- a signature, a printed name and a date
Situations, and what to do
| Situation | What to do |
|---|---|
| Interviewee, presenter or actor | Signed release before filming, with the privacy information on the same sheet. |
| Client's staff | Agree with the client how participation is optional. Offer an alternative for anyone who prefers not to appear. |
| Event or lecture audience | Tell attendees in advance, for example on the invitation or booking confirmation (UCL's guidance), and put clear notices at the entrances. A seating area outside the shot is a sensible option for anyone who does not want to be filmed. |
| Street or public place | No simple law bans it, but avoid private moments, such as someone leaving a clinic. Use clear signs and tell people they may enter shot. Agree sign wording with the landowner or local authority. |
| Children | Written consent from a parent or carer. Film London sets a much higher threshold for publishing a child's image than an adult's. |
| Someone who objects | Exclude them from the shot or reframe. If the footage exists, stop using it if they withdraw. |
| Music, artwork or branded items in shot | Separate permission may be needed from the rights owner. Glasgow asks for proof of consent when you use someone else's music or artwork. Film London advises obscuring identifiable logos or showing them only incidentally. |
Children and consent
For under-13s the ICO's rule that a parent must consent applies to online services offered directly to children. Outside that, the ICO says the Gillick competence test applies, and in Scotland anyone aged 12 or over is presumed competent unless shown otherwise. Those are legal tests about capacity. On a commercial shoot the sound default is still a written consent from a parent or carer, as the table says, and you should not publish a child's image without it.
Do not rely on the artistic exemption
Film London notes that a journalistic, literary or artistic defence exists, but advises against relying on it, because the producer would need a reasonable belief that publication serves the public interest. For commercial and corporate work, assume it does not apply.
Storage, security and takedowns
- Keep releases with the footage. Store them with the production's key documents so you can find them years later.
- Keep rushes no longer than you need. The storage limitation principle says identifiable data should not be kept longer than necessary. Set a deletion date in the release and in your project plan.
- Secure the files. The security principle covers accidental loss as well as misuse, so use access controls and sensible backups.
- Plan for withdrawal. Consent can be withdrawn at any time, and processing should stop promptly. Decide in advance who receives a removal request, how quickly you will act, and what you will do about material that has already been published.
Framing and editing
Film London also asks producers to avoid editing or framing footage so it implies something the original did not. Do not place a recognisable person next to a negative story unless the link is accurate.
Running a closed set
A hired studio is a controlled place. Everyone on set has arranged to be there, so releases can be collected at sign-in and each person can see the privacy notice before the camera rolls. That is easier than clearing a street. If you are weighing locations, see filming around Chichester for what applies outdoors, and how to brief a video shoot for where release collection fits in the plan. Our studio hire page lists the rooms.
Check the guidance before you rely on it
The ICO notes that its guidance on the principles is under review because of the Data (Use and Access) Act 2025. Check the current wording before a large job. If you also publish content made with creators, see the short guide on influencer and creator ad labelling.
Sources
- Information Commissioner's Office, What is valid consent?, read 5 November 2026
- Information Commissioner's Office, What is the legitimate interests basis?, read 5 November 2026
- Information Commissioner's Office, The right to be informed, read 5 November 2026
- Information Commissioner's Office, A guide to the data protection principles, read 5 November 2026
- Film London, Filming People, read 5 November 2026
- Filming in England, Filming Consent Guidance, read 5 November 2026
- University College London, Filming and photography consent, read 5 November 2026
- University of Glasgow, Video consent, read 5 November 2026
Related guides
The picture at the top of this page is an illustration, not a photograph of a client or a real job.
Questions we get asked
Do I need a release form to film someone in the UK?
There is no single law that demands a signed form for every person on camera, but you should get written consent from anyone who is the focus of a shot or clearly identifiable. Footage of an identifiable person is personal data under UK GDPR, so you also need a lawful basis and must tell people what you are doing. A short signed release is the simplest way to do both.
Can I film people in a public place in the UK?
There is no simple law banning it, and ordinary activity in public is unlikely to breach privacy. Avoid private moments, put up clear notices, tell people they may enter shot and agree the notice wording with the landowner or local authority. If someone is the focus of a shot, get consent.
Can someone withdraw consent after I have filmed them?
Yes. The ICO says consent is only valid if the person can withdraw it at any time, and processing should stop promptly when they do. Put a contact address and a removal process in your release so you can act quickly if someone asks.
granary.digital · 01243 884993 · studio@granary.digital · The Old Grainstore, Adsdean, Chichester, West Sussex, PO18 9DN · Prices exclude VAT unless marked inc VAT