Posting employee photos on the website: is that allowed without further ado?

You are allowed to place photos of employees on your website, but not without justification. A recognizable photo is personal data, so you need a valid legal basis. In practice, this is almost always free, informed, and explicit consent from the employee concerned. You record this consent separately from the employment contract, explain where and for what purpose the photo will be used, and the employee may withdraw their consent at any time. If you do not arrange this properly, you run a privacy risk and an employee can demand the removal of the photo.

Are you allowed to put a photo of an employee on the website?

Customers want to know who they are doing business with. Putting a face to a name makes your company more personal and accessible, which is why many entrepreneurs put photos of their team on their website. Understandable, but it is not as casual as it seems.

A recognizable photo of a person is personal data. Publishing it is the processing of personal data, and therefore the rules of the General Data Protection Regulation (GDPR) apply. You must therefore have a valid legal basis to be allowed to post the photo. For employee photos on a public website, that basis is generally the consent of the employee themselves.

In addition, portrait rights a role. A person depicted has a personal interest in their portrait. In practice, consent for GDPR processing and due care regarding portrait rights go hand in hand: you politely ask the employee for consent and you only use the photo for the purpose for which that consent applies.

What permission do you need?

Consent under the GDPR is not a formality. For consent to be valid, it must meet a number of requirements.

Explicit and specific

The consent must explicit and specific . A general phrase such as “agree to image usage” is insufficient. You must state concretely where you are using the photo and for what purpose. There is a difference between a photo that is only on the private intranet and a photo that you use publicly on your website, on LinkedIn, or in an advertisement. For any use, the employee must have consciously consented to it.

Informed

The employee needs to know what he is saying yes to. Therefore, provide clear information on: what the photo will be used for, where it will be published, who can see the photo, and how long the photo will remain online. Only when the employee knows this can he make a real choice.

Released

This is the most difficult point in the workplace. Consent must freely given: it must not be obtained under pressure or coercion. This is a particular point of attention in an employment relationship, because a hierarchical relationship exists between employer and employee. The supervisor scrutinizes whether an employee truly dares to say “no” freely in such a situation. Therefore, make it explicitly clear that refusal is permitted and will have no adverse consequences.

How free is “free” consent within an employment relationship?

The core of the problem: due to the power imbalance, an employee may feel obliged to give consent, even if they do not actually want to. For this very reason, European privacy rules emphasize that consent is only valid if it is genuinely voluntary.

For you as an employer, this means that you must actively eliminate the possibility that a “yes” actually stems from social pressure. A few practical anchor points:

• Do not attach any adverse consequences to a refusal. Anyone who does not want a photo may refuse without explanation and must not notice this in their work or assessment. Document this in writing as well.
• Procedurally separate consent from other documents, such as the employment contract or personnel regulations. Consent that is “hidden” in a contract you have to sign anyway is generally not given freely.
• Do not exert social pressure. Ask neutrally, not in a plenary session where colleagues are watching. Some employers deliberately allow a manager the choice of whether or not to be in the photo themselves, so that it is clear that refusing is indeed allowed.

If you want to set this up carefully for your entire organization, our expertise in privacy and data protection you.

Step-by-step plan: publishing employee photos in compliance with the GDPR

Do you want to get it right the first time? Then follow this order:

1. Determine usage per channel. Map out where the photo will appear: website, LinkedIn, print, or intranet.
2. Inform the employee. State the purpose, channels, visibility, and retention period before asking for consent.
3. Request written, individual consent. Use a separate form, independent of the employment contract.
4. Make refusing risk-free. Stipulate that a “no” has no consequences.
5. Keep an overview. Note which photos are located where, so that you can carry out a withdrawal quickly.
6. Secure and store specifically. Store originals securely and delete images when the legal basis expires.

Withdrawing consent: what should you do then?

An employee may withdraw their consent at any time, without reason. From that moment on, you no longer have a valid legal basis and must remove the photo. Keep in mind that withdrawal affects more than just your own website:

• Remove the photo from the website and from any caches.
• Also consider copies: newsletters, social media, brochures, and presentations.
• Where necessary, ask external parties (such as a web developer or marketing agency) for removal.

Ensure you know internally where each photo is located, so that you can process a revocation request quickly and completely. This prevents a photo from remaining somewhere after a departure or refusal.

Security and retention period of employee photos

Because a photo is personal data, the other GDPR obligations also apply. You must adequately secure and not retain it longer than necessary.

In practical terms, this means, among other things: store original files in a secure environment, delete photos of employees who have left the company (or ask upon departure if they may remain online), and consider how easily you make your photos copyable online. Technical anti-copying measures are easy to circumvent with a screenshot, but they do demonstrate that you handle the images carefully. More importantly, your workflow must be sound: clear consent, an up-to-date overview, and a quick route to remove images.

Why an individual consent form is required

In the past, many companies regulated the use of images in a single sentence in the employment contract. Under the GDPR, this is generally no longer sufficient, because consent is then not specific and not free enough. A separate, individual consent form is therefore the safest route.

A good form:

1. Specifies specifically which images are involved and for which channels (website, intranet, social media, print).
2. Makes clear that consent voluntary and may be refused without consequences.
3. Points out the right to withdraw consent , and how.
4. Separate from the employment contract and other mandatory documents.
5. Current ,request consent again.

It is precisely that combination of specific, voluntary, and revocable that makes drafting it more difficult than it seems. A form that is not legally correct provides a false sense of security: you think you have everything arranged, but the consent is invalid.

Frequently asked questions about employee photos on the website

Am I allowed to put a photo of an employee on the website without permission?

As a rule, no. You generally need permission to publish a recognizable employee photo on a public website. Without a valid legal basis, the publication violates the GDPR, and the employee can demand removal.

Is an agreement in the employment contract sufficient?

Usually not. Consent included in the employment contract is often not specific enough and not sufficiently flexible, because the employee is required to sign that contract regardless. A separate consent form is therefore preferred.

What if an employee withdraws their consent?

In that case, your legal basis lapses and you must remove the photo, including on other channels such as social media and in print. You may withdraw your consent at any time and without giving a reason.

Do I have to pay an employee for the use of his photo?

The GDPR does not require this. Compensation may be part of agreements, but payment does not render missing or invalid consent legally valid.

Does this also apply to photos on the intranet or in a private area?

Internal use also requires a legal basis, but the assessment may differ compared to a public website. It is advisable to request permission separately for each use (internal versus public) and to clearly document this.

Am I allowed to keep an old team photo after someone has left?

Not automatically. Upon departure, the reason for publication usually ceases to exist. Remove the photo or make a clear agreement in advance regarding what happens to the image after leaving the company.

What are the risks if I don't arrange this properly?

Without valid consent, an employee can object, demand removal, and, in extreme cases, file a complaint with the supervisory authority. In addition to the legal risk, there is a trust risk: employees who feel ambushed are less willing to cooperate with visual material.

Need help with consent and privacy?

Photos of your team on the website are valuable for your marketing, provided you arrange the consent in a legally watertight manner. Our legal experts draft a consent form tailored to your organization and help you think about your broader privacy policy.

• More about privacy and the GDPR: privacy and data protection.
• Questions about employment agreements with your employees: employment law.
• Having a form or contract drafted or reviewed: legal assistance from MKB Juristen.

Want to get it right immediately? Schedule a no-obligation intake and we will explain exactly what is needed for your situation.