Media Release Form (Ireland)

A Media Release Form in Ireland releases one party from liability and records the risks the other party accepts in return for taking part or receiving a benefit, with its requirements set by the GDPR and the Data Protection Act 2018.

The Data Protection Commission (DPC), headquartered at 21 Fitzwilliam Square South, Dublin 2, is the independent supervisory authority responsible for enforcing the GDPR and the Data Protection Act 2018 in Ireland. Ireland is the lead supervisory authority under the GDPR's one-stop-shop mechanism for many of the world's largest technology companies — including Meta, Google, Apple, Twitter/X, LinkedIn, and TikTok — whose European headquarters are based in Dublin. The DPC publishes detailed guidance for organisations and individuals on lawful photography, video recording, and the use of images in marketing and social media, available at dataprotection.ie.

For consent to be valid under Article 7 of the GDPR, it must be: freely given (not coerced or conditional); specific (identifying the exact purposes for which the media will be used); informed (clearly explaining how the data will be stored, shared, and for how long); and unambiguous (given by a clear affirmative act, such as signing a form — not by silence, inactivity, or pre-ticked boxes). Article 7(3) of the GDPR gives every data subject the right to withdraw consent at any time, and withdrawal must be as easy as giving it. Where consent is withdrawn, the data controller must stop using the images for new purposes and, where technically feasible, remove identifiable images from digital publications.

For children under 16, the Data Protection Act 2018 requires parental or guardian consent for processing their personal data for digital services under section 31 of the Act, mirroring the GDPR's requirements for children's data. Túsla — the Child and Family Agency, established under the Child and Family Agency Act 2013 — publishes safeguarding guidance relevant to photographing children in the context of sports clubs, schools, and community organisations. The Children First Act 2015 imposes separate mandatory safeguarding obligations on organisations that work with children. A media release form for a child must be signed by a parent or legal guardian, not the child themselves, unless the child is 16 or over and the form is for a non-digital service use. The forms-legal.com Media Release Form (Ireland) template is drafted in compliance with the GDPR and the Data Protection Act 2018.

Ireland law requires a media release form whenever an organisation or individual intends to photograph, film, or record an identifiable person and use that material for specified commercial, promotional, or public-facing purposes — implied or assumed consent is not sufficient under the GDPR. The lawful basis of consent under Article 6(1)(a) of the GDPR must be obtained before the activity, not after the fact.

A Media Release Form is needed in the following situations. Corporate and commercial events: businesses hosting conferences, product launches, team-building events, or networking events in Ireland must obtain media release consent from individual attendees whose identifiable images will be used in marketing materials, websites, LinkedIn posts, or press releases. The Data Protection Commission (DPC) has confirmed that attending an event does not imply consent to being photographed for promotional use.

Sports clubs and community organisations: sports clubs, athletic associations, youth organisations, and community groups in Ireland photograph participants regularly for promotional purposes. Under the DPC's guidance, clubs must obtain signed consent forms before using participants' images on websites, social media channels, or in printed materials. For under-16 participants, parental consent is mandatory.

Schools and educational institutions: Irish schools must obtain parental consent before photographing or filming students for yearbooks, websites, school newsletters, or social media. The Department of Education and the DPC have published joint guidance confirming that schools are data controllers in respect of student photographs and must comply with the GDPR. School media release forms should clearly distinguish between internal use (e.g. notice boards) and external publication (e.g. the school website or social media).

Marketing campaigns and advertising: advertising agencies, brands, and marketing departments in Ireland creating content for television, online advertising, social media, or print publications must hold signed media release forms from every identifiable person featured. Under Articles 9 and 10 of the GDPR, additional consent requirements apply where images reveal special category data — for example, images that reveal a person's health condition, disability, or racial or ethnic origin.

HR and employee communications: employers wishing to use employee photographs in staff directories, internal newsletters, company websites, or recruitment marketing materials must obtain separate, specific consent under Article 6(1)(a) of the GDPR, as the employment relationship creates a power imbalance that means employment consent is unlikely to be considered freely given for non-essential purposes.

Journalism and media organisations: the GDPR provides a derogation for journalism and freedom of expression under Article 85 and section 43 of the Data Protection Act 2018, but this must be balanced against individuals' privacy rights, and media organisations in Ireland should have clear policies and, where appropriate, release forms for non-news uses of identifiable images.

Ireland's GDPR-compliant Media Release Form must contain specific elements to satisfy the consent requirements of the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018, and to provide the data controller with a defensible record of lawful processing for the Data Protection Commission (DPC).

The data controller identification clause must state the full legal name and address of the organisation or individual controlling the use of the images — the data controller as defined in Article 4(7) of the GDPR. Where the data controller is a company registered with the Companies Registration Office (CRO), the CRO number and registered office address should be included. This information helps the data subject exercise their rights under Articles 15–22 of the GDPR.

The subject identification clause must state the full name, address, and (for a child) date of birth of the person being photographed or filmed. For child subjects, the form must also identify the parent or guardian providing consent, their relationship to the child, and their contact details.

The description of media clause must clearly describe what is being captured — photographs, video footage, audio recordings, or a combination — the date and location of the recording, and the event or context in which the recording takes place. Precision here prevents scope disputes and confirms the boundaries of the consent given.

The permitted uses clause is the core of the GDPR consent statement. Under Article 5(1)(b) of the GDPR, personal data may only be processed for specified, explicit, and legitimate purposes. The clause must list every intended use of the media — website publication, social media (with specific platforms named), print marketing, press releases, broadcast advertising, commercial licensing, or educational use. A general or all-encompassing statement of purposes is unlikely to satisfy the specificity requirement and may be challenged by the DPC.

The territorial and duration clause should specify the geographic scope of the consent (Ireland only, EU, worldwide) and the retention period — how long the images will be stored. Under Article 5(1)(e) of the GDPR, personal data must not be kept longer than necessary for the stated purpose. The form should state when images will be deleted and how they will be securely destroyed.

The data subject rights clause must inform the subject of their rights under the GDPR, including: the right of access (Article 15); the right to rectification (Article 16); the right to erasure / right to be forgotten (Article 17); the right to restriction of processing (Article 18); the right to object (Article 21); and the right to withdraw consent at any time (Article 7(3)). The clause must provide the contact details of the data controller's Data Protection Officer (DPO) or designated contact for data rights queries, and confirm that complaints may be made to the Data Protection Commission (DPC) at dataprotection.ie or by post to the DPC's offices at 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

The consent statement clause must contain a clear, specific, and affirmative statement of consent — for example: "I consent to [Organisation Name] capturing, storing, and using photographs and video footage of me for the following purposes: [list]. I understand that I may withdraw this consent at any time by contacting [contact details]." The statement must be signed and dated by the data subject or, for a minor, by their parent or guardian.

The withdrawal of consent clause should explain how consent may be withdrawn — for example, by emailing or writing to the data controller — and confirm that withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

The third-party sharing clause must specify whether images will be shared with third parties — photographers, graphic designers, social media agencies, press agencies, or commercial licensees — and must confirm that any such sharing will be done under a data processing agreement meeting the requirements of Article 28 of the GDPR.

For event organisers operating in Ireland, it is recommended that separate forms be prepared for minors (requiring parental signature) and adults, clearly distinguishing the scope of consent given. The forms-legal.com Media Release Form (Ireland) template includes all mandatory GDPR elements and is designed for use by Irish schools, sports clubs, businesses, and event organisers.