Almost every school in the country has a photography policy. Almost none of them say anything about what happens to a child’s image after it has been published.
The risk now begins there.
Three free documents govern how a UK school takes and uses images of pupils. Between them they ask a school to do five things. With the job titles changed, the same applies to early years settings and sports clubs.
DfE
ICO
NSPCC
None of these documents tells a school to stop publishing. All three tell it to know what it is doing and be able to show it.
A policy earns its place when a member of staff can open it on a Monday morning and find the answer. Most good policies answer these five.
On what lawful basis do we take and use images of pupils? Named, with the reasoning written down.
How do we record who agreed to what? A consent record per pupil, and a discreet way for staff to know who must not be photographed.
Where may an image be published, and who decides? Separate permissions for the website, social media, print and third parties.
How long do we keep images, and where? A retention period tied to purpose, secure and encrypted storage, school owned devices only.
What applies to parents photographing events? Data protection law does not usually apply to personal use, but the policy can still set expectations about disruption, about children who must not be identified, and about posting other people’s children publicly.
If your policy answers all five, you are ahead of most. It is the sixth question that the sector has not caught up with.
A photography policy governs the decision to publish. It cannot govern what follows, because the school no longer controls the image. The NSPCC puts it plainly: images can be copied, downloaded, screenshotted and shared by anyone, and once online an image “will be very difficult to recall it if consent is withdrawn”.
What can be done with a published image has changed inside two years
8,029
AI generated images and videos assessed in 2025 as showing realistic child sexual abuse
3,443
of them videos, up from 13 in 2024
Source: Internet Watch Foundation, AI CSAM Report 2026.
A policy that takes this seriously adds a sixth section, how we protect the identities in the images we choose to publish, with four parts. Three cost nothing.
Publish the activity, not the child. The NSPCC advises images that focus on the activity, taken from a distance, with close ups side on.
Strip what identifies. No names with images. Remove location data and metadata before upload. Consider reducing resolution. All three are NSPCC recommendations.
Review what is already out there. A termly review of the website and social accounts, with a named owner. The DfE confirms a school can ask a parent to remove publicly posted images of other pupils that raise safeguarding concerns.
Decide how you will handle faces. Until recently the choice was identifiable faces or no photographs. There is now a third option: replace each face with a generated one before publication, so the image can be shared and the child cannot be identified from it.
Aidos replaces every child’s face in a school photograph with a realistic generated face before the image is published. The replacement is irreversible, the face belongs to no real person, and the school chooses from several candidate versions of each image.
Before and after images use licensed stock photography, processed through Aidos.
The photograph still shows the school day. It cannot be used to identify, or to train a model on, any individual child.
One part of the sixth section
It protects the identities in the images your school chooses to publish, and nothing else. If your policy already answers the first five questions, Aidos is the practical answer to the sixth.
Not the policy
A consent form that says what the risk is and what the school does about it is easier to sign than one that does not.
The sixth section changes the consent conversation with parents, and in our experience it changes it for the better.
Parents have been receptive to informed consent that explains today’s risk and shows what the school is doing to reduce it. The schools we work with name Aidos in their consent forms and are explicit with parents about how images are processed. We have worked alongside those schools to support the change to their consent process and to answer parents’ questions as they came up.
The questions designated safeguarding leads, bursars and heads ask most often when they review a photography policy.
It is a decision that needs a lawful basis, a record of who agreed to what, and a plan for what happens to the image afterwards. The DfE’s data protection guidance for schools says schools often collect specific consent before posting to social media because the sharing is wider and the privacy risk higher. The NSPCC adds that once an image is online it will be very difficult to recall if consent is withdrawn.
Nothing in law. Video is personal data in exactly the same way as a still image, and the same lawful basis, consent record and retention rules apply. A policy that only says “photographs” leaves staff guessing about assemblies filmed for parents, sports day livestreams and clips posted to social media. Say “photographs and video” throughout.
Either. The NSPCC publishes an example photography and filming policy statement that is free to adapt. Whatever you start from, the test is whether it answers the five questions on this page, including the one almost every template leaves out: what happens to an image after it has been published.
Data protection law does not usually apply to photos taken for personal use, according to both the DfE and the ICO. Your policy can still set expectations: not disrupting the event, not photographing children whose parents have asked that they are not identified, and not posting other people’s children publicly. The ICO says posting to a public account is likely to go beyond personal use.
Start a no obligation 28 day free trial today with 15 free images. Run one of your own published photographs through Aidos and see what the sixth section looks like in practice.
Start trialTwenty minutes with us, on your own images, with your designated safeguarding lead in the room.
Request a demo