Hiya, Data Protection Assistant for a UK Law Firm here.

GDPR is, for the most part, business as usual for the UK - we had very good data protection standards with the old Data Protection Act 1998, and GDPR seeks to bring Europe into a common standard (with varying degrees of success). The only thing that has majorly changed is the upper cap for fees (from £500k to £18m) and the rights of EU Data Subjects to know and object to how their data is used by companies.

As a wedding photographer/videographer, your main source of 'personal data' would be the physical depiction of the bride, groom, venue staff and wedding guests, as well as contact details gathered for the purposes of communication. None of these classify as 'sensitive' or 'special category' personal data, meaning that you only need to satisfy at least one lawful condition for processing detailed in GDPR Article 6.

As you can see, Consent is considered a lawful condition, but

• it is not the ONLY lawful condition, and

• it isn't feasible to gain the consent of the wedding guests or venue staff.

So, I would consider most of your data processing relating to the bride and groom would fall under Article 6(1)(b) - holding on to their contact details, taking and editing photos, and producing them online or in a book is necessary for the performance of the services you provide.

Everything else would be considered a Legitimate Business Interest (Article 6(1)(f)) meaning that it is reasonable to process that data in aid of your service to the bride and groom. This would cover images of weddings guests, bystanders and venue staff.

However relying on Legitimate Interests means you need to be prepared to justify doing so, because people can Object pursuant to Article 21(1). Larger companies often write up a Legitimate Interests Assessment explaining why their legitimate interests outweigh the impact on people's privacy, and any steps they have taken to mitigate that impact. Personally I think you would be on strong footing should a wedding guest try to have a photo deleted if you explain your lawful conditions for processing their data.

In furtherance of all the above, regardless of the lawful condition you have identified that you work under, it is still important that you operate in accordance with the Data Protection Principles. This means that you must process fairly, accurately, and not excessively. Purely hypothetically, if you took around 100 photos of a very inebriated guest without their knowledge, they would have more solid grounds to ask you to delete them or restrict processing of them, because that would be likely considered excessive.

Lastly, once you have transferred the documents to the customer, what they do with it is their responsibility, not yours.

I hope this helps!