Taking and displaying pupil photos and information

There are no hard and fast rules under the UK GDPR on displaying pupil photos or other information, but you must have a 'lawful basis' for using personal data. Find out when you do and don't need to ask for consent, and use our practical examples to work out how to stay compliant.

Updated
on 29 June 2026
See updates
School types: AllSchool phases: AllRef: 34588
Contents
  1. Work out your 'lawful basis' for displaying the data
  2. When you don't need consent
  3. When you do need consent
  4. Always consider the safeguarding risks 
  5. Only display the necessary information

Work out your 'lawful basis' for displaying the data

Personal data you display about your pupils on the walls of classrooms, offices or medical rooms might include pupils': 

When you don't need consent You don't need consent if you can justify the task with 1 of the other 6 lawful bases (or reasons) for processing personal data under the UK GDPR.   The 'public task' basis is the one you'll most likely use if displaying the information is necessary to fulfil your function as a school (e.g. an essential part of teaching and learning, or it helps to keep pupils safe). Note that, even if you can justify the task with 1 of the lawful bases, pupils and parents/carers can opt out of having their images used. You must consider each opt-out request in line with their right to object. In some cases, your duties might override their right to object (e.g. using their photo for your