Before and after photos: getting permission

This is general guidance, not legal advice. Follow your product manufacturer's instructions and check with your insurer and professional body for your own situation. The practical suggestions below are suggestions, not rules.

Why permission matters

A photo of a client in which she can be recognised is information about her. Official UK data protection guidance defines personal data as "any information relating to an identified or identifiable natural person". In practice, treat a recognisable face as identifying, and remember that a name in the caption identifies someone too. If she can be picked out, treat the photo with care.

The same guidance says that where you rely on consent, it must be freely given, specific and informed, and it needs a clear action from the person. Silence, pre-ticked boxes and inactivity do not count, and confirming that someone has read your terms is not enough. You also have to be able to show that she agreed.

What to ask

Ask before you take the photo, not after. Cover three things in plain words:

1. What you will photograph: the treatment only, or her face as well.
2. Where it may appear: your website, your social media, printed material, or just your own records.
3. That she can say no, and that saying no changes nothing about her treatment.

A practical suggestion: give separate choices. A client may be happy for a close-up of her lashes on your website and not for her face on social media. Do not bundle photo permission into your general booking terms.

Faces, and the awkward cases

Where you can, frame the shot on the work: a brow, an eye area, an arm, the back of a head. That is often kinder to the client and to you. Take extra care with photos of intimate or sensitive areas, and with anyone who may feel pressured to agree. For tattoo work, a practical suggestion is to ask before photographing a healed piece, and think about whether the placement makes her identifiable. A practical rule many owners follow is to never use a photo of a client who has not agreed, even if it is the best result you have had.

Recording it

Keep a simple record: her name, the date, what she agreed to and where. A signed line on her form works, or a tick on her record. Keep any photo link to that record so you can find the permission when you need it.

Withdrawing permission

The guidance says people have "the right to withdraw consent easily and at any time". Tell clients how: a message to you is enough. Once she asks, stop using the photo as soon as you reasonably can. Taking a post down on your own site is quick. Photos already shared elsewhere, or printed, are harder, which is why it is worth being clear at the start about where they will appear. If you are unsure what a withdrawal means for photos already shared, ask a professional.

How we help

A photo you link to a client shows on your website only while her answer on her card is yes, and a photo that shows her face needs a separate yes. If she changes her mind, from the details link in her emails or by telling you, the photo comes off your website within a few minutes. Her form asks about social media and print as separate questions, and her answers show on her card. We never post anywhere for you, so what you share on social media is yours to take down: keep your own note of where each photo has appeared. See our page for your craft.

Do this next

1. Write a short photo permission wording with separate choices for website, social media and print.
2. Add it to your consultation form or ask for a tick on her record before the first photo.
3. Decide how you will remove a photo when asked, and where you will check.
4. Go through your current gallery and remove anything you cannot show permission for.

Sources

• Official UK data protection guidance: what is personal data
• Official UK data protection guidance: what is valid consent

Last checked 22 October 2026. General guidance, not legal or tax advice.

Read next

• Consultation and consent forms: what to ask, what to keep, how long

  A good consultation form protects your client and your business, and it only works if you ask the right things, keep it safe and keep it long enough.

  3 min read

• Patch tests explained: when, how often and how to record them

  A patch test is a small, early check for an allergic reaction, and the record you keep of it matters as much as the test.

  3 min read

• Why your clients' records should be yours, not your booking app's

  You are responsible for your clients' information, so it should live somewhere you control and can always get back out.

  4 min read