Consent is a yes. A model contract is an agreement.
A consent form records a person’s permission for specific processing of personal data. A model agreement can govern participation, payment and the agreed use of photos or video.
The content and circumstances – not the document’s name – determine which legal basis you can rely on.
When you base the use on consent
Consent must be freely given, specific, informed and unambiguous. The person must understand what they are agreeing to and be able to withdraw consent.
A student appears in a video
You want to use the video on the school website and social media. If consent is your legal basis, these purposes and channels must be clearly stated, and the student must have a genuine choice without negative consequences for saying no.
Pay particular attention to whether consent is freely given where there is an imbalance of power, such as with employees or students.
When you agree on professional participation
A planned campaign may require more than permission to use a photo. A model agreement can describe the assignment, fee, usage period, channels and any exclusivity.
A model is hired for an advertising campaign
The agreement sets out the shoot date, payment and use of the material in specified advertisements for two years. This gives both parties a shared understanding of the deliverables and their limits.
A contract is not a shortcut around GDPR. If processing is based on performance of a contract, it must be necessary to fulfil the agreement with that person. Simply including a use in the contract is not enough.
Source: Danish Data Protection Agency: When may you process personal data?
Can someone withdraw their permission?
Where consent is the legal basis, it can be withdrawn. You must then stop the processing that relies on it. Withdrawal does not retrospectively make earlier processing unlawful.
Where processing is lawfully based on a contract, the consent-withdrawal rule does not apply in the same way. The Danish Data Protection Agency reached this conclusion in a specific model-agreement case. This does not mean all model agreements are irrevocable or that other GDPR rights disappear. Termination and continued use must be assessed against the agreement and relevant rules.
Sources: Guidance on consent and Danish Data Protection Agency: Model agreement – consent or contract?
Clarify four things before sending the document
- What is the project?Is this voluntary participation or an agreed production with specific deliverables?
- How will the material be used?Write down the purposes, channels and duration. Consider advertising and later reuse too.
- Which legal basis fits the processing?Assess the legal basis separately. Payment or a signature does not decide the question on its own.
- How will you find the agreement again?Store the document with details of the person, material and agreed use.
Seek specific legal advice if you are unsure about the agreement’s scope. Standard wording should always be adapted to the actual project.
Make documentation easier to find
See how PhotoConsent can support collecting and managing consent and retrieving your records.
Get a free consent checkSee how PhotoConsent works →Adapted from PhotoConsent’s LinkedIn article dated 25 November 2024.
Read also: Verbal consent is easier. Or is it?