GDPR and Employee Photos in Luxembourg: A Practical Company Guide

Yes, your company can photograph employees and use those images in Luxembourg, but only if you have a clear lawful basis under the GDPR and you tell people, in advance, how their image will be used. For most internal uses, a documented legitimate interest usually works better than consent; for promotional and external use, you generally need genuine, freely given consent because employees cannot easily say no to their employer.

This guide is written for Luxembourg companies, fintech and finance teams, and the many international employers here who run EN/FR workplaces. It is general guidance, not legal advice.

What counts as a "photo" under GDPR

An identifiable photo of an employee is personal data, so the GDPR applies the moment you take, store or publish it. A face, a name badge, a desk with visible documents, or a recognisable silhouette can all make someone identifiable.

A few practical consequences:

• Photos on your intranet, website, LinkedIn, ID badges and CRM are all "processing."
• Special-category data (e.g. religious dress, a visible health condition, trade-union context) needs extra care and a stronger basis.
• Even internal storage on Dropbox, SharePoint or a shared drive counts and must be secured.

Consent vs legitimate interest: which lawful basis to use

Pick the lawful basis before the shoot, not after. In an employment relationship the Luxembourg regulator (the CNPD) and EU guidance treat consent with caution, because the power imbalance between employer and employee means consent is rarely "freely given."

A useful rule of thumb:

• Legitimate interest (Art. 6(1)(f)) is usually the cleaner basis for operational uses where the employee reasonably expects to be photographed: an org chart, an internal directory, a security/access badge, a team page. You must run and document a balancing test showing your interest does not override the employee's rights.
• Consent (Art. 6(1)(a)) is the safer basis for promotional or optional uses: marketing campaigns, advertising, the careers page, social media, a personal portrait used externally. Because employees may feel pressure to agree, make refusal genuinely cost-free and easy.

Whatever you choose, write down why. If you ever face a complaint, "we documented our reasoning" is the difference between a fixable issue and a finding against you.

What to put in a photo notice or consent form

A good photo notice answers, in plain language, who, why, where and for how long. Keep it short, give it in EN and FR if that matches your workforce, and store the signed or logged version.

Include:

• Controller identity and contact (and the DPO/contact if you have one).
• Purpose: e.g. internal directory, website "About" page, recruitment, social media, press.
• Lawful basis for each use (legitimate interest vs consent).
• Scope: internal only, or external/public; which channels.
• Retention period and what triggers deletion.
• Rights: access, objection, erasure, and the right to withdraw consent at any time.
• Third parties: your external photographer, agency, CMS or social platforms.

For consent-based uses, avoid pre-ticked boxes and silence. Consent must be an active, specific opt-in, and as easy to withdraw as it was to give.

Internal vs external use: treat them differently

Internal use (intranet, badges, directories) and external use (website, ads, social media) carry different risk, so separate them in your form. An employee may happily appear in the staff directory but not want their face in a paid recruitment ad.

Practical approach:

• Use checkboxes per channel so people can say yes to internal and no to external.
• For external promotional use, prefer consent and re-confirm before a major campaign.
• Remember external content travels: a LinkedIn post can be screenshotted and re-shared, which is exactly why people are choosier about it.

Retention and leavers: have a deletion plan

Decide upfront how long you keep employee photos and what happens when someone leaves. As a default, internal images tied to an active role should be removed or archived when that role ends, unless you have a separate, documented reason to keep them.

When an employee leaves:

• Remove them from the active intranet, directory and badge systems promptly.
• Take down externally published photos where the basis was consent, on request, and proactively review the careers page and recent campaigns.
• Honour erasure and withdrawal requests by locating copies across drives, backups and the photographer's archive, and document what you deleted.
• Note the limit: you can keep an image if there is a genuine, lawful reason (for example a historical press photo of a public event), but "it's convenient" is not one.

Group shots, events and the office in the background

Group and event photos are normal and usually defensible, but tell people before the camera comes out and offer an easy way to opt out of being featured. A company summer party, a conference stand, an award evening, these are reasonable to photograph, provided attendees are informed.

Good practice in Luxembourg's EN/FR settings:

• Put a short bilingual notice at the entrance or in the invite: photos will be taken, used for X, speak to Y to opt out.
• Have an "opt-out" lanyard, sticker or seating area for anyone who prefers not to appear.
• For close-up, identifiable individual shots used in marketing, get specific consent even at an event.
• Be careful with incidental data in the background: client documents, screens, security layouts.

Under the Luxembourg Labour Code, systematic monitoring of staff is a separate regime requiring information of the staff delegation (or the ITM) and possibly a CNPD opinion. Ordinary corporate and event photography is not workplace surveillance, but do not let a "photo project" quietly become continuous monitoring.

Working with your photographer: the contract details

Your photographer is a data processor when they shoot and store your team's images, so the relationship needs a written data processing agreement. This protects you and makes the photographer accountable for security, retention and deletion of the files.

What to expect from a professional production partner:

• A processing clause covering confidentiality, security, sub-processors and deletion on request.
• Clarity on who holds the master files, for how long, and how they are stored (encrypted, access-controlled).
• A clean handover of selected images plus deletion of the rest on a defined timeline.
• Cooperation on erasure and leaver requests, including pulling images from their archive.
• Help preparing simple, bilingual consent and notice templates for the shoot day.

At Lux Photo Pro we build these expectations into corporate shoots in Luxembourg as standard, because a smooth, compliant process is part of a professional result, not an afterthought.

FAQ

Do we always need written consent to photograph employees? No. For routine internal uses you can often rely on a documented legitimate interest. For marketing and external publication, genuine consent is the safer route, because employee consent must be freely given and easy to withdraw.

Can an employee ask us to remove their photo after they leave? Yes. If the basis was consent, they can withdraw it and request erasure, and you should remove the image from live channels and archives unless you have a separate lawful reason to keep it.

Who is responsible if our external photographer leaks the images? Both parties have duties: you are the controller and the photographer is a processor. A written data processing agreement defining security, retention and deletion is essential to allocate responsibility and protect your team.