In this guide · 8 sections
- 01Why staff photos are personal data under the PDPA
- 02Getting staff consent the right way
- 03Choosing an AI headshot vendor: retention and training terms
- 04When staff leave or withdraw consent
- 05Honest representation: real people, realistic photos
- 06A workflow for consistent, brand-friendly team photos
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
You can use AI headshots for staff, but treat them as personal data: get each person's written consent, choose a vendor that deletes uploaded selfies and does not train on them, remove photos promptly when staff leave or withdraw consent, and only show real team members who look like their portrait.
Why staff photos are personal data under the PDPA
The Personal Data Protection Act defines personal data as data about an individual who can be identified from it. A recognisable photo, real or AI-generated from their selfies, clearly qualifies.
PDPC's Advisory Guidelines on Selected Topics has a chapter on photography. Its example is close to this case: when a photo is published for an organisation's publicity purposes, such as its brochures or website, the PDPA's data protection provisions apply to the organisation, and it will have to obtain the person's consent before publishing it.
AI headshots add two more steps: you send several selfies to a third-party vendor, often overseas, and that vendor may keep them or a trained model of the person's face. Both are uses of personal data that staff should know about. This guide is general information, not legal advice.
Getting staff consent the right way
Consent works best when it is specific, voluntary and written down. A one-line message in a group chat is not enough.
What a staff consent form should cover
Employees may feel they cannot say no to their employer. Make the optional part genuine: nobody should be pressured into uploading selfies to a third-party AI service.
Choosing an AI headshot vendor: retention and training terms
Vendors differ a lot in how long they keep selfies and whether they use them for anything else. Read the privacy and security pages, not just the marketing.
| Question to check | Why it matters | Example (vendor docs, Oct 2026) |
|---|---|---|
| When are uploaded selfies deleted? | Less data held means less risk | HeadshotPro: input photos deleted 30 days after gallery generation |
| Are photos used to train AI models? | Faces should not end up in a general model | HeadshotPro says it does not use customer content to train models |
| Where is data stored? | Overseas transfer under the PDPA | HeadshotPro: data in the EEA, application servers in the US |
| Can you delete an account on request? | Needed when staff leave | Aragon: delete account and data from settings at any time |
| Is there a team account? | Keeps control with the business, not personal logins | Most vendors offer team plans |
Sources: HeadshotPro security overview, HeadshotPro pricing (one-off packages listed at US$29, US$39 and US$59 per person, approximate, October 2026) and Aragon's privacy page. If a vendor does not state retention and training terms clearly, choose another.
General design tools such as Canva and Adobe Express also have AI photo features; see our Canva vs Adobe Express comparison for their business terms.
When staff leave or withdraw consent
Section 16 of the PDPA lets a person withdraw consent at any time on reasonable notice. In practice, plan for two events: someone leaves, or someone simply asks for their photo to come down.
Add photos to your offboarding checklist
Remove the person from the team page, About page and any staff directory on the day they leave, unless they agreed otherwise in writing.
Update the files designers reuse
Proposal templates, pitch decks, brochures and email signatures often carry old headshots. Replace them in the master files.
Remove from social posts where practical
Old posts are harder; agree in the consent form what happens to past posts versus new use.
Delete the vendor account or gallery
Delete the person's gallery and any stored selfies with the AI vendor, and keep a note of when you did it.
Confirm to the person
Tell them in writing what was removed and when. It closes the request cleanly.
Our employee offboarding IT checklist covers the account side of a leaver; add the photo steps to it.
Honest representation: real people, realistic photos
AI headshots are meant to make real staff look professional, not to invent a bigger company.
Acceptable
- A real employee, consistent background and lighting across the team
- Light retouching that still looks like the person on a video call
- Business attire generated for someone who usually dresses casually
- A note on the team page that portraits are AI-assisted, if you want to be transparent
Avoid
- AI-generated people who do not work for you
- Headshots of former staff left up to make the team look bigger
- Changing age, ethnicity or features so the person is unrecognisable
- Fake reviewers or "customers" with AI faces
A workflow for consistent, brand-friendly team photos
Consistency is the main reason businesses choose AI headshots. A simple brief gets you there.
- Pick one style for everyone: background colour, framing (head and shoulders), clothing tone. Save it as a written brief.
- Use a team account so the business, not individuals, controls galleries and deletion.
- Let each person choose their own final photo from their gallery.
- Export at one size and crop for the website, and compress the files so the team page loads quickly.
- Add alt text with the person's name and role for accessibility and search.
- Review yearly: update photos that no longer look like the person.
Copyright in fully AI-generated images is uncertain in Singapore because the law requires a human author; see our guide to using AI-generated images commercially for the details. Mention the photos and their purpose in your website's privacy notice too; our website privacy policy and cookie consent guide covers what to include.
Do it yourself or get help?
Running AI headshots for a small team is easy to do yourself: agree the brief, collect consent forms, use a team account, and add photo removal to your offboarding checklist.
We can build or refresh the team page itself: consistent layout, fast-loading images, alt text, and a simple way to add or remove people without breaking the design. Our Business Website package (S$1,490) includes this as part of a new site. We do not take or generate the photos.
Frequently asked questions
Yes, you should get it. A recognisable photo is personal data under the PDPA, and PDPC's guidance says an organisation publishing a person's photo for its own business purposes, such as its website, needs that person's consent. Get it in writing, explain the AI vendor involved, and make it genuinely optional.
Some are better than others. Check how long the vendor keeps uploaded selfies, whether it trains AI models on them, where data is stored and whether you can delete accounts on request. For example, HeadshotPro states input photos are deleted 30 days after generation and not used for training. Use a business team account.
Remove it from your website, templates and directories on their last day unless they agreed otherwise, delete their gallery with the AI vendor, and confirm the removal to them. Under the PDPA, people can also withdraw consent at any time, so have the same process ready for current staff.
No. Showing people who do not exist, or former staff, as your team misleads customers about your business. Use AI headshots only for real current employees who agreed to it, and keep the portraits recognisable as the actual person.
The vendor's terms decide what rights it claims, and most assign or allow commercial use of outputs. Under Singapore law, copyright requires a human author, so a purely AI-generated image may have little or no copyright protection. The person shown still has rights over their personal data under the PDPA.