Visit Website →
← Back to blog

7 legal and photographer steps to protect photoshoot confidentiality

September 29, 2026
7 legal and photographer steps to protect photoshoot confidentiality

Photos from a photoshoot can often be kept confidential, but the level of legal protection depends on how the images are used and by whom. Purely private, personal photography usually sits outside formal privacy law, while professional or published images can trigger real obligations. If your photos have been shared without permission, preserve the evidence, ask for removal in writing, and contact Netsafe or the police when the situation involves image-based abuse.

TL;DR:

  • Photos shared or used in commercial or published contexts may trigger legal obligations under privacy, copyright, or contract law, depending on how they are handled.
  • A written, specific model release specifying permitted uses, duration, confidentiality, and withdrawal rights reduces disputes and ensures enforceability.
  • When photographing children, explicit consent from guardians, clear opt-in forms, and prompt removal requests are essential to comply with higher duty of care.
  • Reposting or sharing images without permission can lead to privacy complaints or claims of image-based abuse, especially if the content is harmful or offensive.
  • Proper documentation, secure storage, and clear communication at every stage protect subjects’ rights and help prevent confidentiality breaches.
Life in style Photography
Capture Your Story With Confidence
Life in Style Photography creates authentic, high-quality images through a relaxed approach that helps clients feel at ease during their shoot.
Explore photography services

Table of Contents

When are photos personal information and which laws apply

Not every photograph is treated the same way under the law. A photo becomes "personal information" when it identifies a specific person and is collected, stored or used by an agency or business rather than by an individual acting privately. Once that threshold is crossed, a set of information-handling obligations can apply to whoever holds the image.

The Privacy Act 2020 sets out those obligations for agencies and businesses, covering how personal information is collected, stored, used and disclosed. It does not generally reach purely private, domestic photography, such as a family album or a friend's phone snap taken outside of any business context. This is often called the household exception, and it means a lot of everyday photography sits outside the Act's scope even though the images clearly identify people.

That gap matters for photoshoots, because a professional photographer or a business commissioning images is usually acting as an agency for the purposes of the Act, while a friend taking casual photos at a private gathering is not. Several other laws can fill the space the Privacy Act leaves open:

  • The Harmful Digital Communications Act addresses image-based abuse and the distribution of harmful digital content, regardless of whether a business is involved.
  • The Copyright Act 1994 creates separate rights around ownership and moral rights that can restrict how a photo is published, even where privacy law does not apply.
  • Contract law, through a signed model release or booking agreement, can create private obligations that go further than any statute requires.

Understanding which regime governs your situation helps you pick the right remedy. A privacy complaint suits a business misusing photos collected for one purpose and used for another. A Harmful Digital Communications Act complaint suits image-based abuse. A copyright or contract dispute suits disagreements over who gets to publish or sell an image.

Consent is the foundation of confidentiality in photography, but it only holds up when it is informed and specific. A subject needs to know, before the shutter clicks, what the images will be used for, where they might be shared, how long they will be kept, and whether any third party (a client, a publication, a social media audience) will see them. Consent given without that context is weak and easy to dispute later.

A written model release turns a verbal understanding into something enforceable. At minimum, it should cover:

  1. Permitted uses, spelling out exactly where images can appear, such as a portfolio, social media, a client's website or a print campaign.
  2. Duration, stating whether permission is ongoing or limited to a set period.
  3. Ownership and licence terms, clarifying who holds copyright and what rights the subject or client is granted to use the images.
  4. Confidentiality clauses, restricting publication or sharing for sensitive sessions such as personal branding, maternity or private family shoots.
  5. Withdrawal process, describing how a subject can revoke consent and how quickly the photographer or business must act on that request.

Photographers who explain confidentiality clauses in advance tend to run into fewer disputes than those who leave it to a verbal agreement, because a written release removes the guesswork around who agreed to what. Life in Style Photography's approach to written agreements, outlined on its confidentiality and image-use practices page, reflects that same principle: clear terms set before the session avoid awkward conversations after it.

Beyond the release itself, a few simple habits reinforce good documentation. Email confirmations after a shoot create a timestamped record of what was agreed. On-set checklists remind photographers to confirm consent verbally before shots that might be sensitive. Signage at events (weddings, corporate functions) lets attendees know photography is taking place and gives them a chance to opt out. Keeping copies of every signed release, even for casual sessions, gives both parties something concrete to refer back to if a disagreement arises months later.

Illustrated photography consent documentation process

Pro Tip: Ask every client to initial the confidentiality clause separately from the main signature line: it forces a moment of genuine attention rather than a rushed scroll-and-sign.

Photographing children and young people: special duties

Photographing children carries a higher duty of care, even though the household exception can technically apply to casual family photos. The Office of the Privacy Commissioner treats informed consent as best practice whenever children's images are collected outside a purely private setting, such as at a school event, a sports club or a commercial shoot.

In practice, that means parents and guardians should always know, and ideally confirm in writing, how a child's image will be used before it is taken. A few habits keep this straightforward:

  • Use simple opt-in or opt-out forms at events where children will be photographed, rather than assuming consent from attendance alone.
  • Put up signage at venues so parents can identify the photographer and ask questions before the session starts.
  • Communicate directly with a parent or guardian rather than relying on a school, club or venue to pass on consent details.
  • Avoid using personal phones or devices for formal collections of children's images, since this makes secure storage and deletion harder to guarantee.

Consent for children's photography should also be treated as reviewable rather than fixed. If a parent or guardian later withdraws permission, whoever holds the images should act on that request promptly, removing the photo from any public use and confirming the removal in writing. Photographers who build a short review step into their workflow, checking old permissions before republishing an image, avoid the awkward situation of a photo resurfacing years after a family's circumstances or wishes have changed.

Using, sharing and publishing images: limits and takedown options

Businesses and photographers that collect images for one purpose generally cannot repurpose them for something entirely different without fresh consent. This principle, known as purpose limitation, means a headshot taken for an internal staff directory should not end up in a public marketing campaign unless the subject agreed to that broader use. When a business breaches this principle, the subject has grounds for a privacy complaint.

Separately, sharing an image that is highly offensive or intended to cause harm can amount to image-based abuse, which sits outside ordinary privacy law and squarely inside the Harmful Digital Communications Act. Netsafe treats this as a serious and ongoing issue, and it offers direct assistance for people trying to get harmful images taken down, alongside guidance on reporting to platforms and police.

If you find yourself needing to remove an image, a consistent process gets better results than an ad hoc one:

  1. Identify where the image is hosted and take dated screenshots showing the content, the URL and any visible upload details.
  2. Report the content through the platform's own reporting tool, since most major platforms have dedicated processes for non-consensual or harmful images.
  3. Contact Netsafe if the image qualifies as image-based abuse or if the platform is slow to respond; Netsafe can advise on further steps and, in some cases, assist directly with takedown.
  4. Escalate to police where the content involves intimate images shared without consent, harassment or another criminal element.

Netsafe notes that image-based abuse, sharing intimate images without consent, is a serious problem it actively supports people through, offering practical routes for takedown assistance rather than leaving individuals to negotiate with platforms alone.

Copyright ownership and privacy are two separate legal questions, and confusing them causes most disputes over who can publish a photo. Under the commissioning rule, when someone pays a photographer to take photos for private or domestic purposes, such as a family portrait or a wedding, the person who commissioned the work can hold rights that limit the photographer's ability to publish those images, even though the photographer took the shot. A written agreement should always clarify who owns copyright and what licence, if any, the other party receives, because default rules vary depending on how the shoot was commissioned.

Separately, moral rights give the subject of certain commissioned photographs a right to privacy that exists independently of who owns copyright. This means:

  • A subject can object to publication, exhibition or broadcast of a privately commissioned photo, even where the photographer legally owns the copyright.
  • This right applies specifically to images taken for private and domestic purposes, not to commercial or editorial photography taken with different expectations from the outset.
  • The right does not expire simply because time has passed, so old images can still be subject to an objection years later.

For photographers and clients, the fix is straightforward: put ownership, licensing and publication permissions in writing before the shoot. A short clause specifying that images may be used for portfolio display but not for third-party sale, for example, avoids ambiguity that would otherwise be settled by default legal rules that neither party may fully understand at the time.

If your photos are shared without permission: step-by-step response

Finding your own photos published somewhere you did not agree to is unsettling, but a clear sequence of actions gives you the best chance of a fast resolution.

  1. Preserve the evidence first. Take screenshots of the image, the page it appears on, the URL and any timestamps before the content can be edited or deleted.
  2. Identify who uploaded it. Note the account name, profile or website, since this detail matters for both platform reports and any later legal action.
  3. Contact the uploader and the photographer directly, in writing, requesting removal and stating why the use breaches your consent or agreement.
  4. Keep a written log of every reply, including dates, since this record becomes useful if the matter escalates.
  5. Report to the platform using its built-in reporting tool for non-consensual or harmful content.
  6. Contact Netsafe for practical takedown assistance with image-based abuse, particularly where a platform is unresponsive.
  7. Involve police or a lawyer where the image involves intimate content shared without consent, harassment or another criminal element.

Pro Tip: Send your takedown request by email rather than a direct message on the platform itself: it creates a clearer paper trail if you need to escalate later.

Practical confidentiality steps for photographers and subjects

Good confidentiality practice is built into the shoot itself, not bolted on afterwards. A few habits, applied consistently, prevent most disputes before they start.

  • Use short, plain-language model releases that spell out permitted uses, duration and any confidentiality restrictions, especially for sensitive sessions like personal branding, maternity or family portraits.
  • Add a confidentiality addendum for shoots where a client needs stricter limits, such as a non-publication clause that keeps images entirely off social media and portfolios.
  • Confirm consent verbally on set, particularly before any shot that might be considered sensitive, rather than relying solely on a signature taken before the session began.
  • Transfer files to a secure system promptly and avoid leaving images sitting on personal phones or laptops where they are harder to track or delete on request.
  • Share low-resolution proofs for approval before publishing anything more widely, giving the client a chance to flag images they would rather keep private.
  • Limit online galleries to password-protected or time-limited pages rather than fully public albums, especially for weddings and family sessions.
  • Tie retention to purpose and offer a simple way for clients to request deletion once the agreed use has passed, rather than holding files indefinitely by default.

These steps do not require complicated systems, just consistency, and they turn confidentiality from a vague promise into something a client can actually see happening during their session.

Why photographers should treat confidentiality as a service feature

Confidentiality is not an afterthought bolted onto a contract. It is part of how a client decides whether to trust you with their image at all, and treating it that way changes how a session runs.

Confidentiality is often built into the conversation before taking photos: discussing what images will be used for, who will see them, and whether anything needs to stay off social media. Clients doing personal branding or sensitive family shoots often request firmer limits than a standard portfolio use clause allows, and stating that plainly in the contract avoids awkward conversations later.

The businesses that get this right are the ones clients recommend to others. If you have specific confidentiality needs for an upcoming session, mention them when you enquire. It helps shape the planning of the shoot from the start.

— Rowan Freeman

How Life in Style Photography handles confidential sessions

Good confidentiality practices shape how sessions are planned by many photographers, from the release signed to how files are delivered. Clear model releases are used, online proofs are kept low-resolution until approval for wider use, and master files are stored securely rather than left on personal devices.

Confidential requests often arise for personal branding, maternity, and couples sessions, where clients may want images kept off public galleries or limited to specific uses.

Mention your confidentiality preferences when you get in touch, and we will build them into your quote from the start.

Sources

For readers who want to go straight to the primary material, a few sources cover most situations. The Privacy Act 2020 sets out the information-handling principles that apply to agencies and businesses, including the household exception for private photography. Netsafe provides direct, practical help with image-based abuse and takedown requests. The NZ Police guidance on photography in public places clarifies when taking or publishing a photo in public can still raise legal issues. For readers researching location permits for shoots abroad, this guide to Dubai wedding photo locations and permit requirements is a useful reference, though it reflects rules specific to that market rather than any local framework.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Taking a photo of someone in a public place is generally lawful, but publishing or using that image in a way that is highly offensive or harassing can breach the Harmful Digital Communications Act. Context matters: a casual public photo is treated very differently from a targeted or intimate image shared without consent.

What are my rights if someone is using my photos without permission?

Your rights depend on how the image is being used. If a business is using a photo beyond the purpose you agreed to, you may have a privacy complaint under the Privacy Act 2020, and if the image is intimate or harmful, Netsafe can assist with a takedown request.

Can a photographer share photos without my permission?

A photographer's ability to share your photos depends on the release or contract you signed at the time of the shoot, since these documents set out permitted uses and any confidentiality limits. Where a shoot was commissioned for private or domestic purposes, you may also hold a moral right to object to publication even if the photographer owns the copyright.

It is not automatically illegal to take a picture without consent, particularly in public places, but publishing or distributing that image can become unlawful if it is harassing, highly offensive or amounts to image-based abuse under the Harmful Digital Communications Act. Whether a specific photo crosses that line depends on the content and the circumstances of how it was taken and shared.