Website, social media, company brochure, employee directory, intranet… as soon as an employee’s photo is published, you are processing personal data and invoking that person’s right to their own image. To ensure these uses are handled securely, we provide a ready-to-use Word template for an image rights authorization form, which your employees must sign before any photos are published.
This image rights form, available as a Word template, is based on two legal foundations: the GDPR and the right to one’s own image as protected by the Civil Code. It allows you to obtain clear, free, and revocable consent, distinguishing between internal and external use.
A photograph that can be used to identify a natural person constitutes personal data within the meaning of GDPR, just like a name or an email address. Therefore, whenever you capture, store, or distribute an image of an employee, you are processing personal data, which must be based on a legal basis provided for by the GDPR.
This topic is actually governed by two overlapping legal provisions:
Permission must be obtained before taking any photographs, videos, or other images intended for publication, regardless of whether the final content is used as-is or after photo editing. There are two types of use, each of which must be approved separately:
By providing this structure—two separate checkboxes—you allow the employee to consent to one without being forced to accept the other, which ensures that consent is truly free and specific, as required by the GDPR.
A violation of the right of publicity may result in several types of penalties, which may be cumulative:
Obtaining written authorization before any recording or broadcast therefore remains the best form of protection, regardless of the intended use.
A concrete example: A former employee whose photo remains visible on the company’s website or social media accounts after leaving is entitled to request its immediate removal, based on their right to withdraw consent. Without a clear procedure for removing such content, this type of situation can quickly become a source of avoidable tension.
Consent may be withdrawn at any time, just as easily as it was given, by contacting the DPO via email or regular mail. This withdrawal must result in the removal of the content from all relevant platforms within a reasonable timeframe. Designate a clear point of contact to handle these requests.
The document begins by directly identifying the parties: the employee’s name and the name of your organization. This simple wording makes it easy to read and ensures that the signature clearly indicates who is authorizing what.
The employee checks the boxes separately for external use (social media, website, press, promotional activities) and internal use (directory, employee photo gallery, intranet). This distinction allows the employee to authorize one without being required to accept the other, making consent truly free and specific.
A clause stipulating use free of charge, without any associated compensation, outside the context of modeling. This provision eliminates any ambiguity regarding potential compensation related to the publication.
The authorization remains valid for the entire duration of the employment contract and for 5 years after its termination, for worldwide distribution. This ensures you remain covered for the actual period during which the content is used, without having to renew the agreement for each campaign.
An employee may withdraw their consent at any time by contacting the DPO directly by email or regular mail. This statement reassures the employee while establishing a clear framework for the procedure on the company’s side.
The document concludes with a section dedicated to the location, date, and signature, ensuring that the agreement is dated and legally enforceable in the event of an audit or dispute.
Image rights authorization is just one piece of the puzzle. The GDPR rigorous protection of employees’ and candidates’ personal data. Whether you manage your HR or provide HR solutions HR HRIS, payroll, recruitment), compliance is a strategic issue.
As an external DPO registered with the CNIL (National Commission for Information Technology and Civil Liberties), Dipeeo handles your GDPR compliance GDPR start to finish, making us your best business partner:
Contact Dipeeo, external DPO for over 600 companies
Yes. This form template covers both photos and videos of employees (interviews, testimonials, corporate videos, training videos), as long as the person is identifiable in them.
The rules are simple: an employee is free to refuse, and that refusal cannot result in any disciplinary action or pressure. In practice, it is sufficient to exclude that employee from the relevant communication channels, without this affecting their employment contract.
Dipeeo offers several resources in the same category, such as the GDPR consent request form and the AI policy, to meet all your documentation needs in compliance with the GDPR the AI Act.
Unique support from a dedicated GDPR expert combined with the power of a powerful, intuitive SaaS platform for simplified compliance.
At Dipeeo, our GDPR experts - specialized lawyers and former in-house counsel - take care of your compliance from A to Z.
A dedicated legal expert
An outsourced DPO registered with the CNIL (National Commission for Information Technology and Civil Liberties))
Unlimited, tailor-made advice
Cutting-edge expertise
No more stress, no more wasted time, we manage everything for you.
Access an innovative, intuitive tool that centralizes all essential information and facilitates the compliance process.
