Salon portfolio photos: copyright and client consent

When a salon publishes before and after photos on its website or social media, two separate legal issues arise: copyright ownership of the photograph and personal data consent under UK GDPR. Understanding the difference is essential because they have different rules and different remedies. Run a free UK compliance scan to flag privacy and image issues on your portfolio pages.

Issue 1: Who owns the copyright in the photo

Copyright ownership is determined by who took the photograph, not who is pictured in it.

Under section 11 of the Copyright, Designs and Patents Act 1988, the author of a work (in this case, the photographer) is the first owner of the copyright. The person photographed has no copyright claim in the image itself, even though their face appears in it.

Employee-taken photos

If a staff member at your salon takes the before and after photos in the course of their employment, section 11(2) of the CDPA 1988 makes the salon the first owner of the copyright by default, subject to any agreement to the contrary.

That default is helpful but fragile. If the photos were taken outside the scope of employment (a stylist shooting on a day off, for example), the default flips back to the employee as author and first owner.

A clear contract clause removes the ambiguity. Spell out that any work made in the course of employment belongs to the salon, including photographs.

Action: Review your employment contracts. Include a clause stating that "All photographs, images and creative works produced during the course of employment are the copyright of the salon and may be used for marketing, portfolio and business purposes."

Freelance photographer

If you hire a photographer (freelance or self-employed) to take photos, they own the copyright by default. A payment or contract for their services does not transfer copyright to you.

Under section 11, only an express written agreement can transfer copyright from the photographer to the salon.

Action: Before hiring a photographer or stylist, use a written agreement that states: "All photographs taken shall be copyright of [Salon Name] and may be used for portfolio, website and marketing purposes." Have the photographer sign it.

Photos provided by the client

If a client supplies before and after photos (for example, a client sends photos of their previous hair style), the client owns the copyright. You do not have the right to publish them without the client's permission, even if you took the photos yourself with the client's camera or phone.

Action: Obtain a separate written consent from the client specifically granting permission to use the photos for portfolio, website and social media purposes. A verbal agreement is not sufficient under UK law.

<div className="my-6 overflow-x-auto"> <table className="w-full border-collapse text-sm"> <thead> <tr className="bg-slate-100 text-left"> <th className="border border-slate-300 px-3 py-2 font-semibold">Who took the photo</th> <th className="border border-slate-300 px-3 py-2 font-semibold">Default copyright owner</th> <th className="border border-slate-300 px-3 py-2 font-semibold">What you need to use it</th> </tr> </thead> <tbody> <tr> <td className="border border-slate-300 px-3 py-2 font-semibold">Salon employee, during work</td> <td className="border border-slate-300 px-3 py-2">Salon by default under CDPA s.11(2)</td> <td className="border border-slate-300 px-3 py-2">No assignment needed. A written IP clause removes any ambiguity over scope of employment.</td> </tr> <tr className="bg-slate-50"> <td className="border border-slate-300 px-3 py-2 font-semibold">Freelance photographer or stylist</td> <td className="border border-slate-300 px-3 py-2">Photographer</td> <td className="border border-slate-300 px-3 py-2">Written copyright assignment. Payment alone does not transfer copyright.</td> </tr> <tr> <td className="border border-slate-300 px-3 py-2 font-semibold">Client supplied the photo</td> <td className="border border-slate-300 px-3 py-2">Client (or the person who took it for them)</td> <td className="border border-slate-300 px-3 py-2">Written client consent for portfolio use.</td> </tr> <tr className="bg-slate-50"> <td className="border border-slate-300 px-3 py-2 font-semibold">Client tagged the salon on Instagram</td> <td className="border border-slate-300 px-3 py-2">Client</td> <td className="border border-slate-300 px-3 py-2">Sharing within the platform may be permitted. Republishing on your own site requires separate written consent.</td> </tr> </tbody> </table> </div>

The LinkedIn and Instagram trap

A client tagging you in their Instagram post or accepting a LinkedIn connection does not grant you permission to reuse their image elsewhere. Social media follows are not licence agreements.

If your client posts a before and after photo on their own Instagram account and tags your salon, you may share or repost that image if the client's privacy settings allow it. However, moving that image to your website, a printed portfolio or Google My Business without separate written consent is infringement.

Issue 2: Personal data and GDPR consent

This is the second layer and it is separate from copyright.

A recognizable before and after photo of a client is personal data under UK GDPR Article 4, because it allows the person to be identified. The fact that the photo is also protected by copyright does not change this.

Under UK GDPR Article 6, you must have a lawful basis to process that personal data. The simplest lawful basis is explicit consent: the client agrees to let you use their image.

Health data and special category processing

Before and after photos showing cosmetic, aesthetic or medical treatments are often special category data under Article 9 of UK GDPR, because they may relate to the person's health or physical condition.

Examples include:

• Before and after photos of hair loss treatment, baldness or scalp conditions
• Photos of skin treatments for acne, rosacea or dermatological conditions
• Cosmetic surgery before and afters
• Tattoo cover-up or removal work

Processing special category data requires higher safeguards than ordinary personal data. You must have explicit consent (not just accepting terms and conditions) and you must document that consent carefully.

<div className="my-6 overflow-x-auto"> <table className="w-full border-collapse text-sm"> <thead> <tr className="bg-slate-100 text-left"> <th className="border border-slate-300 px-3 py-2 font-semibold">Photo type</th> <th className="border border-slate-300 px-3 py-2 font-semibold">UK GDPR category</th> <th className="border border-slate-300 px-3 py-2 font-semibold">Lawful basis required</th> <th className="border border-slate-300 px-3 py-2 font-semibold">Consent format</th> </tr> </thead> <tbody> <tr> <td className="border border-slate-300 px-3 py-2 font-semibold">Hair colour or styling before-after</td> <td className="border border-slate-300 px-3 py-2">Ordinary personal data</td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) consent</td> <td className="border border-slate-300 px-3 py-2">Written consent</td> </tr> <tr className="bg-slate-50"> <td className="border border-slate-300 px-3 py-2 font-semibold">Hair-loss or scalp condition treatment</td> <td className="border border-slate-300 px-3 py-2"><strong>Special category</strong> (health data)</td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) + Art 9(2)(a) explicit consent</td> <td className="border border-slate-300 px-3 py-2">Signed explicit consent</td> </tr> <tr> <td className="border border-slate-300 px-3 py-2 font-semibold">Skin treatments (acne, rosacea, dermatology)</td> <td className="border border-slate-300 px-3 py-2"><strong>Special category</strong></td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) + Art 9(2)(a) explicit consent</td> <td className="border border-slate-300 px-3 py-2">Signed explicit consent</td> </tr> <tr className="bg-slate-50"> <td className="border border-slate-300 px-3 py-2 font-semibold">Cosmetic surgery before-after</td> <td className="border border-slate-300 px-3 py-2"><strong>Special category</strong></td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) + Art 9(2)(a) explicit consent</td> <td className="border border-slate-300 px-3 py-2">Signed explicit consent. Stricter retention.</td> </tr> <tr> <td className="border border-slate-300 px-3 py-2 font-semibold">Nails or makeup styling shots</td> <td className="border border-slate-300 px-3 py-2">Ordinary personal data</td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) consent</td> <td className="border border-slate-300 px-3 py-2">Written consent</td> </tr> <tr className="bg-slate-50"> <td className="border border-slate-300 px-3 py-2 font-semibold">Tattoo cover-up or removal</td> <td className="border border-slate-300 px-3 py-2"><strong>Special category</strong> if showing medical scarring</td> <td className="border border-slate-300 px-3 py-2">Art 6(1)(a) + Art 9(2)(a)</td> <td className="border border-slate-300 px-3 py-2">Signed explicit consent</td> </tr> </tbody> </table> </div>

Even if the photo is flattering or the client is happy with the result, if it shows a health-related condition, you need their signed consent.

How to obtain GDPR-compliant consent

Create a simple written consent form that clients sign when they book a treatment or attend their appointment. The form should state:

• What photos will be taken (before and after, close-ups, full face/body etc.)
• How the photos will be used (website, social media, printed materials, Google My Business)
• How long you will keep them (typically "until the client withdraws consent")
• That the client can withdraw consent at any time
• That withdrawal means you will stop publishing the image, though you may retain a copy for your own records

You do not need a separate form for copyright and GDPR, one clear form covering both works.

Example consent clause:

"I give [Salon Name] permission to photograph before and after images of my treatment. I consent to these photos being used on the salon's website, social media, Google My Business and other marketing materials. I understand I can withdraw this consent at any time by emailing [salon email]. I confirm that [Salon Name] has explained how my data will be used and stored."

File signed consent forms with the client's appointment notes.

Withdrawal of consent

A client can withdraw consent to use their image at any time. If they ask you to remove their photo from your website or social media, you must comply promptly (within days, not weeks).

Under UK GDPR Article 17 (the right to erasure), clients can ask you to delete their personal data, including images. You must delete or anonymise the image from all public-facing channels, though you may retain a copy in your archives for business records.

Practical steps for your salon

Audit existing photos. Review all before and after images currently on your website, social media and printed materials. For each image, check whether you have written consent from the client and, if taken by a freelancer, written copyright assignment from the photographer.

If you cannot find evidence of consent or copyright ownership, unpublish the image and consider replacing it with a stock photo or generic image.

Update employment and contractor agreements. Include clauses assigning copyright in all work to the salon.

Create a consent form. Draft a simple one-page form that clients sign before their first treatment. Keep it with their booking records.

Implement a process. Before publishing any client photo, confirm that consent is on file.

Train staff. Make sure reception staff and stylists know that client photos require written consent and that verbal permission is not sufficient.

Be transparent. Mention in your privacy policy that you may photograph treatments for portfolio purposes and that clients will be asked for consent. Provide the ICO's guidance on personal data as a reference.

Key takeaways

• Copyright in a photo belongs to the photographer by default. You must have written assignment to own or use the image
• Client photos are personal data under UK GDPR. You must have explicit written consent to publish them
• Photos showing health-related conditions (hair loss, skin conditions and cosmetic procedures) require higher safeguards
• A client's social media post or tag does not grant you permission to reuse the image elsewhere
• Create a simple written consent form covering both copyright and GDPR, have clients sign before taking photos
• Review existing portfolio images and remove any lacking documented consent