GDPR starter kit for photographers

Photographers work in two parallel legal regimes: portrait law (Dutch Copyright Act Art. 19-21, see portrait law) + GDPR (photo = personal data). Core matters: (1) Commissioned photo (wedding, portrait session): publication only with subject's consent (Aw Art. 19). Model contract with explicit publication rights. (2) Non-commissioned (street photography, events): no consent required, BUT "reasonable interest" of subject can block publication (Aw Art. 21 — Cruijff jurisprudence). Commercial use almost always requires consent. (3) RAW storage: personal data — retention not "forever". For portrait session: contract duration + 2 years. Delete unused photos. (4) Portfolio on website: explicit consent per medium. No "we have wedding photos, so they may go online". (5) Cloud storage (Dropbox, Adobe Creative Cloud): DPA + Schrems II TIA. (6) Social sharing terms: clients often want to share on Instagram — separate consent + tag policy. (7) Press photography: journalistic exemption UAVG Art. 43 lowers many GDPR requirements. But portrait right remains applicable. Model release: contract setting all uses + duration + revoke procedure. Essential for commercial photography.