Student photos, event albums and publication choices

Imagine that the school photographer has finished the annual day. There are hundreds of images, parents are asking for a link and the communications team wants a few photographs for next year’s admissions campaign. Before anyone uploads the folder, the institution needs to make several separate publication decisions.

An album for a defined family audience, an internal learning record and a public advertisement do not have the same purpose or exposure. Start with those differences, not with the convenience of one shared folder.

Decision one: why was the image taken?

Describe the intended use before capture where possible. Is the photograph part of a learning activity, a record of participation, an optional family album or public promotion? Identify the people visible and the accompanying information, including names, uniforms, location and captions.

As of 22 October 2026, the substantive DPDP duties discussed here are scheduled for 13 May 2027 under the commencement notification. The coming sections 5, 6 and 9 will require assessment of the relevant processing route, notice, consent and additional children provisions. Rule 10 addresses parental verification where required. This planning exercise should also account for existing applicable obligations.

Do not assume a child’s attendance at an event supplies permission for every publication. Equally, avoid treating the entire event as one indivisible processing activity. A specific assessment is more useful than a single broad statement about photographs.

Decision two: who will receive the image?

Define the audience in operational terms. A link restricted to particular accounts differs from a public page that can be indexed or freely forwarded. Check the actual sharing settings and test them with an account outside the intended audience. A label saying ‘private album’ is not evidence that access is restricted.

Review downloads and onward sharing as part of the explanation. Be honest about what the institution can control and what it cannot guarantee once an image is received. Choose a distribution method that fits the promised audience rather than relying on a request that everybody behave carefully.

For public material, consider whether the story needs a full name, a precise location or other identifying details. A caption can make a photograph more revealing than the image alone. Remove unnecessary details and check the background before release.

A hypothetical annual-day album

A school offers a family album and separately plans a small public event report. Its preparation distinguishes those two uses. The team keeps track of relevant publication choices and provides a practical way for staff to identify the approved material without circulating private family explanations.

Before upload, an editor checks the images against those conditions. One photograph includes a child whose image should not appear in the proposed public report. The editor selects an alternative rather than assuming that a wide group shot makes the concern irrelevant. The family album is tested through its intended access route.

Months later, a marketer asks to reuse the same images in an admissions advertisement. The asset register prompts a new assessment of the purpose and permissions. The existence of a completed album does not silently authorise the new campaign.

Decision three: which exception, if any, actually applies?

Rule 12 and the Fourth Schedule contain conditional exceptions affecting particular children duties. The educational-institution condition is not a blanket permission for publicity. Read the exact activity and conditions before relying on it, and remember that section 9(2)’s wellbeing restriction is not removed by those exceptions.

Record why a particular use qualifies or does not qualify. Where the legal position is uncertain, obtain a focused assessment of that use before publication instead of relying on a general assurance that schools are exempt.

Manage changes after publication

Where consent is the basis, the coming section 6 withdrawal framework requires a usable route and action on the affected processing within a reasonable time, subject to its legal qualification. Identify the people who can remove controlled website assets, stop future campaigns and contact an external photographer or agency.

Do not promise to recover every printed copy or erase every independent repost. Explain actions and limitations accurately, and record what remains unresolved. Keep any necessary evidence restricted to its justified purpose.

The common failure is choosing the sharing method first and asking about permission later. A short asset record linking purpose, audience, approved version and publication conditions lets the school make each release deliberately, even when many people are asking for photographs at once.