GDPR for drone footage, a working guide for the pros

The GDPR applies to your drone footage whenever it captures identifiable people, which for commercial work means you are almost always processing personal data and must handle it lawfully. As a professional you generally cannot rely on the personal or household exemption, so you take on the duties of a data controller.

This guide explains what the GDPR asks of commercial drone operators and how to meet those duties in practice. It complements, and does not replace, your aviation compliance, as of 2026.

When does the GDPR apply to your drone work?

The GDPR applies once you process personal data, and footage showing identifiable people is personal data. For commercial drone work, the personal or household exemption almost never applies, so you should assume the GDPR is in play.

The key triggers:

• Identifiable people in your footage, whether by face, number plate or other detail.
• Commercial purpose, which takes you outside the personal or household exemption.
• Storing, editing, sharing or publishing footage, all of which count as processing.
• Any recognisable individual, even incidentally, not just deliberate subjects.

Aviation compliance and data protection are separate. A flight that is perfectly legal under Regulation 2019/947 can still breach the GDPR if you handle footage of people carelessly. Treat both as obligations you must satisfy on every commercial job.

What does being a data controller mean for you?

Being a data controller means you decide why and how personal data is processed, which carries legal duties around lawfulness, transparency, security and people’s rights. When you choose what to film and why, you are the controller for that footage.

Your core duties include:

• Having a lawful basis for processing the footage.
• Being transparent about what you capture and why, where practical.
• Minimising data, capturing only what the job needs.
• Keeping footage secure and controlling who can access it.
• Respecting people’s rights, such as access and, in some cases, erasure.
• Keeping data only as long as needed, then deleting it.

These duties apply to you as the operator, and may be shared with your client depending on the arrangement. Clarify in your contract who controls the data and how it will be used, so responsibilities are clear.

What lawful basis can you rely on?

You need a lawful basis under the GDPR to process footage of people, and the common options for drone work are legitimate interests or consent, depending on the situation. Choosing and documenting the right basis is part of doing the job properly.

The bases most relevant to drone work:

• Legitimate interests, often appropriate for commercial work where you balance your purpose against people’s rights, and where capture is limited and reasonable.
• Consent, suitable where you deliberately film identifiable individuals, such as at an event.
• Contract or other bases, which may apply in specific circumstances.

Legitimate interests requires you to weigh your purpose against the impact on the people filmed, and to keep capture proportionate. Consent must be freely given and specific. Because the right basis depends on facts and national interpretation, take local advice for anything sensitive or large-scale.

How do you handle footage responsibly in practice?

You handle footage responsibly by minimising what you capture, securing what you keep, and being open about what you are doing. Most data protection problems come from careless capture and sharing, not deliberate intrusion.

Practical measures:

• Capture only what the job needs, avoiding gardens, windows and private spaces you do not require.
• Reframe or fly higher so uninvolved people are not the focus.
• Blur or crop faces and number plates before publishing where appropriate.
• Store footage securely, with access limited to those who need it.
• Delete footage you no longer need, on a sensible schedule.
• Be visible and open on commercial jobs, which reduces complaints.

These habits also protect your reputation, since complaints are a common trigger for scrutiny. Good data practice is good business practice. Keeping your aviation and data duties straight is easier when you study them together, which is part of what the dronexamine material helps professionals do.

What extra care do sensitive situations need?

Sensitive situations, such as filming crowds, children, or near homes and hospitals, need extra care because the impact on people and the legal risk are higher. In these cases, be more cautious about your basis, your capture and your storage.

Situations warranting extra care:

• Crowds and events, where many identifiable people are captured at once.
• Children, who are given special protection under data protection law.
• Homes, gardens and private spaces, where privacy expectations are high.
• Sensitive locations, such as hospitals, schools or places of worship.
• Publishing footage of identifiable people, which raises the stakes.

In these cases, consider consent, transparency measures like signage, and stronger minimisation. National privacy, harassment and trespass laws also apply on top of the GDPR, and they vary by country, so check your local rules before filming in sensitive settings.

Common questions

Does the GDPR apply to a commercial property shoot? Usually yes, because footage often captures identifiable people or neighbouring private spaces, and the commercial purpose removes the household exemption. Minimise what you capture, avoid filming neighbours, and handle footage securely. Assume the GDPR applies and act accordingly.

Do I always need consent to film people? Not always. Consent is one lawful basis, but legitimate interests may apply for proportionate commercial work. Consent is most relevant when you deliberately film identifiable individuals, such as at an event. Choose and document the basis that fits the situation, and take local advice if unsure.

How long can I keep drone footage? Only as long as you need it for the purpose you collected it, then you should delete it. Keeping footage indefinitely without reason conflicts with data minimisation. Set a retention period suited to the job and your client agreement, and delete footage when it is no longer needed.

Is the client or the pilot responsible for the data? It depends on who decides why and how the footage is processed, which can make either or both a controller. Clarify this in your contract so responsibilities are clear. As the operator capturing and often storing footage, you carry duties regardless.

Your next step

Before your next commercial flight, decide what you genuinely need to capture, identify your lawful basis, and set up secure storage with a sensible deletion schedule. Clarify data responsibilities with your client in the contract, and take local advice for sensitive jobs. To keep your aviation compliance solid alongside these separate data duties, use the guides at dronexamine.