A staff photo is personal data
A photograph of an identifiable colleague is personal information, so an employer that publishes one needs a lawful basis under UK GDPR and has to tell the person what it is doing. We are a photo service, not a law firm, and nothing here is legal advice. The ICO pages below were read on 22 October 2026, and your own data protection adviser should check the final wording.
The two lawful bases people reach for first are consent and legitimate interests, and the ICO treats them very differently when the person asking is the employer.
Consent, legitimate interests and what the ICO says
| Basis | When it fits | The catch, according to the ICO |
|---|
| Consent | A truly optional portrait, such as a press photo that only volunteers appear in | The ICO says consent is not freely given where there is an imbalance of power, and names employers. Its example is staff asked to consent to monitoring who feel compelled because they rely on the company for their livelihood. |
| Legitimate interests | A consistent team page or internal directory that staff would reasonably expect | You must pass a three-part test that looks at purpose and necessity and then balances the interests. Staff can object, and they must give reasons based on their own situation. The right to object is not absolute. |
| Asking for consent when you would process anyway | Avoid | The ICO calls this misleading and unfair, because it gives a false choice and only the illusion of control. |
If you use legitimate interests, the guidance expects the interest to be spelled out in the privacy information you give to staff. A team page where staff are told the photo is a condition of the job is a poor fit for consent.
What employees ask, and where the answers disagree
Three UK threads show the questions staff actually have. On r/LegalAdviceUK, an employee of nearly ten years was told to appear on a new public staff page with name, work history, qualifications and photo, and asked whether they must. Another poster on that forum asked what happens when a company keeps using an employee's image after they have left. On r/HumanResourcesUK, an employee asked what the law says about a company photographing staff at their normal workplace.
The answers contradict each other. Some say plainly that the employer needs your consent. Others reply that GDPR has other lawful bases and that an employer can rely on legitimate interests, so refusing may be an employee-relations matter and not a data protection one. One poster doubted that legitimate interests would stretch to a full public profile once the person has refused. The doubt about legitimate interests fits the ICO's balancing test, and the point about other bases fits its view that consent is a poor fit for employers. None of this settles a particular case, which is why the five steps below put the reasoning on paper before the shoot.
Leavers and withdrawn consent
A 2019 note from the law firm Wrigleys on a former employee who objects to marketing use of their image makes three points. If the employer relied only on consent and the person withdraws it, the image should come down as soon as reasonably possible. An employer cannot change its lawful basis afterwards. If it relied on legitimate interests, it should weigh its own interest against the leaver's and record how it decided, asking how much it needs the image, whether the person was told it might be kept after they left, and how easy it is to remove. The note predates later ICO pages, so use it as background and read the ICO's own pages for the current wording.
What this means for a team photo project
- Decide the purpose first: website team page, press kit, internal directory or a mix. Different purposes can need different judgements.
- Write down the legitimate interest, why a photo is needed for it, and why staff expectations and rights do not outweigh it.
- Tell people before the shoot where the photos will appear and for how long, in the same privacy information they get for other staff data.
- Offer a real alternative for anyone who does not want to be photographed, such as a logo or initials on the team page, and do not mark that person out.
- Agree what happens when someone leaves or objects. You should be able to remove a photo from the live site without a long search.
What a team shoot costs per head
Whito's August 2026 check of 40 published UK price lists reports £40 to £75 a head for team headshots of ten or more people, booked as a half or full day on site, and £110 to £350 for an individual session. One studio publishes team headshots from £985 excluding VAT for teams of any size, with retouching and usage rights included. The table shows a team of twelve using Whito's figures.
| Route for 12 people | Per head | Total |
|---|
| On-site team day, low end | £40 | £480 |
| On-site team day, high end | £75 | £900 |
| Individual sessions, low end | £110 | £1,320 |
| Individual sessions, high end | £350 | £4,200 |
Whito's own advice is that for five or more people a per-head package beats individual sessions every time. The day still needs a quiet room and someone who keeps to the schedule, and the usage licence is a separate question for the photographer.
Where AI portraits fit in a company project
Profilfoto KI builds a photorealistic portrait from your own selfies in the style you choose, such as business or LinkedIn, and no studio appointment is involved. The first photo is free and carries a watermark, so you can judge the likeness before paying anything. After that the packages are one-off payments with no subscription: 2 photos for €4.99, 12 for €29 and 40 for €79. Creation usually takes three to five minutes. Uploaded selfies are stored in Frankfurt and deleted automatically after 90 days at the latest. The payment page is in German or English, and the privacy policy is available in English on our privacy page.
In a company setting, every colleague would create their own portrait from their own selfies, and nobody should be pushed into it. That keeps the choice with the person, which matters given the ICO's view of employer requests. It suits remote teams who cannot be gathered on one day, and it can give a similar look if everyone follows the same brief on style and background. A photographer is still the better route when the team day is also a team event, or when the picture needs a physical location.
Questions people ask
Do I need consent to put staff photos on a UK company website?
The ICO says consent is often not freely given when the person asking is the employer. Many employers rely on legitimate interests instead, with a documented assessment and clear privacy information. Check the details with your data protection adviser.
Can my employer require a photo on a public staff profile?
Forum answers disagree, and we cannot settle it here. The ICO says an individual can object where legitimate interests are the basis, with reasons based on their situation, and that the right is not absolute. Raise it with HR and ask for the employer's assessment.
Can a former employee make a company stop using their photo?
It depends on the lawful basis. A 2019 Wrigleys note says that where only consent was relied on and it is withdrawn, the image should be removed as soon as reasonably possible. Where legitimate interests apply, the employer weighs both sides and records the decision.
What does a company headshot day cost in the UK?
Whito reports £40 to £75 a head for teams of ten or more, booked as a half or full day on site. Individual sessions typically cost £110 to £350.
Should staff be required to use AI portraits?
No. Each person should choose for themselves, and offering a simple alternative is better than a requirement. The ICO's view of consent in employment points the same way.
Sources (retrieved 22 October 2026)
Create your first photo free