UK GDPR and Drone Photography

What UK GDPR Says About Drone Imagery

The UK General Data Protection Regulation, retained in domestic law after Brexit and supplemented by the Data Protection Act 2018, defines personal data as any information relating to an identified or identifiable living individual. Photographs and video footage captured by a drone can constitute personal data when faces, vehicle registration plates, or other identifying features are visible.

Under Article 4(1) of UK GDPR, even partial identification counts. If footage can be combined with other data to identify a person, it falls within scope. The Information Commissioner's Office (ICO) has specifically addressed drone use in its guidance, confirming that drone operators who capture identifiable images are acting as data controllers.

The Domestic Purposes Exemption

Section 2(1)(c) of the Data Protection Act 2018, read alongside Recital 18 of UK GDPR, provides an exemption for processing carried out by an individual in the course of a purely personal or household activity. If you fly a drone to photograph your own garden for personal memory-keeping, this exemption is likely to apply.

However, the exemption is narrow. The ICO has made clear that the moment footage is shared on social media, uploaded to a public platform, or used for any commercial purpose, the domestic purposes exemption no longer applies. Similarly, if your drone systematically surveys a neighbourhood or captures footage of numerous individuals in a public space, a tribunal may find that the activity goes beyond what is genuinely personal or household in nature.

Establishing a Lawful Basis

Where the domestic purposes exemption does not apply, you must identify one of the six lawful bases set out in Article 6(1) of UK GDPR before processing personal data through drone photography. The most commonly relied upon bases for drone operators are:

• Legitimate interests (Article 6(1)(f)): This is the most frequently used basis for drone photography. You must conduct a three-part Legitimate Interests Assessment (LIA): identify the legitimate interest, demonstrate that processing is necessary to achieve it, and balance it against the rights and freedoms of the data subjects. Aerial photography for landscape documentation, property surveys, or journalism may qualify.
• Consent (Article 6(1)(a)): Obtaining meaningful consent from every individual captured in drone footage is often impractical, particularly in public spaces. Where consent is used, it must be freely given, specific, informed, and unambiguous.
• Public task (Article 6(1)(e)): This applies primarily to public authorities or those exercising official functions, such as emergency services using drones for search and rescue.

Data Minimisation and Storage

Article 5(1)(c) of UK GDPR requires that personal data be adequate, relevant, and limited to what is necessary. For drone operators, this means:

• Avoid capturing more footage than needed for your stated purpose.
• If you only need images of a building, adjust altitude and camera angle to exclude identifiable individuals where possible.
• Blur or anonymise faces and registration plates in post-production before sharing or publishing footage.
• Delete raw footage containing personal data once it is no longer needed for your purpose.

Article 5(1)(e) imposes storage limitations. Personal data must not be kept in a form that permits identification for longer than is necessary. Retaining drone footage indefinitely on a hard drive without a clear retention policy may constitute a breach.

Transparency and Subject Access Rights

Under Articles 13 and 14 of UK GDPR, data subjects have a right to know that their data is being processed. For drone operators, fulfilling this obligation can be challenging, but the ICO expects reasonable steps. Practical measures include displaying signage at the flight location indicating that drone filming is in progress, and providing contact details for data subject enquiries.

Data subjects also have the right of access under Article 15. If an individual requests a copy of footage in which they appear, you must respond within one calendar month. They may also exercise the right to erasure under Article 17 if there is no overriding lawful basis for continued retention.

What Happens If You Breach UK GDPR

The ICO has the power to investigate complaints and take enforcement action against drone operators who breach UK GDPR. Penalties can be substantial:

• Standard maximum: Up to 8.7 million GBP or 2% of annual global turnover, whichever is higher, for breaches of obligations such as data minimisation or storage limitations.
• Higher maximum: Up to 17.5 million GBP or 4% of annual global turnover, whichever is higher, for breaches of lawful basis requirements, conditions for consent, or data subject rights.

Beyond financial penalties, the ICO may issue enforcement notices requiring specific actions, or reprimands. In serious cases involving deliberate surveillance, individuals affected may also pursue civil claims for compensation under Section 168 of the Data Protection Act 2018.

Practical Steps for Compliant Drone Photography

1. Before each flight, assess whether your footage is likely to capture identifiable individuals.
2. Determine whether the domestic purposes exemption applies honestly and narrowly.
3. If processing personal data, identify and document your lawful basis before you fly.
4. Conduct a Legitimate Interests Assessment if relying on Article 6(1)(f).
5. Minimise data capture: adjust altitude, angle, and resolution where practicable.
6. Post-process footage to blur or anonymise identifiable features before publication.
7. Set a clear retention schedule and delete footage containing personal data when no longer needed.
8. Be prepared to respond to subject access requests within one calendar month.
9. Consider displaying signage at the flight location to meet transparency obligations.
10. Keep records of your processing activities as required by Article 30 of UK GDPR.

Common Misconceptions

"I am flying in a public place, so GDPR does not apply." The location does not determine whether UK GDPR applies. What matters is whether identifiable personal data is captured, regardless of whether the subject is in a public or private space.

"I am a hobbyist, so data protection law does not apply to me." Recreational use may fall within the domestic purposes exemption, but only if the footage remains genuinely personal. Sharing on social media or YouTube removes this exemption.

"Consent is always required." Consent is only one of six lawful bases. Legitimate interests is often more appropriate and practical for drone photography, provided a proper balancing exercise is conducted.