Tutorials Video

Data Protection for Media Producers

By Infinite Creation · Intermediate · ~15 min

Overview

A production holds a surprising amount of personal data. Contributor details, crew records, release forms, unused footage of identifiable people, a transcript sitting in a service you signed up to on the day, viewing figures from an embedded player. The General Data Protection Regulation, Regulation (EU) 2016/679 of 27 April 2016, applies to all of it. Most of the practical work is not legal. It is administrative: deciding on a lawful basis before you shoot, telling people what you are doing, writing down what you hold, and having a contract behind every service you send material to. This page walks through the articles that actually bite on a shoot, quoting the regulation rather than a summary of it.

What You Need

A list of every category of person a production records or employs
A list of every service that receives your footage, audio or contributor details
A decision, made before the shoot, about which lawful basis covers each activity
A release form that says what will happen to the material, not only that permission is given
Somewhere to keep the record of what you hold, why, and for how long

Steps

Write down what personal data the production actually holds

Start with the list rather than the law, because the list is what determines everything after it. Contributors and their contact details. Crew and their bank details. Anyone identifiable in footage you shot and did not use. Transcripts. Location releases. Casting submissions. Analytics from a player you embedded. Most productions are surprised by how long this gets, and the length is the point: you cannot protect a category you have not noticed you hold.

Choose a lawful basis before the shoot, not after

Article 6(1) says processing is lawful only if and to the extent that at least one of six conditions applies. The ones a production meets are consent, necessity for a contract with that person, a legal obligation, or legitimate interests. Legitimate interests is the one most factual and journalistic work runs on, and article 6(1)(f) qualifies it: it does not apply where those interests are overridden by the interests or fundamental rights and freedoms of the person, in particular where they are a child. Decide per activity, and record why.

Understand why a release form is not the same thing as consent

A release form is a licence to use somebody in your programme. Consent under the regulation is a lawful basis for processing their personal data, and it has to be freely given and capable of being withdrawn. Those two documents can sit on the same sheet of paper but they are not the same promise, and if your only basis is consent then a contributor who withdraws it takes your footage with them. This is exactly why most factual production leans on legitimate interests and keeps consent for the situations that need it.

Treat special category data as a different problem

Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person's sex life or sexual orientation. A documentary about a medical condition or a faith community is inside that list by its subject matter. The prohibition lifts only under one of the conditions in article 9(2), and for a production the realistic one is explicit consent.

Tell people what you are doing, in words they read at the time

Article 13 requires that where personal data are collected from the person, the controller provides, at the time the data are obtained, the identity and contact details of the controller, the purposes of the processing and the legal basis for it, and where the basis is legitimate interests, what those interests are. In production terms this is a short, plain paragraph attached to the release, handed over on the day rather than emailed afterwards.

Assume you need a record of processing

Article 30(5) exempts organisations employing fewer than 250 persons, but the exemption falls away if the processing is likely to result in a risk to people's rights and freedoms, or the processing is not occasional, or it includes special category data under article 9(1) or criminal conviction data under article 10. A production company films people as its ordinary business, so its processing is not occasional. Read the exemption as not applying to you and keep the record.

Put a contract behind every service that touches the material

Article 28 says a controller shall use only processors providing sufficient guarantees, that a processor shall not engage another processor without your written authorisation, and that the processing shall be governed by a contract setting out its subject matter, duration, nature and purpose, the type of personal data, the categories of people, and your rights and obligations. The transcription service somebody signed up to on a phone during the shoot is a processor. Check it has terms that say those things before the footage goes into it, not after.

Do an impact assessment when the risk is genuinely high

Article 35(1) requires an assessment where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, carried out before the processing starts. Filming vulnerable contributors, covert recording, or running biometric identification across footage are the production situations that reach that bar. One assessment can cover a set of similar operations, so this is a document per format rather than per episode.

Know that journalism has a route, and that it is national law

Article 85 requires member states to reconcile data protection with freedom of expression, and article 85(2) says that for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, member states shall provide exemptions or derogations where those are necessary to reconcile the two. That is an instruction to member states, not a self-executing exemption. What you can rely on depends on the law of the country you are in, and you have to look it up rather than assume it.

Pro Tips

The riskiest data on most shoots is the material you did not use. Unused footage of identifiable people is still personal data, and nobody has a retention policy for it.
Put the retention period on the release form. Deciding it once, in advance, is far easier than deciding it under pressure when somebody asks.
Free transcription and cloud editing tools are processors. Read what their terms say about training on your uploads before a contributor interview goes into one.
If your only lawful basis is consent, plan for the day it is withdrawn. Knowing which shots would have to go is a five minute exercise before broadcast and a crisis afterwards.
None of this is legal advice. It is the set of questions worth being able to answer before somebody with a legal budget asks them.

Knowledge Base

Reference Notes

Most production data protection failures are not decisions taken wrongly. They are decisions nobody realised they were taking, usually about a service or about footage that was never broadcast.

Why the release form is the wrong place to stop

Release forms are old, and they were built for a different problem: permission to use somebody in a work, so the work can be exploited without a later claim. Data protection asks a different set of questions. What are you holding about this person, why is holding it lawful, who else gets to see it, how long will you keep it, and how would they find that out. A form can answer both sets at once, but only if somebody has written the second set into it. Most standard release forms have not, which is why a production can hold a signed release and still have no defensible answer about the interview recording sitting in a transcription service.

The service you signed up to on the day is the exposure

The article 28 obligation is easy to satisfy in advance and almost impossible to satisfy retrospectively. It requires a written contract that names the subject matter and duration of the processing, its nature and purpose, the type of personal data and the categories of people involved, and it requires the processor not to bring in a further processor without your authorisation. A tool adopted mid-shoot because it was quick has none of that, and by the time anyone reviews it your contributor interviews are already inside it. The fix is a short approved list of services, decided in pre-production, and a rule that anything not on it is asked about before it is used.

Where This Fits

Data protection is one of the paperwork duties a producer carries, and Production Management covers the rest: breakdown, schedule, budget and the day on set.

FAQ

Q: Is a signed release form enough?
A: Not on its own. A release licenses the use of somebody in your programme. It does not by itself establish a lawful basis for holding their personal data, tell them what you are doing with it as article 13 requires, or cover the services that will process the footage. Those can be added to the same document, but they have to be added.

Q: Which lawful basis covers a documentary?
A: Usually legitimate interests under article 6(1)(f), which the regulation qualifies as not applying where the interests or fundamental rights and freedoms of the person override yours, in particular where that person is a child. Where the subject matter falls inside article 9(1), explicit consent is normally the realistic route.

Q: We are a small company. Are we exempt from keeping records?
A: Probably not. Article 30(5) exempts organisations with fewer than 250 employees, but not where the processing is likely to be a risk to people, or is not occasional, or involves special category data. A company that films people as its business is doing it more than occasionally.

Q: Does journalism get an exemption?
A: Article 85(2) instructs member states to provide exemptions for journalistic, academic, artistic and literary expression where these are necessary to reconcile data protection with freedom of expression. It is national law that grants the exemption, so what applies to you depends on where you are.

Q: What about footage we never broadcast?
A: It is still personal data about identifiable people, and it is usually the largest unmanaged holding a production has. Give it a retention period, write that period on the release, and delete against it.

Vocabulary

Personal data Any information relating to an identified or identifiable living person. On a production this covers far more than a name and an address: unused footage of a recognisable face, a voice recording, a transcript and a casting submission are all personal data about the people in them.

Lawful basis One of the six conditions in article 6(1), at least one of which must apply before personal data may be processed at all. The six are consent, contract, legal obligation, vital interests, public task, and legitimate interests. A production picks one per activity and records the reasoning.

Special category data The classes article 9(1) prohibits processing except under listed conditions: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone uniquely, health data, and data about sex life or sexual orientation.

Controller and processor The controller decides why and how personal data are processed, which on a shoot is the production company. A processor acts on the controller instructions, which is what a transcription service or cloud editing platform is. Article 28 requires a written contract between them.

Record of processing The written account under article 30 of what personal data an organisation holds, why, who receives it and how long it is kept. The exemption for organisations under 250 people falls away where processing is not occasional, which is the normal state of a production company.

Sources

The regulation was read directly from the official text at EUR-Lex, and every article referred to above was read in full rather than from a summary of it. Checked 27 August 2026.

Regulation (EU) 2016/679, the General Data Protection Regulation. The official consolidated text. Article 6(1) sets the six lawful bases and qualifies legitimate interests as not applying where overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. Article 9(1) lists the prohibited special categories. Article 13 lists what must be provided at the time data are obtained. Article 28 sets the processor requirements and the contents of the required contract. Article 30(5) sets the fewer than 250 persons exemption and the three conditions that remove it. Article 35(1) sets the impact assessment trigger. Article 85 places the journalistic and artistic derogations on member states.

This page does not tell you what the journalism exemption gives you in your own country. Article 85(2) directs each member state to legislate the derogations, so the answer is 27 different national laws plus, for the United Kingdom, its own post-exit legislation. None of those were read for this page. It is also not legal advice: it sets out what the regulation says so that you know which questions you are being asked.