In this guide · 8 sections
- 01Are event photos personal data under the PDPA?
- 02Private events: notice, consent and deemed consent
- 03Sample photography notice wording
- 04How to run opt-outs at the event
- 05Children, hired photographers and staff
- 06When someone asks you to take a photo down
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
At a private event you generally need consent: say in the invitation or registration form, and on a clear entrance sign, that photos will be taken and how they will be used, and offer an easy opt-out. At events open to the public, the publicly available exception may apply.
Are event photos personal data under the PDPA?
Yes, if people can be identified. The PDPC's Advisory Guidelines on the PDPA for Selected Topics (revised May 2024) say an image of an identifiable individual in a photograph or video recording is personal data about that individual. People in the background count too, unless they are too small or obscured to be identified.
That does not mean you need a signed form from every guest. It means you need a lawful basis for collecting, using and publishing the images: usually consent, deemed consent, or an exception such as the one for publicly available data. Which one applies depends mainly on whether the event is private or open to the public.
| Situation | What the PDPC guidelines indicate | Practical approach |
|---|---|---|
| Private event (invited guests, registration required) | Consent generally required; deemed consent may apply | Notice in invitation and at entrance, plus opt-out |
| Event open to the public (few or no entry restrictions) | Publicly available exception likely applies to taking photos | Still put up a notice as good practice |
| Staff party or internal event | Employer is responsible for compliance | Tell staff in advance; respect opt-outs |
| Guest taking photos for personal use | Personal or domestic capacity: PDPA does not apply to them | No action, unless your business reuses them |
| Children at the event | Parental consent for under-13s; judgment for 13 to 20 | Ask parents at registration; use wristbands for opt-outs |
Private events: notice, consent and deemed consent
The PDPA does not prescribe how consent for photos must be obtained. The PDPC recommends, as good practice, consent that is in writing or recorded so you can prove it later. Its own examples for a private function give three workable options:
- State clearly in the invitation that photos will be taken and what they will be used for.
- Put up an obvious notice at the reception or entrance saying the same thing.
- Include the statement on the registration or confirmation form that guests submit.
Deemed consent can also apply. The PDPC's example: a photographer tells a guest the photos are for the company newsletter and asks if they would like their photo taken. By letting it be taken, the guest is considered to have consented for that stated purpose. The key words are "for that purpose". A photo taken for an internal newsletter is not automatically consented for a paid Facebook ad.
Sample photography notice wording
Keep the sign short, large and placed where everyone passes it, such as the registration desk. Repeat it in the registration form.
Adapt it to your event. If the session is streamed live or recorded in full, say so separately, because people cannot opt out of a livestream after the fact.
How to run opt-outs at the event
A notice only works if people can actually say no. Make opting out quick, visible and respected by everyone with a camera.
Give opt-outs a visual marker
A coloured lanyard, sticker or wristband at registration lets photographers spot who to avoid without awkward conversations.
Brief the photographer and staff
Explain the marker, which areas are no-photo zones, and that candid crowd shots should avoid marked guests.
Separate livestream and recording areas
Seat people who do not want to appear outside the camera's view, and tell them where that is.
Review before publishing
Check selected photos for opt-out markers and blur or drop images where those guests can be identified.
Keep a record
Save the invitation text, sign wording and registration form with the event file, in case you need to show what guests were told.
Children, hired photographers and staff
Children and young people
The PDPC considers that a minor aged 13 to 20 can give valid consent if the policies are readily understandable to them. For children under 13, and wherever a minor may not understand the consequences, get consent from a parent or guardian. Schools and preschools may set a higher age. Our guide to child photos and preschool parent apps covers education settings in more detail.
Hired photographers
If you hire a photographer under a written contract to take photos on your behalf, the PDPC treats them as your data intermediary: you handle consent, and they must protect, retain and dispose of the images properly. The moment they reuse your event photos in their own portfolio, they are acting for themselves and need their own consent. Put that in the contract. Photographers can find more on this in our photographer website and client gallery guide.
Staff taking photos
When an employee takes photos as part of their job, the PDPA treats the employer as responsible. A guest snapping a selfie for their own social media is acting in a personal capacity, but if your company later reposts that photo for publicity, you need consent for that use.
When someone asks you to take a photo down
Under the PDPA, people can withdraw consent at any time with reasonable notice. The PDPC's guidelines explain what that means for photos:
- Stop future use and publication of the image, and tell your agencies and photographers to stop too.
- You are not required to recall printed material already distributed, such as brochures or annual reports.
- For group photos, you can mask or crop the person instead of withdrawing the whole image.
- The PDPA does not give a general right to have data deleted, but you should not keep images longer than you need them.
- If the photo was taken without a proper basis in the first place, stop using it and consider deleting it.
In practice, take down or edit the post promptly, reply in writing to confirm what you did, and update your photo library so the image is not reused. If you collect registrations through your website, our guide to event registration websites shows where to put the photography statement in the form.
Do it yourself or get help?
Most small businesses can handle event photography with three things: a line in the invitation or registration form, a clear sign at the entrance, and an opt-out marker. Write them once and reuse them for every event.
Event photography PDPA checklist
Our PDPA Compliance Pack (S$690) includes a website privacy policy, a staff data protection policy, a personal data inventory and a breach response plan, which give your event notices something to point to. We are not a law firm; for unusual situations, ask a lawyer.
Frequently asked questions
For a private event, generally yes. The PDPC suggests stating in the invitation or with an obvious notice at the entrance that photos will be taken and how they will be used, or including it on the registration form. Deemed consent can apply when someone knowingly lets a photo be taken for a stated purpose.
A clear, obvious notice at the entrance is one of the measures the PDPC gives as an example for private functions, especially when combined with the same statement in the invitation or registration form. It should explain how photos will be used and how to opt out, and staff and photographers must respect opt-outs.
Possibly not. The PDPC says that taking photos of people at an event open to the public, with few or no entry restrictions, is likely collection of publicly available data, for which consent is not required. A private space inside a public venue may not count. The PDPC still suggests asking for consent as good practice.
Yes. For children under 13, consent should come from a parent or guardian, and they can decline or withdraw it. Ask at registration, give opted-out children a visible marker, and check photos before publishing. For minors aged 13 to 20, the PDPC says they may consent themselves if they understand the policy.
If the photographer works for you under a written contract and only for your purposes, the PDPC treats them as your data intermediary, so you are responsible for consent and they must keep the images secure. If they reuse the photos for their own portfolio or marketing, they need their own consent from the people shown.