Informed consent for photos and video: what organisations need to know

A signed form is evidence of consent, but it is not the same thing. The Dóchas Guide to Ethical Communications says that identifying people in content, or getting permission to use material, does not on its own mean you have informed consent.³

Bond, the UK network for international development organisations, calls informed consent the cornerstone of ethical content and says it is much more than filling in a form.²

In practice, this means the person understands who you are, why you are taking the picture, where it will appear and what could happen as a result, and then chooses freely.

Rwanda’s data protection law is Law No. 058/2021 of 13 October 2021 relating to the protection of personal data and privacy. It defines consent as a freely given, specific, informed and unambiguous indication of a person’s wishes, given by a statement or a clear action.¹

Consent is valid only when the person decides freely after being told the consequences. It can be oral, written or electronic, and the organisation must be able to show that it was given.¹

Some information is treated as sensitive, including health status, medical records, religious beliefs, political opinion and family details. Sensitive data may be processed only on limited grounds, the first being the person’s consent. This matters for stories about health programmes.¹

The supervisory authority is the National Cyber Security Authority, which runs Rwanda’s Data Protection Office. Organisations that control or process personal data must register with it.¹⁵

The law also requires personal data to be stored in Rwanda unless the organisation holds authorisation to store it abroad, and a data breach must be reported to the authority within 48 hours.¹

We treat photographs, recordings and signed consent forms that identify people as personal data. This article is a summary for planning, not legal advice.

Under Rwanda’s law, when personal data belongs to a child under 16, consent must come from a person with parental responsibility, and it is acceptable only if it is given in the child’s interest.¹

UNICEF’s ethical reporting guidelines go further: they ask for permission from the child and the guardian for interviews, filming and, where possible, documentary photographs. The child’s best interests come before any other consideration.⁶

Bond suggests asking children themselves from around the age of seven or eight, in language they understand, alongside the signature of a parent or guardian.²

Bond also recommends that no member of a production team is ever left alone with a child.²

• Kenya: the Data Protection Act, 2019, set up the Office of the Data Protection Commissioner. It says a child’s data may not be processed unless a parent or guardian consents.⁷
• Uganda: the Data Protection and Privacy Act, 2019, set up a Personal Data Protection Office under the National Information Technology Authority. It limits the collection of children’s data without a parent’s or guardian’s prior consent.⁸
• Tanzania: the Personal Data Protection Act, 2022, set up the Personal Data Protection Commission, which began operating on 1 May 2023.⁹

If you work across borders, check the law of each country where you film and where you store the files.

UNHCR’s guidance on multimedia content asks teams to explain that an image or story could be seen all over the world, on the internet, television and radio.⁴

UNICEF asks reporters to make sure the child or guardian knows they are talking to a reporter, and to explain the purpose of the interview and how it will be used.⁶

Bond advises giving consent an expiry date and sharing it with contributors, noting that consent in perpetuity is not supported by the European Union’s data protection rules (GDPR).²

For children, Bond’s good practice is to retire images, or renew consent, three years after the picture was taken or when the child turns 18, whichever comes first.²

Dóchas asks organisations to explain that people can withdraw consent at any time and to give them a practical way to do it.³

Consent does not remove the duty of care. UNICEF says not to publish a story or image that might put a child, their siblings or peers at risk, even when identities are changed.⁶

Bond describes a triangle of risk: a story should never combine more than one of a recognisable face, a real full name and an exact location.²

The Core Humanitarian Standard (2024) requires that communications about people, including for advocacy and fundraising, are made with their informed consent and are accurate and respectful.¹⁰

UNHCR states that images without consent cannot be used, in particular for fundraising. Bond says that without evidence of informed consent, images should not be used for any promotion or fundraising.²⁴

The International Federation of Journalists advises against paying children, or their parents, for material about children’s welfare unless it is clearly in the child’s interest.¹¹

Bond asks organisations that use AI-generated images to say so in the caption.²

Our own policy is simpler: we never create or alter images of real people with AI, and we never present an AI image as a real photograph.

This is the process our teams follow. It is our practice, built on the sources above.

• Before the shoot: agree with the client who will be photographed, why, and where the images will be used.
• On the day: explain in Kinyarwanda, English, French or Kiswahili, and let people ask questions.
• Ask the person and, for a child, both the child and a parent or guardian.
• Record consent in writing or on video, with the date, the uses agreed and an end date.
• Store the consent with the images, with names, dates and context.
• Tell people how to withdraw consent, and act on it quickly.
• Review images of children after three years or when they turn 18.