Sub-250g Drone Privacy Rules in the UK

Why Privacy Matters Even for Small Drones

The physical size and weight of a drone have no bearing on its privacy implications. A sub-250g drone equipped with a high-resolution camera can capture the same level of detail as a larger aircraft. From a data protection perspective, the relevant factor is not the weight of the drone but whether the images or footage it captures constitute personal data.

Personal data, under UK GDPR, means any information relating to an identifiable living individual. A photograph showing a person's face, a vehicle registration plate visible in a video frame, or even distinctive clothing that identifies someone in context — all of these create personal data that triggers data protection obligations.

The Legal Framework

Three main pieces of legislation govern drone privacy in the UK:

UK GDPR

The UK General Data Protection Regulation sets out the principles for processing personal data. If your drone captures personal data, you must have a lawful basis for processing it, use it only for specified purposes, keep it secure, and not retain it longer than necessary. The six lawful bases include consent, legitimate interests, and the domestic purposes exemption for purely personal use.

Data Protection Act 2018

The DPA 2018 supplements UK GDPR with additional provisions specific to the UK. It sets out the domestic purposes exemption in detail: processing personal data for purely personal, family, or household purposes is largely exempt from the full requirements of UK GDPR. However, publishing images online, sharing them commercially, or using them for any business purpose falls outside this exemption.

Human Rights Act 1998

Article 8 of the European Convention on Human Rights, as incorporated by the Human Rights Act, protects the right to respect for private and family life. Drone operations that intrude into areas where people have a reasonable expectation of privacy — particularly homes and gardens — can engage Article 8 rights and give rise to civil claims.

Reasonable Expectation of Privacy

The concept of reasonable expectation of privacy is central to assessing whether drone operations infringe on individuals' rights. UK courts and the ICO consider several factors:

• Location: People have the strongest expectation of privacy in their homes and gardens. The expectation decreases in public spaces but does not disappear entirely.
• Activity: Intimate or sensitive activities (sunbathing, family gatherings, medical treatments) attract stronger privacy protection than routine public behaviour.
• Visibility: If an area is not visible from ground level but is exposed to aerial observation, the fact that you can see it from a drone does not eliminate the privacy expectation.
• Persistence: A single flyover is treated differently from repeated or systematic monitoring of the same area.

ICO Enforcement Powers

The Information Commissioner's Office has the authority to investigate complaints about drone-related privacy breaches. Enforcement actions can include:

• Information notices requiring you to provide details about your data processing activities.
• Enforcement notices ordering you to stop processing personal data in a particular way.
• Penalty notices imposing fines for serious breaches of UK GDPR. While the maximum fine under UK GDPR is substantial, the ICO typically issues proportionate penalties considering the nature and severity of the breach.
• Assessment notices allowing the ICO to audit your data protection practices.

In practice, most drone privacy complaints from members of the public result in the ICO providing guidance and seeking voluntary compliance rather than imposing fines. However, repeated or egregious breaches — particularly involving deliberate surveillance of individuals — can lead to formal enforcement action.

Neighbour Disputes and Drone Privacy

One of the most common sources of drone privacy complaints involves neighbours. Flying a drone over or near a neighbour's property, particularly if images or video are captured, can rapidly escalate into a formal dispute. Practical steps to avoid such situations include:

• Informing nearby residents before flying in residential areas, where practical.
• Keeping your camera pointed away from neighbouring gardens and windows.
• Being responsive to concerns — if a neighbour asks you to stop recording near their property, consider their request seriously.
• Avoiding hovering in positions that give a direct view into private spaces.

Your Obligations as a Data Controller

If your drone captures personal data outside the domestic purposes exemption, you are a data controller under UK GDPR. Your obligations include:

• Identifying a lawful basis for processing (most commonly legitimate interests for photography or videography).
• Being transparent about what data you collect and why — a privacy notice on your website is good practice.
• Responding to subject access requests within one calendar month.
• Deleting personal data when it is no longer needed for its original purpose.
• Reporting certain types of data breaches to the ICO within 72 hours.
• Keeping records of your processing activities if you operate commercially.

Practical Privacy Checklist

• Before flying, assess whether your planned route or recording area is likely to capture identifiable individuals or private spaces.
• Use the minimum camera resolution and field of view necessary for your purpose.
• Review all footage before sharing and blur or remove identifiable details.
• Store footage securely and set a retention schedule — delete what you do not need.
• If someone asks to be removed from your footage, respond promptly and respectfully.
• For commercial operations, maintain a written privacy policy and flight log.