A GDPR checklist for event organisers using face search

Selfie search is now something participants expect at races, sportives and festivals. It's also face recognition, which brings duties under the GDPR and the UK GDPR that a gallery of thumbnails never did. Our article on GDPR and face recognition at events explains the law in plain words. This page turns it into a checklist for organisers: what to do before, during and after an event that offers face search, using Photohawk Studio as the example of how a platform handles its part.

Before you decide: is face search right for this event?

Decide per event, and per gallery:

• Adult mass-participation events (road races, sportives, triathlons) are where selfie search is most useful, because numbers are often hidden.
• Junior races, school events and anything with many children deserve a harder look. You may decide the gallery runs on bib search and browsing only. On Photohawk, selfie search can be switched off for any gallery, and everything else keeps working.
• Sensitive events (health charities, some community events) may also suit a gallery without face search.

Write the decision down, with the reason. If anyone asks later, you'll be glad you did.

Step 1: tell people before the event

Participants should know before they take part. Put a short, plain notice in:

1. The registration page and entry terms: photos will be taken; galleries can be searched by face; who provides the service; how long face data is kept; how to opt out.
2. The pre-event email: one or two lines and a link.
3. Your privacy notice: a section on event photos, linking the platform's face data policy.

A good test: could a participant reading it on a phone in a minute say what happens to their face and how to say no?

Step 2: consent for the person searching

The person taking a selfie chooses to search. On Photohawk, face search runs only with that person's consent, they can withdraw it at any time, and the selfie is used for that one search and then discarded. It isn't stored and isn't used to create a face template.

Step 3: think about everyone else in the photos

Everyone in a searchable gallery has their face indexed, including people who never search: other participants, spectators, marshals. They're the group to think hardest about, because they may not know it's happening. Your pre-event notice covers participants; signs at the start and finish can help with spectators and volunteers.

Step 4: offer another way to find photos

Nobody should have to use face search to get their photos. Make sure the gallery also offers:

• Bib number search, read from the photos, with no face data involved;
• Time search and browsing by collection.

On Photohawk all of these are on every plan, so someone who opts out of face search can still find and buy or download their photos. See bib number search.

Step 5: make opting out easy

One clear route, honoured quickly:

• In the gallery: selfie search, then Make a request.
• By email: support@photohawk.com, naming the event or gallery.

On Photohawk, the person's face data is deleted within 30 days and those photos aren't indexed for face search again. Their photos stay in the gallery; removing a photo altogether is a separate request to the gallery's owner. Put the opt-out route in your notices and in the photos email.

Step 6: know the time limits

Face data is only needed while people are looking for their photos. From 1 November 2026, Photohawk deletes it automatically:

• at the latest 12 months after each photo is uploaded;
• 30 days after a gallery is closed or its selfie search is switched off;
• within 30 days of a request.

Deleting face data never deletes a photo: bib search, browsing, sales and downloads carry on. What changed on 1 November 2026 explains why the limit is 12 months.

Step 7: agree who does what

The organiser, the photographer and the platform each play a part. Your contracts and privacy information should say:

• who decides how face data is used, and who processes it on another's behalf;
• who writes and publishes the participant notice;
• who handles deletion requests and questions.

Agree it before the event, not after a complaint. Our page on choosing an event photography partner lists the other questions to ask.

After the event

• Link the policy in the photos email as well as at registration.
• Close galleries you no longer need. Face data for a closed gallery is deleted within 30 days.
• Keep a short record of what you told participants and when.

The checklist

• Face search decided per gallery, with reasons, especially for children.
• Notice in the registration page, entry terms and pre-event email.
• Privacy notice links the face data policy.
• Bib search and browsing available to everyone.
• Opt-out route published and honoured within 30 days.
• Time limits understood; unneeded galleries closed.
• Roles agreed in writing with your photographer.
• Your notice checked by someone qualified.

Photographers setting up galleries for organisers can create a free Studio account; selfie search is on every plan and can be switched off for any gallery.