GDPR and patient photographs:
what EU and UK clinics actually have to do
Written for aesthetic, dermatology and surgical practices across the EEA and the United Kingdom. What a clinical photograph is under the law, what you need before you take one, and what changed in the UK in 2026.
Three things clinics get wrong
- →Your photographs are not biometric data. They are special category data because they reveal health, which is a different route to the same protection and a different legal test.
- →Being small does not exempt you. The under-250-staff record-keeping exemption switches off the moment you hold health data.
- →A reportable breach must be notified within 72 hours, counted from when you became aware of it, not from when you finished investigating.
This is not legal advice and it has not been reviewed by counsel in any member state or in the UK. It is a practitioner-facing summary with every source named so you can check it. The GDPR leaves significant room for national variation in health data, and the UK began diverging in February 2026. Have your own adviser review anything you intend to rely on.
The short version
A clinical photograph of a patient is special category data under Article 9. Not because a face is biometric, which is a different and narrower thing, but because an image showing a condition and its treatment is data concerning health.
That classification means you need two legal footings rather than one, a lawful basis under Article 6 and a separate condition under Article 9. Most clinics have thought about neither, and most that have thought about it have found only one.
Treating a patient gives you a condition to take the photograph. It does not give you a condition to publish it. Those are two different questions with two different answers.
And the GDPR is not the only rulebook. National medical councils govern how clinicians advertise, and in the United Kingdom the advertising rules on cosmetic injectables are strict enough to change what you do with the images entirely.
Who the GDPR covers
Does the GDPR apply to a small private clinic?
Yes. There is no turnover threshold and no headcount threshold for the GDPR itself. A single-room practitioner established in the EEA is a controller of their patients' data in exactly the same way a hospital group is.
Size changes some obligations, which is covered below, but it never changes whether the Regulation applies.
Does it reach a clinic outside Europe?
It can. Article 3 extends the GDPR to controllers outside the EEA where they offer goods or services to people in the EEA, or monitor their behaviour there.
For clinics this matters most in medical tourism. A practice marketing to European patients, quoting in euros, or running consultations for people who will travel to them is reaching into the EEA, and taking photographs of those patients engages the Regulation. Where the procedure happens is not the only question.
Are we a controller or a processor?
The clinic is the controller. You decide why the photographs are taken and what happens to them. A software vendor that stores them on your behalf is a processor, acting on your documented instructions under an Article 28 contract.
This distinction decides who answers to the patient and who answers to you. A patient exercising their rights goes to the clinic, not to the vendor, which is why your vendor needs to make those rights straightforward for you to honour.
Do we have to keep records of processing if we are under 250 staff?
Yes, and this is the exemption clinics most often rely on wrongly. Article 30(5) relieves organisations with fewer than 250 employees of the record-keeping duty, but it switches off where the processing is not occasional, is likely to risk people's rights, or includes special category data.
A clinic holding patient records fails that test on all three limbs at once. Treat the exemption as unavailable to you, and keep an Article 30 record covering what you hold, why, who sees it, and how long you keep it.
Supervisory authorities have enforced Article 30 against organisations well under the 250 threshold. The exemption is for the business that processes ordinary data occasionally, not for the small business that processes sensitive data all day.
Do we need a data protection officer, or a DPIA?
Both turn on whether your processing of special category data is large scale, a phrase the Regulation uses and does not define.
| Obligation | Where a clinic usually lands |
|---|---|
| Records of processing Article 30 | Required. The small-organisation exemption does not reach special category data |
| Data protection officer Article 37(1)(c) | Usually not required for a single practice. A multi-site group sits closer to the line. Document the assessment either way |
| Data protection impact assessment Article 35 | Required for large-scale special category processing. Recital 91 carves out the individual practitioner treating their own patients. Check your national authority's published list |
| Article 28 contract with vendors | Always required where a third party stores or handles patient data for you |
The honest position is that a solo practice is probably outside the DPO and DPIA requirements and definitely inside the Article 30 and Article 28 requirements. Write the scale assessment down, because the obligation is to be able to demonstrate the conclusion, not merely to reach it.
Why a clinical photograph is special category data
Is a patient photograph biometric data?
Usually not, and this is worth getting right because a great deal of vendor marketing gets it wrong. Recital 51 is explicit that photographs are not automatically sensitive. An image becomes biometric data only when it is put through specific technical processing that allows unique identification of a person.
Storing a photograph, displaying it, and comparing it to a later one by eye are none of those things. Running facial recognition over your library is. So is any feature that matches a face to an identity automatically.
Then why is it special category data?
Because it reveals health. Article 9 protects data concerning health as its own category, entirely separately from biometrics, and a photograph showing a condition, a procedure or its result is data concerning health about an identified person.
The image is protected because of what it shows, not because of whose face it is. Both routes lead to Article 9, and only one of them actually applies to you.
The practical difference is real. If you believe your exposure is biometric, you will look for a technical fix. If you understand it is health data, you will look at consent, retention and access instead, which is where the risk actually sits.
If you add facial recognition, automatic patient matching, or a feature that identifies people from their faces, you have added a second Article 9 category and you will usually need explicit consent for it specifically. This is worth asking any vendor directly before you turn such a feature on.
Does it count as health data if we only use it internally?
Yes. Classification does not depend on what you do with it. A photograph is special category data from the moment it is taken, which is why the device it is taken on matters from that moment too.
The common failure is not a hacker. It is a photograph taken on a staff member's personal phone, which has already entered a consumer cloud account the clinic does not control, in most cases one that replicates outside the EEA, under no Article 28 contract and with no lawful basis for the transfer.
Capture goes directly into the clinic account. Photographs never enter a staff member's camera roll, so they never leave the practice's control in the first place.
Article 6 and Article 9 together
Special category data needs two keys, not one. You need a lawful basis under Article 6 for the processing at all, and separately a condition under Article 9(2) that lifts the general prohibition on handling health data. A clinic that has thought only about consent has usually found one key and assumed it opened both locks.
A lawful basis
For clinical care this is usually contract or legitimate interests. For marketing it is normally consent.
A condition for health data
For clinical care, Article 9(2)(h) covers medical diagnosis and the provision of treatment. For marketing, only Article 9(2)(a) explicit consent will do.
What does that mean in practice?
| What you are doing | Article 6 | Article 9(2) |
|---|---|---|
| Taking photographs for assessment, planning and follow-up | Contract or legitimate interests | (h) medical diagnosis and treatment |
| Keeping them in the patient record | Legal obligation or legitimate interests | (h), with retention justified |
| Showing them to the patient at a later visit | Contract | (h) |
| Publishing them in marketing | Consent | (a) explicit consent, nothing else |
| Using them to defend a complaint | Legitimate interests | (f) legal claims |
Article 9(2)(h) is doing most of the work on this page, and it stops at the edge of clinical care. It does not stretch to advertising, to your website, or to a social post. Marketing needs explicit consent, and explicit consent is a higher bar than the consent you take for treatment.
Publishing a patient's photograph
What makes consent valid?
Article 4(11) requires consent to be freely given, specific, informed and unambiguous, signalled by a clear affirmative action. Article 9(2)(a) adds that for health data it must be explicit, which in practice means a clear written statement rather than an inference from a signature at the bottom of a treatment form.
| Requirement | What it means for a photograph |
|---|---|
| Freely given | Declining has no effect on treatment or price, and the patient knows that |
| Specific | Named purposes and named channels. Not "promotional purposes" |
| Informed | Which images, where they will appear, and that the internet is permanent |
| Unambiguous and explicit | A separate affirmative act for the marketing use, recorded |
| Withdrawable | As easy to withdraw as to give, under Article 7(3) |
A single form where the marketing permission rides along with the treatment consent is not freely given, because the patient cannot decline one without appearing to decline the other, and not explicit, because nothing separates it. Use two documents.
What a patient photo consent form must contain →
Can consent be withdrawn after we have published?
Yes, at any time, and Article 7(3) requires withdrawal to be as easy as giving it was. Withdrawal does not undo processing that was lawful at the time, but it does mean you must stop.
The operational problem is that stopping means finding every copy. A photograph that went to a website, two social platforms, a printed brochure and a conference deck has four afterlives, and a clinic that cannot locate them cannot comply. This is a record-keeping problem long before it is a legal one.
Once the patient signs, the signed form is saved on their record. You then move the best photos to the right album. Every share is written to the audit trail, which is what makes a withdrawal actionable rather than aspirational.
What about the advertising rules on top?
There is no single European regime. Advertising by clinicians is governed nationally, by medical councils and consumer protection authorities, and the rules differ sharply between member states. Several restrict or prohibit testimonials and comparative imagery for regulated professions.
The general direction is consistent even where the detail is not. Before-and-after imagery is treated as a claim about efficacy, and a claim must be capable of substantiation. An image taken under different lighting or at a different distance is a claim you cannot substantiate, whatever you intended.
The United Kingdom is the strictest case, and it is strict enough to change your workflow. See Section 10 →
Access, erasure and the limits of both
Can a patient ask for their photographs?
Yes. Article 15 gives a right of access, and photographs are part of what you hold. You have one month to respond, extendable by two further months where the request is complex, provided you tell the patient within the first month.
You cannot charge for the first copy, and you cannot ask why they want it.
Can a patient demand we delete them?
They can ask, and the answer usually splits in two. This is the most useful thing on this page and almost nobody states it plainly.
Stop, and take it down
Consent was the basis. Withdraw it and the basis is gone, so the publication must end.
Usually stays
Article 17(3) disapplies erasure where processing is needed for a legal obligation, for healthcare under 9(2)(h), or for legal claims.
So a patient who withdraws consent is entitled to have their photograph removed from your Instagram. They are not usually entitled to have it removed from their medical record, because you hold that under a different condition and often under a retention duty.
A refusal is lawful but it still has to be explained, within the same one-month window, with the reason and the right to complain to the supervisory authority. Silence is the breach, not the refusal.
Marketing consent and clinical record retention serve different purposes. If a patient withdraws consent for marketing use, the clinic should stop using their photographs for that purpose where consent is the legal basis. This does not automatically require deletion of photographs that must be retained as clinical records under an applicable legal obligation or other valid legal basis. Confidential patient records go further, hiding a patient entirely from staff who are not authorised.
The 72-hour rule
When do we have to report?
Within 72 hours of becoming aware of it, to your supervisory authority, unless the breach is unlikely to result in a risk to people's rights and freedoms. Where the risk is high, Article 34 also requires you to tell the affected patients without undue delay.
The clock starts when you become aware, not when you finish investigating. An incomplete report filed on time is the expected outcome, and Article 33(4) lets you supply the rest in phases.
A breach involving patient photographs will almost always clear the risk threshold. Health data plus an identifiable face is close to the worst combination the risk assessment contemplates.
What does the report have to contain?
- What happened, and the categories and approximate number of people and records affected
- The likely consequences
- What you have done or propose to do, including anything to mitigate the harm
- Contact details for whoever can answer follow-up questions
Every item above depends on knowing what was accessed and by whom. A clinic that cannot answer that cannot scope the notification, and a report that cannot state the number of affected patients invites the regulator to assume the worst. CureCast records every view, download and share against the staff member, device and timestamp. See how the audit trail works →
You must also document every breach internally, including the ones you decide not to report, with the reasoning. Article 33(5) makes that record itself an obligation.
What a breach can cost
Article 83 sets two tiers, and mishandling health data sits in the higher one.
Whichever is higher. This tier covers the principles in Article 5, lawful basis under Article 6, consent under Article 7, special category data under Article 9, patient rights, and international transfers.
Whichever is higher. The lower tier covers controller and processor obligations: records of processing, security measures, breach notification, and the vendor contract.
In the United Kingdom the equivalent ceilings are £17.5 million or 4%, and £8.7 million or 2%.
The split is more useful than the headline numbers. Publishing a photograph without a valid condition is a higher-tier failure. Failing to keep your Article 30 record is a lower-tier one. Both matter, and if you only have time for one this quarter, the tiers tell you which.
Fines are also only part of it. Supervisory authorities can order processing to stop, which for a clinic can mean taking down a gallery that took years to build.
How long to keep photographs
What period does the GDPR set?
None. This surprises people. Article 5(1)(e) says only that data must be kept in identifiable form no longer than is necessary for the purpose. The Regulation deliberately sets no number of years.
The numbers come from somewhere else: national medical records law, professional body guidance, and your limitation period for negligence claims. These vary significantly between member states, so the retention schedule for a clinic in Dublin is not the one for a clinic in Madrid.
So what do we actually do?
- Write a retention schedule by record type, with the justification for each period named. A schedule you can explain is the deliverable, not a specific number
- Check your national rule for clinical records, then check your professional indemnity insurer's position, which is sometimes longer
- Treat photographs as part of the clinical record, not as an asset to be cleared out when storage runs short
- Record destruction when it happens, because an undocumented deletion is indistinguishable from a loss
A practice that deletes images to save storage while keeping the notes has not retained the record. It has retained part of it, and lost the part a complaint would turn on.
Keeping everything forever is not the safe option either. Storage limitation is a principle in the higher fine tier, and "just in case" is not a purpose.
Sending data outside the EEA
Does patient data have to stay in Europe?
No, and this is widely misunderstood. Chapter V does not require data to stay in the EEA. It requires that when data leaves, the protection travels with it.
There are three routes. An adequacy decision, where the Commission has ruled a country's protection essentially equivalent. Appropriate safeguards, most often the Standard Contractual Clauses, usually with a transfer impact assessment. Or a narrow derogation under Article 49, which is for occasional transfers and is not a foundation for routine ones.
What should we ask a vendor?
- Where is the data stored, and is any copy held elsewhere for backup, replication or disaster recovery?
- Which sub-processors touch it, where are they, and will you be told before that list changes?
- If data leaves the EEA, which Chapter V route applies, and can we see the documentation?
- Is there an Article 28 contract, and does it contain the full set of required terms?
- Can support staff outside the EEA access patient images, under what circumstances, and can we refuse?
- What happens to the data when we leave, and how quickly is it returned or destroyed?
A statement on a web page is not a contractual commitment and it is not Chapter V documentation. Have the answers named in the agreement. As controller, the accountability for the transfer stays with the clinic regardless of what you were told verbally.
What is different in the UK
The UK GDPR started life as a copy of the EU text, and everything above still applies in substance. But the UK began meaningfully diverging in February 2026, and its advertising rules for cosmetic injectables were already the strictest in this guide.
Can we still move data between the EU and the UK?
Yes. The European Commission renewed the UK adequacy decisions on 19 December 2025, running to 27 December 2031. EEA to UK transfers need no additional safeguards for that period.
This replaced the short technical extension granted in June 2025 while the assessment finished. The renewal followed a European Data Protection Board opinion and runs for six years, with the Commission committed to a mid-point review after four years.
Adequacy is reviewable, and the EDPB flagged areas for monitoring including the governance of the Information Commissioner's Office. Practitioners advise keeping fallback documentation in place rather than discarding it. For a clinic this is a watching brief, not a project.
What did the Data (Use and Access) Act 2025 change?
It received Royal Assent on 19 June 2025, and the principal data protection provisions came into force on 5 February 2026. Most of it is aimed at larger organisations, and four points reach a clinic.
| Change | What it means for you |
|---|---|
| Subject access clock new Article 12A | You may pause the one-month period while waiting for a patient to clarify a request. The clock stops rather than running against you |
| Recognised legitimate interests | Five named purposes no longer need a balancing test. None of them covers marketing, so this changes little for a clinic |
| Automated decision-making recast Article 22 | The prohibition now bites mainly on significant automated decisions using special category data. Your photographs are special category data, so if you adopt AI analysis the restriction still applies to you |
| Cookies and PECR | Some analytics and functionality cookies are exempt from consent. PECR fine ceilings rose from the previous £500,000 cap |
From 19 June 2026, section 164A of the Data Protection Act 2018 requires every controller to give people a way to make data protection complaints directly to them, and to acknowledge each complaint within 30 days. Section 164A was inserted by section 103 of the Data (Use and Access) Act 2025. The clinic is the controller, so this applies to you. Check the ICO’s guidance on data protection complaints when you write your procedure.
Why UK advertising rules change your workflow
Botulinum toxin is a prescription-only medicine, and prescription-only medicines cannot be advertised to the public. That restriction is the single biggest practical difference between the UK and every other market in this guide.
The Advertising Standards Authority's position goes further than clinics expect:
- Before-and-after images are read as an efficacy claim, and the ASA's advice is to avoid featuring them in marketing for a prescription-only treatment
- Such imagery is likely to be treated as an implied advertisement for the medicine even with no accompanying words
- Organic social posts count as advertising. You do not have to pay for a post for the Code to apply
- Endorsement of a prescription-only medicine by a health professional or celebrity is separately prohibited
- For treatments that are not prescription-only, the familiar rules apply: consistent lighting, angle and camera settings, no filters and no retouching
So a UK clinic faces the position that the photograph it may not publish is still the photograph it must take and must keep. The clinical case for standardised imaging survives the advertising restriction entirely intact.
That is worth sitting with, because it inverts the usual reasoning. If before-and-after images cannot carry your marketing, their value is clinical: planning, showing an individual patient their own progress in consultation, and evidencing what you did if a complaint arrives. Those uses are untouched by the advertising rules and are exactly what Article 9(2)(h) covers.
The ASA position above is regulator guidance rather than statute, and it is applied case by case. CAP operates a free Copy Advice service for checking material before publication, and serious cases can also involve the MHRA. Use it rather than relying on a summary.
How long do UK clinics keep records?
The UK GDPR sets no period either. The widely adopted benchmark is the NHS Records Management Code of Practice 2021, which many private clinics follow: 8 years after last treatment for an adult, and for a child, until the 25th birthday, or the 26th where treatment ended at 17.
The BMA treats the Code's periods as floors rather than ceilings. Published figures vary by specialty and by source, with some dental and private hospital policies setting considerably longer periods. Confirm the period for your specialty and record the reasoning, rather than adopting a number from a vendor page.
What CureCast does, and does not do
CureCast is clinical photo management. It is not a practice management system, it does not hold your clinical notes, and it is a processor acting on your instructions, never the controller of your patients' data.
| Obligation | What CureCast provides |
|---|---|
| Keep special category data off personal devices | Capture goes directly into the clinic account. Photographs never enter a staff member's camera roll |
| Security of processing Article 32 | AES-256 encryption at rest, TLS in transit, and per-individual access |
| Detect and scope a breach Articles 33 and 34 | Every view, download and share written to an audit trail with staff member, device and timestamp |
| Data minimisation and access control | Module and action-based permissions per staff member |
| Limit access to authorised staff Articles 5(1)(f) and 32 | Confidential patient records, invisible to unauthorised staff |
| Explicit consent, held and evidenced | Customisable consent forms, up to four signatures, stored as a PDF alongside the photographs |
| Right of access Article 15 | A patient's images are retrievable as a set rather than hunted across devices |
| Unedited images, consistent conditions | No editing, filtering or retouching at any point. It uses an earlier patient photograph as a live reference to help reproduce the original positioning, angle and framing. |
Make you compliant. Under the GDPR the controller is the clinic, and accountability under Article 5(2) cannot be outsourced to a vendor. A system can make the obligations achievable and evidenced. It cannot assume them, and any vendor claiming otherwise is describing something the Regulation does not permit.
Sources and what we could not verify
Primary instruments and regulator guidance. Obtain current texts from the issuing authority rather than relying on this page.
- Regulation (EU) 2016/679, in particular Articles 3, 4(11),4(15), 5, 6, 9, 15, 17, 28, 30, 32, 33, 34, 35, 37, 83 and Chapter V
- Recital 51, on photographs and the limits of the biometric category
- Recital 91, on the individual practitioner and the DPIA requirement
- European Data Protection Board, Guidelines 3/2019 on processing personal data through video devices
- UK GDPR and the Data Protection Act 2018
- Data (Use and Access) Act 2025, Royal Assent 19 June 2025, principal data protection provisions commenced 5 February 2026, complaints provision (section 103) commenced 19 June 2026
- European Commission, renewed UK adequacy decisions adopted 19 December 2025, expiring 27 December 2031
- Advertising Standards Authority, advice on botulinum toxin products, and guidance on the marketing of surgical and non-surgical cosmetic procedures
- Committee of Advertising Practice, guidance on genuine before-and-after advertising, and the Copy Advice service
- NHS Records Management Code of Practice 2021, and British Medical Association guidance on retention of health records
- Information Commissioner's Office, guidance on special category data, international transfers and the DUAA
What we could not verify
Stated plainly, because a knowledge page that hides its gaps is not one.
- National derogations under Article 9(4). Member states may impose further conditions on health and biometric data, and we have not surveyed all of them. Check your own jurisdiction
- "Large scale" for the DPO and DPIA thresholds is undefined in the Regulation and is a judgment call. National authorities publish their own DPIA lists
- UK retention figures vary by source and by specialty. The 8-year and age-25 benchmarks come from NHS guidance adopted voluntarily by private clinics, not from the UK GDPR
- A narrow website exception to the prescription-only advertising restriction is referred to in practitioner commentary. We could not confirm its scope and have not relied on it
- National advertising rules across the EEA differ by member state and we have not surveyed them individually
Written by Vishal Parikh, Founder, CureCast. Last reviewed 11 October 2026. For clinics across the EEA and the United Kingdom. Not legal advice, and not reviewed by counsel in any member state or in the UK. The GDPR leaves significant room for national variation in health data, member state advertising rules differ, and the UK began diverging in February 2026. Have counsel review anything you intend to rely on, and obtain current statutory text and current regulator guidance from the issuing authority rather than from any summary, including this one.