GDPR and photos of children in nurseries: a plain-English guide for managers

Under both UK GDPR and EU GDPR, a photograph of an identifiable child is personal data. That's the starting fact — and it's less frightening than it sounds. It doesn't mean you can't share photos with parents. It means you need to be able to answer six questions about how you do it.

The six questions

1. What is your lawful basis?

For sharing photos with the child's own family through an app, and for any public use, consent is the usual basis. For internal documentation and assessment, settings often rely on public task (maintained/state settings) or legitimate interests (private settings), but check your own status. Write the basis down in your privacy notice; don't leave it implied.

2. Is your consent valid?

Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. In practice that means:

• Tiered choices — family-only, group, public — not one blanket box.
• Named channels — ‘shared through [app name]’, ‘posted on our Instagram’ — not ‘for nursery purposes’.
• No bundling with enrolment — a parent must be able to enrol and still say no to photos.
• A written withdrawal route with a timeline.

Our school photo consent policy template has wording for all four.

3. Who processes the data, and under what contract?

If an app stores the photos, the vendor is your processor and you need an Article 28 data-processing agreement (in Germany, an Auftragsverarbeitungsvertrag, AVV). It should cover instructions, confidentiality, security, sub-processors, international transfers, breach notification, deletion at end of contract and audit rights. A vendor that can't produce one is a red flag. Oyku's is available on request via our Trust Center.

4. How is the data secured?

• Encryption in transit and at rest
• Role-based access — a practitioner sees their rooms, not the whole setting
• No images stored in personal phone galleries
• Approval before anything is visible to parents (a security control as much as a quality one)
• Audit logs of who shared what, when

5. How long do you keep it, and how do families exercise their rights?

Set a retention period (enrolment plus a defined number of months is common), write it down, and make sure the system actually deletes. Families have rights of access, rectification, erasure and portability — a good tool lets a parent export their own child's content and lets you delete on request without a support ticket.

6. Do you need a DPIA?

A Data Protection Impact Assessment is required where processing is likely to result in high risk — and regulators consider children's data and systematic monitoring as risk indicators. Introducing a new photo-sharing system across a nursery is a reasonable trigger. It's a structured document, not a legal ordeal; many vendors provide a template.

Special cases

Group photos

A group photo shared to a family contains other children's personal data. Share it only to the families of children with group consent; exclude opted-out children from the frame or from the share. Software that enforces this automatically — as Oyku does — is far safer than staff remembering who is who.

Public use and social media

Requires explicit public consent per identifiable child and a second approval. Default it to off. Several EU municipalities and Nordic countries follow ‘no identifiable children in public’ norms; respect the strictest expectation among your families.

Separated parents

Both legal guardians are normally entitled to their child's data. Your system should support multiple guardians per child without exposing them to each other, and you should have a process for court orders that restrict access.

Facial recognition and ‘find my child’ features

Biometric processing is special category data under GDPR. Treat any face-matching feature as separate, explicit consent with its own DPIA — or avoid it. Oyku's per-child tagging is done by the teacher, not by biometrics.

Questions to ask any app vendor