A photo from Saturday's match, a group shot from the summer fête, a clip on the club's social account — for most clubs and societies this is just how the year gets documented, and it rarely gets a second thought. Where children appear in those photos, though, it stops being a purely social question and becomes a data protection one, and it's an area where clubs and small charities tend to handle things worse than either a business or a formally "compliant" organisation would, not through carelessness but because nobody ever framed it as a decision that needed making.
A photograph of an identifiable child is personal data in exactly the same sense a name on a membership list is. Publishing it — on a website, a public social account, a printed programme — is a form of processing, and that means it needs a proper basis, not just an assumption that a photo taken at a public club event is automatically fine to share publicly.
Consent isn't the only route, but it has to be handled properly if it's the one used
Consent is the basis most clubs reach for instinctively, and it can be the right one — and good practice, in the direction the ICO's own guidance points, is a granular approach rather than one blanket yes/no: a parent might be comfortable with a team photo in a printed programme but not with an individually named, tagged post on a public social account, and a genuine consent process gives them that choice rather than forcing an all-or-nothing decision. Whatever is agreed needs to be recorded — who consented, when, and specifically to what — and if a parent later withdraws that consent, it has to actually be honoured, including removing images already published where that's reasonably possible.
Consent isn't the only lawful basis available, either — the ICO is explicit that it won't be the right fit in every circumstance, and another basis can apply instead, which matters because consent brings its own overhead of records and withdrawal-handling that not every situation needs. What the ICO does recommend regardless of which basis is chosen is offering an opt-out: a way for a parent to say no to their child's image being used, independent of whatever the club's formal legal basis for the rest of its photography actually is. What isn't a legitimate approach, under any basis, is simply not making the decision at all and hoping the question never comes up.
Safeguarding is a separate question from consent, and it needs answering too
Getting consent right is necessary, but it's a different question from what a published image actually shows and how it then gets shared — and treating the two as the same thing is exactly the gap that catches well-meaning clubs out. It's entirely possible to obtain textbook-clean, fully documented consent for a photo and still create a real safeguarding problem in the image itself: consent covers whether a photo can be used at all, not whether that specific photo is safe to publish. Sport-specific safeguarding guidance, from bodies like the NSPCC's Child Protection in Sport Unit, goes further than data protection guidance on its own ever will on exactly this point.
Two content rules do most of the work. Names generally shouldn't be published alongside a child's image — CPSU guidance recommends removing names and other identifying detail from published photos unless there's a specific reason not to, such as promoting a named elite young athlete. And for activities that involve minimal kit — swimming and gymnastics are the clearest examples — the recommendation is to avoid full-face-and-body shots altogether, using a shot from above the shoulders, or of a swimmer submerged in water, instead.
Online sharing carries its own separate risk, independent of what the photo itself shows. Tagging a child in a social media post can make them individually findable in a way an untagged photo doesn't, which CPSU guidance flags as a genuine risk in its own right, not just a data protection technicality. It's also worth asking parents and spectators directly not to post their own match-day or event photos on social media — other people's children appear in those photos too, and their families haven't necessarily agreed to that.
One rule sits outside the photo-publishing question entirely but belongs in the same policy: no phones, tablets, or any camera-capable device in changing rooms or shower areas, for anyone — players, spectators, staff, and volunteers alike, without exception. That's a blanket rule, not a judgement call made event by event.
What this looks like done properly, without turning into a project
In practice this doesn't need a formal safeguarding department. It needs a short, written photo policy covering both halves of this at once — the consent side (what's photographed, where images might be published, how a parent can say no in advance, opt out, or withdraw consent later) and the safeguarding side (no names alongside images, no full-face-and-body shots in minimal-kit activities, no tagging, the changing-room device ban, and a request to parents and spectators not to re-share) — agreed once and handed to whoever's taking pictures that week, rather than each event depending on a good instinct in the moment. That's a small piece of groundwork that turns a genuinely reasonable set of practices most clubs already follow into something they could actually demonstrate if a parent, or a regulator, ever asked them to.