May we publish an employee's photo on our website and social media?

The Civil Code. Article 2.22(1) of the Civil Code: a person's photo may be reproduced, sold, displayed or printed, and the person may be photographed, only with their consent. The rule covers taking the photo and showing it inside the company too. Paragraph 2 sets out exceptions, for example where the photo relates to the person's public activity or official position, or is taken in a public place. Relying on these exceptions for a "team" page or an advertising post is risky – it is safest to have consent.

The GDPR. A photo from which a person can be identified is personal data. Because publishing it is not necessary to perform the employment contract, the basis is usually consent – Article 6(1)(a) GDPR. Why consent works here although it usually does not at work is explained in the dat.lt article (link at the bottom of this page).

A group photo at an event is a grey zone. Safest is to say in advance that photos will be taken and where they will be published, and to offer a way to opt out.

Four rules:

1. Best: a separate document, not a clause in the employment contract. Article 7(2) GDPR requires the request to be clearly distinguishable from other matters, and Article 7(4) requires you to consider whether a contract is made conditional on consent. A separate document meets both most easily.
2. A separate choice for each channel, if there are several. Some people are fine with the website but not social media.
3. How to withdraw, stated on the form itself. Article 7(3) GDPR: the person is told of the right to withdraw before consenting, and withdrawing must be as easy as giving consent.
4. No consequences for saying no. An employee who does not agree must not lose anything at work.

Sample text

I agree that [company name] may use my photo:
☐ on the "Team" page of the company website
☐ on the company's social media accounts
☐ in company presentations to customers

I know I do not have to agree and that refusing has no effect on my work. I can withdraw my consent at any time by writing to [email address]. If I withdraw, the photo will be removed from the website and presentations within [5 working days].

Date, name, signature.

Choose a period in the square brackets that you will actually meet.

Article 7(1) GDPR: you have to be able to prove that consent was given. Keep the signed form or an email confirmation together with which channels were agreed. If you change the form's wording, keep the old version too – each consent is valid to the wording the person signed.

1. Record the withdrawal date next to the consent.
2. Remove the photo from the website and presentation templates within the period stated on the form.
3. On social media, remove, crop or blur the photo in every post where the employee can be identified, unless you have another legal basis. Withdrawal does not affect processing lawfully done before it, but you can no longer keep showing the photo.
4. Check copies – the photo library, design files, partners' websites you gave the photo to.

Article 17(1)(b) GDPR: when consent is withdrawn and there is no other basis, the data is erased.

Leaving does not by itself withdraw consent. But a former employee on the team page misleads customers, so in practice the photo comes down on their last day. Old social media posts – such as an event photo from two years ago – may stay if consent has not been withdrawn and the post is not misleading.

Add photo removal to the leaver checklist, next to closing accounts.

List every place where employee photos appear today and check that you have consent for each. Enter photo use in your record of processing activities as a separate process. With the tool (in Lithuanian) you can find out free of charge whether a record is mandatory for you.

Is a clause in the employment contract enough?
It is risky. A clearly separated clause may formally meet Article 7(2) GDPR, but consent inside an employment contract is often not free: everything is signed together, and Article 7(4) requires you to consider whether the contract is tied to consent. A separate form is safer.

Can we use a photo if the employee agreed verbally?
The burden of proof is yours. Verbal consent without a record is very hard to prove.

Does a managing director's photo need consent?
Our cautious recommendation is yes. Article 2.22(2) of the Civil Code has an exception where the photo relates to the person's official position, and it may cover a director, but its limits are a matter of judgement. Consent removes the doubt.

How long does consent last?
Until it is withdrawn, and while the photo is used for the purpose agreed. If the purpose changes – for example you want the photo in an advert though consent covered only the website – you need new consent.

• Consent to process data: how to ask for it and prove it
• Employee privacy notice: how to prepare it
• Is a website privacy policy mandatory? (in Lithuanian)

The law and the risk: Why an employee's consent to data processing is almost never valid – dat.lt

• Right to one's image: consent, exceptions, remedies – Article 2.22 of the Civil Code, paragraphs 1–3.
• Definition of consent – Article 4(11) GDPR; consent as a basis – Article 6(1)(a).
• Proof, separate request, withdrawal, freely given – Article 7(1), 7(2), 7(3) and 7(4) GDPR.
• Erasure when consent is withdrawn – Article 17(1)(b) GDPR.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). Civil Code – e-tar.lt consolidated version from 2026-07-31; English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.