POPIA for photographers: what you actually need to do
6 min read · General information, not legal advice
Quick answer
Under POPIA, a recognisable photo of a person is personal information. You need a lawful reason to process it, you must keep it secure, and you should get written consent before using client images in your portfolio, website or ads.
Get consent in your contract
Add a clear opt-in for portfolio and marketing use to your photography agreement, and use a model release for anyone who isn't your client.
Secure your galleries
Use password-protected online galleries, two-factor authentication on cloud storage, and back up drives securely.
Have a privacy policy
If your website has a contact form or booking form, you're collecting personal information and need a POPIA privacy notice naming your Information Officer (usually you).
Register your Information Officer
Register with the Information Regulator — it's free and done online.
Delete what you don't need
Set a retention period for raw files and client details, and stick to it.
