Are photographs of individuals personal information under Australian privacy law?

Yes. In Australia, a photograph or video recording that identifies or could reasonably identify an individual is personal information under the Privacy Act 1988 (Cth). This means that Australian organisations subject to the Act — including private sector entities with annual turnover over $3 million and all private health service providers — must handle images in accordance with the 13 Australian Privacy Principles. In particular, APP 3 restricts the collection of personal information to what is reasonably necessary for the organisation's functions; APP 5 requires that individuals be notified of the purpose of collection at or before the time of collection; APP 6 restricts the use of images to the primary purpose of collection unless the individual consents to a further use or an exception applies; and APP 11 requires that images be stored securely and destroyed when no longer needed. An organisation that publishes an image of an identifiable individual without a clear primary purpose for doing so, or that uses an image for purposes other than those for which it was collected, may be found to have interfered with the individual's privacy under the Act. Note that the Privacy Act does not currently apply to small businesses (with annual turnover of $3 million or less) that are not in a regulated sector — these businesses are not required to comply with the APPs, but remain subject to common law duties and may be subject to state-based privacy legislation.

Can a person withdraw consent for their image to be used after it has been published?

Yes, a person can withdraw consent for the use of their image at any time. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, individuals have the right to request that an organisation stop using or disclosing their personal information, including images. Upon receipt of a consent withdrawal, the organisation should stop using the image in any new publications and take reasonable steps to remove it from existing publications — for example, removing it from the organisation's website or social media accounts. However, the organisation cannot guarantee retrieval of images that have already been distributed to or published by third parties, such as media outlets or social media platforms where images may have been shared by other users. The practical limitation of withdrawal — particularly for images published on social media — is a material fact that should be disclosed at the time of consent. This is why the consent form includes a specific provision drawing the individual's attention to this limitation. For images of children, parents may withdraw consent on behalf of the child. As a child grows older, organisations should be receptive to requests from the now-adult subject to have their childhood images removed from ongoing publications, even where parental consent was given at the time.

What are the Child Safe Standards requirements for using images of children in Australia?

Australia's Child Safe Standards establish mandatory requirements for organisations working with children regarding how children's images may be captured and used. The national Child Safe Standards, created under the National Framework for Protecting Australia's Children and implemented through state and territory legislation, require child safe organisations to implement policies and practices that safeguard children from harm, including harm arising from inappropriate use of their images. In relation to photography and filming, Child Safe Standard 2 (Children's safety is embedded in leadership, governance and culture) and Standard 7 (Processes for complaints and concerns are child focused) generally require organisations to have documented policies on the use of children's images. Key requirements that organisations should incorporate into their image consent practices include: obtaining written parental consent before capturing and distributing children's images in publications; not publishing children's identifying information alongside their images (for example, not captioning a child's image with their full name and school on a public website); not using images of children in a way that could make them identifiable to predatory adults; implementing secure storage of images of children and limiting access to authorised staff; having a clear process for parents or children to request withdrawal of consent and removal of images; and reviewing image consent practices at regular intervals. Organisations subject to child safe legislation — including schools, childcare centres, sports clubs, youth organisations, and religious organisations — should incorporate these requirements into their photo consent forms and their broader child safety policies.

Can an organisation use images taken at a public event without obtaining consent in Australia?

In Australia, the law on photographing people in public is more nuanced than it might appear. There is no general law that prohibits photography in a public place — a person in a public space does not have an absolute expectation that they will not be photographed. However, this does not mean that organisations can freely use images of identifiable individuals captured at public events for commercial or promotional purposes without consent. Under the Privacy Act 1988 (Cth), organisations subject to the Act must comply with the Australian Privacy Principles when collecting personal information, including images. APP 5 requires notification of the purpose of collection, and APP 6 restricts use to the primary purpose unless consent is given. Using images from a public event in an organisation's marketing materials, website, or social media — without obtaining consent from the identifiable individuals in those images — would typically require that either the individuals were notified of the potential use before or at the event (e.g. through signage), or that their consent to that specific use is obtained separately. State-based criminal legislation also creates offences for recording intimate images without consent and for observing or filming people in private circumstances, even if the recording occurs in a nominally public place. As a practical matter, organisations that conduct events at which photography will take place should display clear notice boards informing attendees that images may be captured and how they will be used, and should provide an opt-out mechanism for individuals who do not wish to be photographed. Individual signed consent forms are the most robust approach for images to be used prominently in marketing or promotional materials.

Photo / Video Consent Form (Australia) — Australia

Create a comprehensive Australian Photo / Video Consent Form for organisations, schools, sports clubs, event organisers, and businesses. This template covers image rights, privacy obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, use for websites, social media, marketing, and media, children's image rights and Child Safe Standards, withdrawal rights, and image retention. Suitable for adult subjects and minor subjects with parental/guardian consent. In Australia, photographs and video recordings that identify an individual are personal information under the Privacy Act 1988 (Cth). This means that Australian organisations that are subject to the Act — including private sector entities with annual turnover over $3 million, all private health service providers, and other entities covered regardless of turnover — must handle images of identifiable individuals in accordance with the 13 Australian Privacy Principles (APPs). Capturing and publishing images without appropriate consent can constitute an interference with privacy under the Act and may give rise to complaints to the Office of the Australian Information Commissioner (OAIC), which has the power to investigate and make determinations, and may direct the organisation to pay compensation. Australian Privacy Principle 5 (APP 5) requires that at or before the time of collection of personal information — including photographs — the organisation takes reasonable steps to notify the individual of the identity of the collector, the purposes of collection, the intended disclosures, and the individual's rights of access and complaint. This means that taking photographs of identifiable individuals at an event without prior notification and consent may breach APP 5. Obtaining a signed consent form before the event, or displaying prominent notice boards at an event where photography is taking place, are the most common ways to satisfy this obligation. Australian Privacy Principle 6 (APP 6) restricts the use and disclosure of personal information — including images — to the primary purpose of collection, unless an exception applies. The most important exception is consent. An organisation that collects images for the purpose of documenting an event must have specific consent to use those images for secondary purposes such as website publication, social media, marketing, or media distribution. This is why a comprehensive photo consent form must obtain separate, specific consent for each distinct intended use. The situation is particularly sensitive when children are involved. Australia's Child Safe Standards, which are mandatory for organisations working with children under state and territory legislation — including the Child Wellbeing and Safety Act 2005 (Vic), the Child Safe Organisations Act 2020 (NSW), the Child Protection Act 1999 (Qld), and the Children and Community Services Act 2004 (WA) — require organisations to protect children from harm, including from inappropriate use of children's images. The National Office for Child Safety's Child Safe Framework and the national Child Safe Standards (created under the National Framework for Protecting Australia's Children) require child safe organisations to have specific policies and practices regarding photographing and filming children, including obtaining parental consent before using children's images in any publication. In addition to privacy law, some conduct in relation to images is regulated under criminal law. The Crimes Act 1900 (NSW), the Summary Offences Act 1966 (Vic), the Criminal Code Act 1899 (Qld), and equivalent state legislation create offences for recording intimate images without consent (image-based abuse offences) and for observing or recording a person in private circumstances. These criminal provisions are distinct from the civil privacy framework but reinforce the importance of obtaining clear, documented consent before photographing or filming any individual. Organisations should also be aware that social media platforms — including Facebook, Instagram, YouTube, and TikTok — have their own terms of service governing images published on their platforms, and that once an image is published on a social media platform it may be shared by other users in ways the organisation cannot control. The consent form should draw the individual's attention to this reality so that their consent is truly informed. Children have growing recognition under Australian law and policy of a right to control their own image as they mature. While parents have the legal authority to give consent for a minor's image to be used, organisations should review and honour requests to withdraw or modify consent as a child grows older, particularly when images are published online. The form includes a provision recognising this right. This form is suitable for schools, early childhood services, sports clubs and associations, community organisations, event organisers, healthcare providers, fitness businesses, arts and cultural organisations, corporate event photographers, and any other entity that captures and uses images of identifiable individuals as part of its activities.

What Is a Photo / Video Consent Form (Australia)?

An Australian Photo / Video Consent Form is a written document by which an individual (or the parent or guardian of a minor) gives informed consent for an organisation to take photographs and/or video recordings of the subject and to use those images for specified purposes, such as website publication, social media, marketing, and news media.

In Australia, photographs and video recordings that identify a person are personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This means that the capture and use of identifiable images is a regulated activity for organisations subject to the Act, requiring compliance with the notification, collection limitation, use limitation, and data security requirements of the APPs. A photo and video consent form is the primary instrument by which an organisation satisfies its notification obligation (APP 5) and obtains the individual's consent to uses of their image beyond the primary purpose of collection (APP 6).

For images of children, the requirements are stricter. Australia's mandatory Child Safe Standards — implemented through state and territory legislation including the Child Wellbeing and Safety Act 2005 (Vic) and the Child Safe Organisations Act 2020 (NSW) — require child safe organisations to have specific policies and practices governing the capture and use of children's images, including obtaining explicit written parental consent. A minor generally lacks legal capacity to give a binding consent for commercial or promotional uses of their image, making parental consent a legal necessity.

The consent form serves multiple functions: it satisfies the organisation's privacy notification obligation under APP 5; it documents the individual's voluntary, informed consent to each intended use; it records any restrictions or conditions placed on the use of images; it notifies the individual of their right to withdraw consent and the practical limitations of withdrawal (particularly for images already shared on social media); and it establishes the image retention period in compliance with APP 11.

This form is used by schools, early childhood services, sports clubs, community organisations, event organisers, healthcare providers, fitness and wellness businesses, media companies, arts organisations, corporate event photographers, and any other entity that captures and uses images of identifiable individuals.

When Do You Need a Photo / Video Consent Form (Australia)?

A Photo / Video Consent Form is needed whenever an Australian organisation proposes to take photographs or video recordings of identifiable individuals and to use those images for purposes beyond immediate personal or internal documentation.

Sports clubs and associations should obtain photo consent from members and participants at the time of registration, covering the use of images in club publications, websites, and social media. For junior members, parental consent is required. The consent should be reviewed and renewed periodically, particularly as children grow older.

Schools and early childhood services are among the most active users of photo consent forms. Department of education policies in every state require schools to obtain explicit written parental consent before publishing images of students in any format — including on the school website, in newsletters, in promotional materials, in social media, or in media releases to newspapers or television. Consent is typically collected at enrolment and updated annually.

Event organisers — including festival promoters, conference organisers, community events, and charity fundraisers — should obtain consent from participants whose images will be used for promotional or media purposes. Event signage informing attendees of photography may satisfy the notification obligation for background crowd images, but prominent use of identifiable individual images in marketing requires specific consent.

Fitness and wellness businesses — including gyms, yoga studios, CrossFit boxes, and personal training businesses — frequently use before-and-after images and training footage for promotional purposes. Specific written consent from clients is required before using identifiable images in any publication.

Healthcare and allied health providers may wish to capture images of patients for clinical documentation, educational, or promotional purposes. Clinical images are health information under the Privacy Act and require the highest level of privacy protection. Separate, specific consent for clinical photography (including purpose, audience, and retention) is required before any patient images are captured.

Workplace photographers and corporate event teams should obtain consent from employees and guests before using identifiable images from workplace events in internal publications, recruitment materials, or external marketing. Some employees have privacy rights and preferences that should be respected.

Media companies, documentary filmmakers, and digital content creators should obtain a signed photo / video consent form — or in some contexts, a more comprehensive talent release or model release agreement — before using images or footage of identifiable individuals in commercial productions.

What to Include in Your Photo / Video Consent Form (Australia)

An effective Australian Photo / Video Consent Form must include several key elements to satisfy privacy law requirements and provide genuine legal protection for the organisation and the individual subject.

Organisation details: The full name, ABN, address, and contact details of the organisation collecting the images, and the name of the contact person for privacy enquiries and consent withdrawal. These details satisfy the APP 5 requirement to notify individuals of the identity of the data collector.

Subject details: The full name and, if applicable, date of birth of the person to be photographed or filmed. For minor subjects, the parent or guardian's details must also be recorded.

Minor subject and parental consent: A specific section for parental or guardian consent when the subject is under 18, including the guardian's name, relationship to the minor, and contact details. This section must satisfy the requirements of both the Privacy Act 1988 and applicable Child Safe Standards.

Photography context: A clear description of the event, activity, or setting in which images will be captured, and the date or period of photography. This contextualises the consent and ensures the individual knows when and where they will be photographed.

Primary purpose notice: An APP 5 collection notice explaining why images are being collected and the primary purpose of collection. This must be provided before or at the time images are captured.

Intended uses: Specific, granular consent for each intended secondary use of the images — website publication, social media, marketing materials, news media, internal use. Each use should be clearly described and separately consented to, rather than bundled into a single broad 'all purposes' clause.

Restrictions and conditions: A section for the individual to note any restrictions on use — for example, prohibiting close-up facial images, name captions, or use on specific platforms. These restrictions are legally binding.

Image retention period: The period for which the organisation may retain and use the captured images, chosen by the individual or guardian. After this period, APP 11 requires the organisation to destroy or de-identify stored images.

Withdrawal right: A clear statement that the subject or guardian may withdraw consent at any time, the process for doing so, and an honest acknowledgement of the practical limitations of withdrawal for images already published on third-party platforms.

Privacy complaint process: The contact details of the organisation's privacy officer and a reference to the OAIC as the external complaints body, satisfying the APP 5 notification requirement regarding complaint processes.

Frequently Asked Questions

Related Documents

You may also find these documents useful:

Parental Consent Form (Australia)

Create a comprehensive Australian Parental Consent Form for school excursions, camps, incursions, sporting events, medical activities, community programs, and other activities involving children and young people. This template is designed to comply with state education regulations, child protection legislation, the Privacy Act 1988 (Cth), and the Family Law Act 1975 (Cth), and includes sections for medical information, emergency contacts, and emergency medical treatment consent. In Australia, parental consent is a legal requirement for schools and community organisations when enrolling children in activities that take place outside the school grounds, involve heightened physical risk, or require the handling of sensitive personal information such as medical conditions. The legal basis for this requirement draws on several overlapping legislative frameworks. State education legislation requires schools to obtain written parental consent before conducting excursions outside school grounds. In Victoria, the Education and Training Reform Act 2006 (Vic) and the Department of Education's Excursion Policy require that parents receive notification of excursions, including details of the activity, location, transport arrangements, cost, and risk management, and provide written consent before the child participates. In New South Wales, the Education Act 1990 (NSW) and the NSW Department of Education's Excursion Policy impose equivalent requirements. The Education (General Provisions) Act 2006 (Qld), the School Education Act 1999 (WA), the Education Act 1972 (SA), the Education Act 2016 (Tas), the Education Act 2004 (ACT), and the Education Act 2015 (NT) contain similar provisions in other jurisdictions. Schools that conduct excursions without written parental consent risk disciplinary action and, in the event of an incident, may face significantly increased legal liability. Child protection legislation imposes a duty of care on all organisations and individuals working with children. The Children and Young Persons (Care and Protection) Act 1998 (NSW), the Children, Youth and Families Act 2005 (Vic), the Child Protection Act 1999 (Qld), the Children and Community Services Act 2004 (WA), the Children's Protection Act 1993 (SA), the Children, Young Persons and Their Families Act 1997 (Tas), the Children and Young People Act 2008 (ACT), and the Care and Protection of Children Act 2007 (NT) all impose obligations to protect children in the care of organisations from harm and to act in the child's best interests. Collecting parental consent, medical information, and emergency contact details is a key component of meeting this duty of care. Under the Family Law Act 1975 (Cth), parental responsibility for a child is generally shared equally between the parents following separation, unless a court order provides otherwise. This means that, technically, either parent may consent to a child's participation in a school activity. However, in practice, schools address the consent form to the parent or guardian with whom the child resides, and should seek legal advice if parents' consent is in conflict due to a family law dispute. The Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to the personal information collected in a parental consent form, including the child's name, date of birth, medical conditions, and the parent's contact details. This information is sensitive personal information under the Act and must be handled with appropriate security and disclosed only to authorised persons who need it to deliver the activity safely. For activities that carry risk of injury or health emergency, the form includes a section for emergency medical treatment consent. This clause authorises school staff or medical professionals to obtain necessary emergency medical treatment for the child if parents cannot be reached in time. The legal basis for this clause derives from state legislation governing emergency care of children, including the Children and Young Persons (Care and Protection) Act 1998 (NSW) and equivalent provisions in other states, as well as the common law doctrine of necessity that permits medical treatment without consent in genuine emergencies. A signed medical treatment consent clause reduces uncertainty about the school's authority to act in an emergency and may be important in practice when parents are unreachable. This form is suitable for primary and secondary school excursions and camps, early childhood services, youth organisations, sports clubs, community programs, and any other activities involving minor participants where a supervising organisation assumes a duty of care.

General Consent Form (Australia)

Create a comprehensive Australian General Consent Form for activities, programs, events, and services. This template covers participant consent, assumption of risk, medical disclosure, emergency contact, photography consent, and liability limitation, drafted in accordance with the Australian Consumer Law (Schedule 2, Competition and Consumer Act 2010 (Cth)), applicable state civil liability legislation, and the Privacy Act 1988 (Cth). A general consent form is a foundational legal document for any Australian business, club, organisation, or institution that provides services or organises activities involving participants, customers, or clients. The form documents the participant's informed agreement to participate, their acknowledgement of the risks involved, their disclosure of relevant medical information, and the organisation's liability position — all of which are essential elements of a defensible risk management framework. Informed consent is a principle that runs across Australian law in many contexts. In the context of recreational activities and commercial services, consent is relevant to both the contract between the organisation and the participant and to the law of negligence. A participant who freely and voluntarily agrees to participate in an activity with knowledge of its risks may be taken to have assumed the inherent risks of that activity, which can defeat or reduce a negligence claim. Under the Civil Liability Act 2002 (NSW), the Wrongs Act 1958 (Vic), the Civil Liability Act 2003 (Qld), the Civil Liability Act 2002 (WA), the Civil Liability Act 1936 (SA), the Civil Liability Act 2002 (Tas), and the Civil Law (Wrongs) Act 2002 (ACT), Australian states have codified the voluntary assumption of risk defence, but require that the plaintiff was actually aware of and voluntarily accepted the specific risk that caused the loss. Because of this requirement of actual knowledge, a well-drafted risk disclosure section in a consent form is legally significant. Simply including a blanket exclusion clause is not sufficient — the form must specifically identify the known risks of the activity in plain language. A participant who signs a form that clearly and specifically describes the risks of the activity, and who proceeds to participate, is in a much weaker position to claim they were unaware of those risks. This is why this form includes a dedicated risk acknowledgement section inviting the organisation to describe the known hazards in specific terms. The Australian Consumer Law (ACL), which applies in all states and territories as Schedule 2 of the Competition and Consumer Act 2010 (Cth), imposes important limits on an organisation's ability to exclude liability. Under section 60 of the ACL, there is a consumer guarantee that services will be provided with due care and skill. Under section 61, services must be reasonably fit for any particular purpose the consumer makes known. An organisation cannot exclude these guarantees if the participant is a consumer under the ACL (broadly, where the services are for personal use and cost less than $100,000). Section 64A of the ACL allows an organisation to limit its liability for non-personal injury losses to resupply of the services, but section 64 prohibits any term purporting to exclude the consumer guarantees entirely. Liability for death or personal injury caused by negligence cannot be excluded in consumer transactions under the ACL. For recreational service providers, state legislatures have created specific risk warning regimes. In Queensland, the Tourism and Events Queensland Act 2012 and the Civil Liability Act 2003 allow recreational service providers who give a compliant risk warning to seek a waiver from a participant's rights under the Australian Consumer Law for personal injury. Other states have similar provisions. This general consent form provides a framework that can be adapted to include a compliant risk warning where required. The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) apply to organisations with an annual turnover of more than $3 million, and to certain smaller organisations in specific sectors. When a consent form collects personal information — including the participant's name, contact details, date of birth, and particularly medical information — the organisation must comply with APP 3 (collection of solicited personal information), APP 5 (notification of collection), and APP 11 (security of personal information). This form includes a privacy notice directing participants to the organisation's privacy policy. This form is suitable for adventure tourism and recreational activities, fitness and wellness businesses, sports clubs and associations, community programs and events, workshops and training programs, therapy and allied health services, arts and cultural programs, and any other activity where an organisation seeks documented participant consent before providing services.

Media Release Form (Australia)

Create a compliant Australian Media Release Form for schools, sporting clubs, community organisations, charities, government bodies, and event operators to obtain written consent from participants for the use of photographs, video footage, and audio recordings in print, digital, social media, broadcast, and community publications. This template is drafted in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, with specific provisions for minor participants under state and territory child protection and education legislation. A media release form is distinct from a commercial photo and video release. It is used by non-profit organisations, schools, government agencies, and community groups — rather than commercial photographers or production companies — to obtain participant consent for the publication of media in contexts such as school newsletters, club websites, social media accounts, annual reports, event coverage, and community publications. The consent is typically sought as part of enrolment, event registration, or membership and covers a broad range of foreseeable media uses, rather than a single specific commercial shoot. Under the Privacy Act 1988 (Cth), a photograph, video footage, or audio recording that identifies an individual constitutes personal information within the meaning of section 6 of the Act. Australian Privacy Principle 3 (APP 3) requires an APP entity to collect personal information (including images) only if the individual has consented and the collection is reasonably necessary for a function or activity of the entity. APP 5 requires that individuals be notified of the purpose of collection, how the information will be used, and to whom it may be disclosed. APP 6 permits use of personal information only for the primary purpose for which it was collected, or a secondary purpose to which the individual has consented. A clearly written media release form that identifies the purpose of use and the channels of distribution satisfies all three requirements. For schools and early childhood services, additional obligations apply under state education legislation and departmental policies. In Victoria, the Education and Training Reform Act 2006 (Vic) and the Department of Education's Privacy Policy require schools to obtain parental consent before publishing images of students. In New South Wales, the Education Act 1990 (NSW) and the NSW Department of Education's privacy requirements impose similar obligations. In Queensland, the Education (General Provisions) Act 2006 (Qld) and the Department of Education's Student Information Privacy Policy apply. Similar regulatory requirements apply in all other states and territories. For participants under 18 years of age, the informed consent of a parent or legal guardian is required, not merely the participant's own consent. This requirement is reinforced by state child protection legislation including the Children and Young Persons (Care and Protection) Act 1998 (NSW), the Child Wellbeing and Safety Act 2005 (Vic), the Child Protection Act 1999 (Qld), the Children and Community Services Act 2004 (WA), and equivalent statutes in other jurisdictions. These Acts impose obligations on organisations working with children to ensure that the use of a child's image does not create an unacceptable risk to the child's safety or wellbeing. The form also addresses the participant's rights under the Australian Privacy Principles, including the right to withdraw consent at any time (subject to practical limitations on content already published) and the right to request access to or correction of personal information held by the organisation under APP 12 and APP 13 respectively. A clear withdrawal mechanism, with contact details for the privacy officer, must be provided to ensure compliance with APP 6. This form is suitable for a wide range of events and activities including school sports days, excursions, camps, drama and arts performances, community fairs, charity fundraising events, sporting competitions, award ceremonies, and cultural celebrations. Once signed, both the participant (or parent/guardian) and the organisation should retain a copy for their records.

Privacy Policy (Australia)

Create a compliant Australian Privacy Policy for your business or website. Our template is drafted in accordance with the Privacy Act 1988 (Cth) and covers all 13 Australian Privacy Principles (APPs), including APP 1 (open management), APP 5 (notification), APP 6 (use and disclosure), APP 7 (direct marketing), APP 8 (cross-border disclosure), APP 11 (security), APP 12 (access), and APP 13 (correction). Includes the Notifiable Data Breaches scheme, OAIC complaint process, and the $3 million turnover threshold explanation.