Can we use a photo of the people we help?

England and Wales: This page sets out the position in full. Scotland: the same data protection law and the same Fundraising Code rule — and a second trigger England does not have: OSCR now publishes your accounts in full, so a photo or name in them goes public; see below. Northern Ireland: the same data protection law and the same Code rule; whether CCNI adds its own safeguarding wording on images was not established.

The ICO does not require consent for a photo

Data protection law does not require charity photo consent, though most charities believe it does. The position is the same in England and Wales, Scotland and Northern Ireland. It matters to the fundraiser, the safeguarding lead and the trustees alike.

A photo of someone who can be recognised is personal data. So you need a lawful basis for using it. But consent is only one of the bases. The general choice is made when you establish your lawful basis for each purpose; this page applies it to photos and stories.

The ICO treats consent and legitimate interests as alternatives. It warns against choosing consent when you do not need it. In its words: “The UK GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis.”

The reason is practical. Once you rely on consent, you generally cannot switch to another basis later. If the person withdraws, you must stop. Legitimate interests needs a three-part test instead, done before you start. You check:

1. whether there is a legitimate interest
2. whether using the photo is necessary for it
3. whether the person’s rights override it

The ICO has no guidance written for charities and beneficiary photos. This page applies the ICO’s general guidance. That includes its guidance on photos in schools, the closest published example. The schools guidance treats legitimate interests as a live option and recommends an opt-out rather than consent.

The Fundraising Code does — and that is a different rule

The reason charities ask for permission is the Code of Fundraising Practice, not the ICO. The current Code took effect on 1 November 2025. It says:

“You must get clear and informed permission from any people who could be identified from a case study before you use it. If the person has died, you must take all reasonable steps to get permission from their estate.”

And, for children:

“You must get appropriate permission before taking or publishing photographs of children. For children under 13, you will need permission from a parent, guardian or responsible adult.”

So the Code says you must get permission, whatever lawful basis you use for data protection. Two regulators, two reasons, one practical answer.

Keep them apart in your policy. They behave differently. The Code does not give a person a right to withdraw. What happens after a withdrawal is data protection law, covered below.

Getting the process wrong can itself breach the Code. In September 2025 the Fundraising Regulator found against a community interest company. Its consent form had no space to agree to how information would be shared. The company could not show how it weighed vulnerability and capacity. It also kept posting images. No separate ICO finding was needed.

How the Code applies to you, and what the Regulator can and cannot do, is on registering with the Fundraising Regulator and adopting the Code.

When a photo becomes special category data

Some personal data gets extra protection under Article 9 of the UK GDPR: health, ethnicity, religion and similar. Many people assume that any photo from which a viewer could guess one of these is special category data. That is not the test.

The ICO’s guidance says: “you do not have to treat all such names or images as special category data in every instance”. It depends on whether “your processing intends to make an inference linked to one of the special categories of data; or you intend to treat someone differently on the basis of inferred information linked to one of the special categories of data.”

So the test is your purpose, not what a viewer might infer. An uncaptioned appeal photo taken at a food bank is not special category data only because someone could guess at a person’s background. The same photo captioned to show the person’s disability, faith or refugee status usually is. Now the inference is the point.

Then you need an Article 9 condition as well as a lawful basis.

The ICO draws no bright line here on purpose, and neither does this page.

One age, two sources

Charities often talk about a data protection “age of consent”. One exists, but only in a narrow case.

UK GDPR Article 8 is headed “Conditions applicable to child’s consent in relation to information society services”. Its age — 13 — applies only to consent for online services offered directly to a child. A photo taken at a session, or a paper case-study form, is not an online service. For those, there is no statutory age at all.

The ICO offers a rule of thumb instead: “Data protection law doesn’t specify an age at which a child is considered capable to exercise their own rights, although 12 years old is typically given as a guideline. However, this should be considered on a case-by-case basis.”

The Code’s own age for asking a parent comes from another source. It is 13. That is the Fundraising Regulator’s policy choice, not a data protection age. The Regulator has not published why it chose that figure, or whether it meant to match Article 8.

One date to watch. Since 29 April 2026, the Children’s Wellbeing and Schools Act 2026 s.72(2), UK-wide, has given the government a power to raise the online-services age. No regulations had been made when this was checked on 7 August 2026. Check again before you rely on the figure.

If someone changes their mind after you’ve published

This is the question nobody answers. Both of the usual answers are wrong.

“It’s already printed, so there’s nothing we can do” is wrong. “We must recall every copy” is also wrong. UK GDPR Article 17 sets the standard as reasonable steps. Where you have made the data public, you must take reasonable steps to tell others who are using it that the person wants it erased.

In practice that means:

1. stop active use — take it off your website, out of live campaigns, and do not reprint
2. take reasonable steps to tell people you know have republished it online
3. do not pretend you can recall print already handed out — record what you decided and why
4. if you keep anything, record which Article 17(3) exemption you rely on, case by case

None of those exemptions means “once published, always exempt”. Each is a balance.

The balance shifts further where the person was a child when they agreed. The ICO quotes the recital behind Article 17. It says the right applies “in particular where the data subject has given his or her consent as a child … and later wants to remove such personal data”.

The recital adds that they “should be able to exercise that right notwithstanding the fact that he or she is no longer a child.” Where the subject was a child when consent was given, erasure is more likely to win.

This is a reasoned reading of the Article and the ICO’s guidance. No ICO decision was found on this exact situation: a charity, a withdrawn consent, a report already handed out.

Collect it so you can honour a withdrawal

What follows is this guide’s own model. No regulator publishes one at this level of detail. Each step rests on a sourced point in the sections before this one. The order and emphasis are ours.

1. Separate the uses. Service delivery, fundraising and evaluation are three purposes. Each needs its own basis. Do not collect one blanket consent for all three.
2. For fundraising, get explicit permission that is specific and time-limited. Record what will be used, where, for how long, and that it can be withdrawn.
3. Put an expiry or review date on every consent. This is the single most useful step. A consent that lapses each year turns a future withdrawal into a routine non-renewal, not a recall.
4. Do not rely on consent for anything you cannot afford to stop. If a use is essential, choose another basis.
5. Say at the start what cannot be undone — for example, that printed copies cannot be recalled.
6. For under-18s, judge competence case by case, and follow the Code’s line on parental permission for photos.
7. Make safeguarding sign-off a condition, not an afterthought. The Commission lists data breaches among the harms trustees must manage. It says: “make sure you have permission to display any images on your website or social media accounts. You may need individual or parental permission”.
8. Record the lawful basis, and any Article 9 condition, at the time. If a withdrawal or complaint arrives years later, you need to show your reasoning as it stood then.

This guide also maps a typical charity’s purposes to bases. For beneficiaries’ health or similar data it suggests a separate Article 9 condition. It never assumes that charities are exempt. That mapping is our judgement, not an ICO table. Your own facts may differ.

The ICO’s Children’s code does not apply to most charities. It covers online services likely to be used by children. A youth club or food bank working in person is not one, even with a website. A charity running an app or online counselling for under-18s may be.

What is not established. No official source covers people for whom being identified is itself the harm. Examples are survivors of domestic abuse, refugees, and young people in or leaving care.

Nor does any official source cover a location given away by a recognisable background. The safeguarding sign-off step in the collection model covers the practical need. It will not give you a published framework, because none exists.

Scotland: your accounts are now a second place photos appear

Scotland has a second trigger. It has nothing to do with fundraising.

Since 9 March 2026, OSCR has published every accounts document it receives in full. In OSCR’s own words, “OSCR will no longer delete any personal information from these documents prior to publication”. No income level exempts a charity. The documents stay on the register for years. So the charity is now the only filter.

A good consent process for fundraising does not settle this. The question is whether to name or picture anyone in the accounts pack at all. It comes up when the trustees’ annual report is drafted.

Make sure the decision reaches whoever drafts the report. See drafting the narrative sections and the financial review. What is published, and by whom covers the Scottish regime in full.

The Scottish accounts regulations allow a safety dispensation (regulation 15). How it works was not examined for this page.

On the Code, Scotland is settled. The Scottish Fundraising Adjudication Panel sends Scottish charities to the same Code text. Its role is handling complaints, not writing its own rules. Data protection law is reserved and identical. What was not pinned down is OSCR’s own wording on images in its safeguarding guidance.

Northern Ireland: the Fundraising Regulator’s remit covers Northern Ireland. So the Code rule is the same, and data protection law is identical. Whether CCNI’s safeguarding guidance adds its own line on images was not established.

Next: Can we criticise the government? The last step in this hub covers what the charity may say in public.

Common mistake: attributing the permission rule to the ICO — or dropping it because the ICO does not require consent

Two regulators reach one practical answer. The sector treats it as one rule. The ICO does not require consent for a beneficiary photo. It warns consent is often the worse choice.

You ask anyway because of the Code of Fundraising Practice. It says you must get “clear and informed permission” from anyone identifiable in a case study. That rule applies in all three nations. Only the body that hears a complaint in Scotland differs.

Common mistake: treating every photo from which ethnicity or disability could be guessed as special category data

The test is your purpose, not a viewer’s guess. An uncaptioned appeal photo is ordinary personal data. The same photo captioned to show someone’s disability, faith or refugee status usually needs an Article 9 condition. There is no bright line, and this page does not invent one.

Common mistake: applying the online-services consent age as the data protection age of consent

Article 8’s age applies only to consent for online services offered to a child. Offline there is no statutory age. The ICO’s age is a guideline to apply case by case.

The Code sets its own parental-permission age for photos — a regulator’s choice, not a data protection rule. A power to raise the online age now exists, with no regulations yet.

Common mistake: either stock answer when someone withdraws consent after publication

“It’s already printed” and “we must recall everything” both feel honest. Both are wrong.

The standard is reasonable steps: stop active use, take it off the website, do not reprint, and tell known republishers. Where the person was a child when they agreed, erasure is more likely to win. This is a reasoned reading of the law, not a decided case.

Worked example

Tollgate Youth CIO wants to use photos from its Friday sessions in a fundraising appeal. One is captioned to describe a young person’s disability.

The group photo is ordinary personal data. Tollgate chooses a basis for it. The captioned photo is special category data. The caption makes the inference the point. It needs an Article 9 condition as well.

The Code says Tollgate must get permission for both. For anyone below the Code’s threshold, that means a parent. That is because the Code says so, not because data protection law sets that age.

Tollgate follows the collection model. The appeal is kept separate from session records and evaluation. Permission is explicit and has an expiry date. Tollgate explains that printed copies cannot be recalled. And its safeguarding lead signs off before anyone is asked.

The Children’s code does not apply: Tollgate runs sessions in person, not an online service.

Some time later a young person asks for their photo to be taken down. Tollgate removes it from its website and its campaigns, does not reprint, and tells the one local site that reposted it. It records that it gave extra weight to the request because the person agreed as a child.

The outcome is a written images-and-stories policy and a consent record for every person featured. Each record has an expiry date and a safeguarding sign-off.