Photo archiving and data protection: a guide for photographers

After a few seasons, most photographers face two questions: how long do I keep all these files, and what am I allowed to do with photos of people? The first is about storage and risk, the second about law and trust. Here is a practical framework for both.

How long to keep originals

No law sets a retention period for the photos themselves. You choose it — what matters is that it's written in the contract and that you honour it. Tell clients at delivery when the gallery expires and how long you keep originals, and ask them to save their photos in two places.

The 3-2-1 backup rule

1. 1

   3 copies

   The working copy plus two more. Don't format cards until two copies exist in different places.

2. 2

   2 different media

   For example an internal SSD and an external drive or NAS. Two partitions on one disk are not two copies.

3. 3

   1 off-site copy

   Cloud storage or a drive kept elsewhere, so fire or theft can't take everything.

Shoot to dual cards when you can, copy the same night, test restores regularly and encrypt portable drives — a lost drive of client photos is a personal data breach. An online gallery can be one of the copies: Captures keeps originals in EU data centres (Germany and Finland) with a backup copy, but one service should never be your only copy.

Data protection basics

A photo of an identifiable person is personal data. In Serbia the Law on Personal Data Protection (ZZPL) applies, closely aligned with the GDPR; the GDPR itself may apply if you work with or target EU clients. Shooting under a contract usually rests on performing that contract, while publishing in your portfolio or on social media typically needs separate, specific consent — a dedicated checkbox, not small print. Clients can access, correct and erase their data and withdraw consent. Choose gallery and cloud services that support export and erasure, and secure accounts with strong passwords and two-factor authentication.

Minors

• Get written consent from a parent or guardian, especially for any public use.
• Keep galleries with children private and password-protected.
• Never publish a child's full name, school or location alongside photos.
• Don't use face recognition on galleries that include minors.

Face recognition and consent

Find-yourself features are handy at large events, but face recognition processes biometric data — a special category under both the ZZPL and the GDPR — so explicit consent from each person is generally required. In Captures, the Find me search only works if the studio enables it and each guest explicitly consents; the selfie isn't stored, and it is never available for galleries with minors.

A deletion plan

Once a year, review your archive. Remind clients to download their photos, then delete expired shoots from every copy, cloud included, or move consented images into your portfolio. You keep your promises, save space and reduce risk.