Drones equipped with cameras capture vast amounts of visual data. When that data includes identifiable people, you're subject to GDPR (General Data Protection Regulation). The Dutch Data Protection Authority (AP - Autoriteit Persoonsgegevens) enforces strict rules. This guide explains your obligations.

Key Principle: Drones = Data Processing Devices

Critical realization: A drone with a camera is not just a flying deviceโ€”it's a data processing tool. GDPR applies when:
  • Drone captures images/video of identifiable people
  • Data is recorded, stored, or transmitted
  • Data is used for any purpose (even if not shared)

GDPR does NOT apply when:
  • Only aerial/overhead photos (no identifiable people visible)
  • Complete anonymization (impossible to identify anyone)
  • Private property, non-public area (limited consent requirements)

    •

    AP Guidelines for Drone Operations

    The Dutch Data Protection Authority (AP) published official guidance in 2024:

    Guideline 1: Purpose Limitation

    Before flying, ask: "Why am I collecting this data?" Valid purposes:
    • โœ… Surveying (purpose is clear: mapping)
    • โœ… Event coverage (purpose: create video record)
    • โœ… Inspection (purpose: diagnose condition)
    • โœ… Research (purpose: study phenomenon)

    Invalid purposes:
    • โŒ "General monitoring" (vague, too broad)
    • โŒ "Surveillance" (implies ongoing tracking)
    • โŒ "Data collection for future use" (open-ended)

    Practical application: Document your purpose in writing before flying.

    Guideline 2: Data Minimization

    Collect only what you need. Don't record more than necessary. Examples:

    Operation Minimal Data Excessive Data
    Roof inspection Close-up of roof only Entire neighborhood visible
    Event filming Event stage + immediate crowd Parking lots, distant buildings
    Agricultural surveying Crop field only Neighboring farms, roads
    Property valuation Building exterior + grounds Neighboring properties

    Rule: If someone's privacy isn't necessary for your stated purpose, don't capture it.

    Guideline 3: Transparency & Notification

    People must know they're being filmed. How to notify:
    1. Visible signage โ€“ "Drone filming in progress" signs at entry points
    2. Verbal announcement โ€“ For events, announce before/during filming
    3. Privacy notice โ€“ If footage used publicly, include disclosure
    4. Data processing statement โ€“ Explain how data will be handled

    Failure to notify = GDPR violation, even if you don't use the data.

    Guideline 4: Consent & Legitimate Interest

    Two paths to justify data processing: Path 1: Explicit Consent
    • Get written permission from all identifiable people
    • Consent must be informed (they know what you're filming)
    • Consent must be voluntary (not coerced)
    • Consent is easiest defense (shows you're compliant)

    Path 2: Legitimate Interest
    • Demonstrate your interest > privacy interest
    • Examples: Roof inspection (your interest in building condition > occupant's privacy interest)
    • More complex legally; requires documented reasoning

    GDPR Compliance Framework for Drone Operations

    Step 1: Data Protection Impact Assessment (DPIA)

    For any operation involving identifiable people, conduct a DPIA:
    1. What personal data is collected? (Names? Faces? Locations?)
    2. Who collects it? (Your company, contractor, etc.)
    3. How is it used? (Stored, shared, analyzed?)
    4. What are the risks? (Unauthorized access, data breach, misuse?)
    5. What protections exist? (Encryption, access controls, retention limits?)

    Documentation: Write a 2-3 page DPIA report (helps with AP audit defense).

    Step 2: Data Processing Agreement (DPA)

    If working with contractors/clients, use a DPA: Example: You're a surveying company hired by property developer Your DPA must specify:
    • What data is collected (building exterior photos + RGB orthomosaic)
    • Who processes it (your company = processor)
    • Who owns it (developer = controller, data owner)
    • How it's protected (encryption, access logs, 90-day deletion)
    • Liability if breach occurs (insurance, indemnification)

    Consequence of missing DPA: Joint liability for GDPR violations.

    Step 3: Data Retention Policy

    Don't keep data longer than necessary. Recommended retention periods:

    Data Type Retention
    Event footage 30 days (deleted after event video produced)
    Inspection photos 90 days (until report approved)
    Survey data As specified by client contract (typically 12 months)
    Backup/archive 7 years (if required by law, e.g., construction records)

    Best practice: Automatic deletion (set timers in storage system).

    Step 4: Security Measures

    Protect data from unauthorized access. Technical controls:
    • Encryption in transit (video upload via HTTPS)
    • Encryption at rest (hard drives encrypted, password-protected)
    • Access controls (only authorized staff can view)
    • Audit logs (track who viewed data, when)

    Organizational controls:
    • Employee training (staff understand privacy obligations)
    • Data breach protocol (notification procedure if hacked)
    • Vendor review (if using cloud storage, verify their security)

    Real-World Compliance Examples

    Example 1: Wedding Videography โœ… COMPLIANT

    Operation: Film 100-person wedding ceremony + reception Compliance steps:
    1. Consent: Get written permission from couple (as data controller)
    2. Notification: Announce to guests "Drone filming in progress" before flight
    3. Purpose: Document ceremony (clear, specific)
    4. Data handling: Deliver final video to couple, delete raw footage after 30 days
    5. DPIA: Simple form noting: identifiable people, limited distribution, 30-day retention

    Example 2: Neighborhood Surveillance (Attempted) โŒ NON-COMPLIANT

    Operation: Municipality wants drone to fly over residential neighborhood weekly to monitor quality of life Problems:
    1. โŒ Vague purpose ("quality of life" is undefined)
    2. โŒ No notification (residents unaware of weekly surveillance)
    3. โŒ No consent (residents didn't authorize)
    4. โŒ Excessive data (capturing people's homes, gardens, daily routines)
    5. โŒ No justification (municipality can't claim "legitimate interest" over residents' privacy)

    Result: โŒ GDPR violation, AP would prohibit Fix: If municipality wants surveillance, must:
    • Define specific purpose (e.g., "Identify illegal dumping in parks")
    • Notify residents (public announcement, signage)
    • Obtain consent OR demonstrate compelling public interest (court-approved)
    • Limit data (only relevant areas, not all residences)

      •

      Example 3: Roof Inspection โœ… COMPLIANT

      Operation: Drone inspects residential property for damage assessment Compliance steps:
      1. Consent: Homeowner explicitly requests inspection (implicit consent)
      2. Minimization: Capture only roof area (not neighboring properties, street)
      3. Purpose: Diagnose roof condition (clear, specific)
      4. Data handling: Provide inspection report to homeowner, delete video after 7 days
      5. DPIA: Simple form noting limited scope, single-use purpose

      Consent Form Template

      Use this for commercial operations involving identifiable people:

      `` DRONE FILMING CONSENT FORM Event/Operation: [Name] Date: [Date] Location: [Address] I consent to having my image/likeness recorded by drone during the above event. I understand:

      • Filming is for the purpose of [specify: event coverage/documentation/promotional use]
      • My data will be retained for [specify: 30 days/as agreed]
      • I may withdraw consent by contacting [name, email, phone]
      • I have the right to request access to my data or deletion

      Signed: _________________ Date: _________ Name (print): _________________ Contact: _________________ (email/phone)       `

      Best practice:
      • Use for all commercial operations (weddings, events, filming)
      • Collect signatures before flights
      • Keep signed forms on file (2+ years minimum)
      • Reference form in incident response if questioned by AP

        •

        Data Breach Notification

        If hacked or data accidentally shared, you must notify AP and affected people.

        Mandatory Notification Steps

        1. Assess severity โ€“ Is breach serious? (Names/faces leaked = yes; aerial photos of buildings = no)
        2. Notify AP within 72 hours โ€“ https://www.autoriteitpersoonsgegevens.nl (report form)
        3. Notify affected people โ€“ Email/letter explaining:

        • What data was compromised
        • What you're doing to fix it
        • How they can protect themselves

        1. Document response โ€“ Keep records (AP may investigate)

        Notification Example

        ` INCIDENT NOTIFICATION We experienced a data breach affecting your drone video footage from [date]. Details:

        • Type of data: Video file (identifiable faces)
        • Who accessed: Unknown third party (hacker)
        • When discovered: [date]
        • Actions taken: Videos deleted, storage encrypted, contractor notified

        Your rights:

        • You may request deletion (write to [email])
        • You may file complaint with Autoriteit Persoonsgegevens
        • You may seek damages if harmed

        We sincerely apologize.         ``

        Penalties for GDPR Violations

        Violation Fine Notes
        Flying without notification โ‚ฌ10,000-50,000 First offense; more severe if repeated
        No consent (when required) โ‚ฌ15,000-75,000 Deliberate violation worse
        Data breach (unreported) โ‚ฌ20,000-100,000+ Failure to notify AP within 72 hours
        Excessive data collection โ‚ฌ10,000-50,000 Filming more than necessary
        No retention policy โ‚ฌ5,000-30,000 Keeping data indefinitely
        Unauthorized sharing โ‚ฌ25,000-100,000+ Selling/sharing data without permission

        Piyo's Beginner Path ๐Ÿฃ

        You're just starting and want to comply with privacy rules.
        1. Get basic understanding: Read this guide + AP's official guidance (1 hour)
        2. For each operation:

        • Document purpose (write it down: "Wedding footage capture")
        • Notify people (announcement or signage)
        • Get consent if possible (signed forms for commercial work)
        • Minimize data (capture only what you need)
        • Delete timely (30-90 day policy)

        1. Keep records: Save consent forms, retention policies, notifications
        2. Annual review: Update policies annually (AP updates guidance regularly)

        Poppo's Expert Path ๐Ÿฆ‰

        You're scaling and need enterprise-grade compliance.
        1. Hire Data Protection Officer (DPO) โ€“ External consultant (โ‚ฌ2,000-5,000/year)
        2. Conduct formal DPIAs โ€“ For every operation type (โ‚ฌ1,000-3,000 each)
        3. Implement technical controls:

        • Encrypted storage (cloud provider with EU data centers)
        • Access logging (who views data, when)
        • Automatic deletion (timers, retention policies)
        • Incident response system (breach notification protocol)

        1. Develop privacy-by-design procedures:

        • All new services: DPIA before launch
        • Client contracts: standardized DPA clauses
        • Employee training: annual GDPR update

        1. Maintain compliance evidence:

        • Document all DPIA assessments
        • Keep consent forms (7 years minimum)
        • Log all data processing activities
        • Record breach investigations (if any)

        Annual cost: โ‚ฌ5,000-15,000 (DPO, training, audits)

        Common Questions

        "Can I record drone footage from public space (street, park)?"

        Legally: Yes, public places = lower privacy expectations. However, if identifiable people visible, GDPR still applies (you need consent or legitimate interest). Practical: If faces/identifying features visible, treat as private data requiring consent.

        "Can I use drone footage for promotional purposes without consent?"

        No. If using for ads/marketing, you absolutely need explicit consent (or legitimate interest, hard to justify). Commercial use = higher privacy expectation.

        "What's the difference between Dutch privacy law and GDPR?"

        GDPR is EU-wide regulation. Netherlands has no separate national privacy law (GDPR is the standard). AP enforces GDPR in Netherlands.

        "Can I share drone video with insurers/contractors?"

        Only with DPA in place. If you're data processor (acting for client), you must have Data Processing Agreement defining what can be shared, how it's protected.

        "What if I anonymize drone footage (blur faces)?"

        Anonymization is legal solution. If you can't identify people in footage, GDPR doesn't apply. However, true anonymization (impossible to re-identify) is technically difficult. Safe approach: assume data is identifiable until proven otherwise.

        "Do I need consent for overhead agricultural photos (no people visible)?"

        No. If no identifiable people in photos, GDPR doesn't apply. However, landowner privacy considerations exist (depends on context).

        "What if someone asks me to delete drone footage?"

        Key Resources

        • AP Guidance on Drones โ€“ https://www.autoriteitpersoonsgegevens.nl/drone-privacy (official AP rules)
        • GDPR Text โ€“ https://gdpr-info.eu (full regulation with commentary)
        • AP Data Processing Agreements โ€“ https://www.autoriteitpersoonsgegevens.nl/dpa-templates (ready-made forms)
        • Dutch Privacy Law (AAA) โ€“ Information about Dutch Administrative Appeals (appeals process if AP fines you)

          •

          What MmowW Does for You

          MmowW automates privacy compliance:

          โœ… Consent form generation โ€“ Auto-populated, signable via app โœ… DPIA templates โ€“ Pre-formatted for common operations โœ… Data retention reminders โ€“ Automatic deletion timers โœ… Notification procedures โ€“ Incident response checklist โœ… Compliance calendar โ€“ Privacy policy review reminders โœ… Audit trail โ€“ Logs of all data access, deletions

          Cost: โ‚ฌ6.08/drone/month

          FAQ

          Q: Is facial recognition allowed on drone footage?

          A: Only with explicit consent. Facial recognition = special category data (high risk). AP strongly discourages without compelling public interest.

          Q: Can I use thermal imaging without consent?

          A: Thermal imagery is less identifying (can't see faces clearly), but still captures personal space (people's homes). Consent/legitimate interest still required.

          Q: What's AP's stance on drones in general?

          A: AP views drones as privacy-sensitive (report published 2023: drones require "careful consideration" of privacy). Compliance expected, violations actively prosecuted.

          Q: Do I need AP approval before flying?

          Last updated: April 2026 Next review: July 2026 (AP guidance updates, case law)

          Contact MmowW for privacy compliance consulting.