We want to publish a customer testimonial with a name and photo – how do we do it lawfully?

Often, yes. Personal data is any information relating to an identified or identifiable natural person (Article 4(1) GDPR). Recital 26 GDPR says that, to determine whether a person is identifiable, account should be taken of "all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly".

In practice, judge the whole testimonial, not just the name:

Our recommendation: if in doubt, treat it as personal data and ask for consent. Consent costs one email; a dispute about whether a person can be identified costs far more.

On photos, Article 2.22(1) CK provides that a person's photograph, portrait or other image may be reproduced, sold, displayed or printed, and the person may be photographed, only with their consent. Paragraph 2 sets out exceptions, for example where the photograph is taken in a public place, but even then it may not be displayed if that would degrade the person's honour, dignity or business reputation. Relying on these exceptions for advertising and testimonials is risky – consent is the safest route.

Article 7(2) GDPR requires that, where consent is given in a document that also concerns other matters (for example a survey or an order form), the request is clearly distinguishable from the other matters and written in clear and plain language. Article 7(3) GDPR requires that the person be told, before giving consent, that it can be withdrawn at any time, and that "It shall be as easy to withdraw as to give consent".

A sample text you can send by email together with the testimonial text:

I agree that [company name] may publish my testimonial below:
☐ on the company website
☐ on the company's social media accounts
☐ in advertising

Show with the testimonial: ☐ my first name and surname ☐ my first name and initial ☐ company and job title ☐ my photo

I know I do not have to agree. I can withdraw my consent at any time by writing to [email address]; the testimonial will then be removed from the website and social media within [5 working days]. More about how we process data: [link to the privacy notice].

Testimonial text: [text]

The link to the privacy notice is there because, when collecting data, you must give the information listed in Article 13 GDPR.

Good practice: if you shortened the testimonial or corrected the language, show the person the final text. The consent covers the text they saw.

Article 7(1) GDPR: where you rely on consent, you must be able to demonstrate that the person gave it. Keep:

1. the person's reply – an email or a signed form with the date;
2. the approved testimonial text and photo, exactly as they saw them;
3. the channels ticked and the name format;
4. the date of withdrawal, if they withdraw.

Keep all of this in one place, for example a "Testimonials" folder, so that two years later you do not have to search the whole mailbox.

A review being public does not mean you may use it in your own advertising. The person published it on the platform; moving it to your website or advertising is your own processing for your own purpose, and it needs a basis of your own under Article 6(1) GDPR. If you also show the person's profile photo, Article 2.22 CK applies as well.

Two safe routes:

• ask the author – reply to the review or write to them and ask for consent using the sample above;
• a link instead of a copy – show the overall rating and a link to the platform, rather than reviews with names and photos.

Where consent is withdrawn and there is no other legal ground, the data must be erased (Article 17(1)(b) GDPR). The procedure:

1. record the withdrawal – put the date in the same folder where you keep the consent;
2. take the testimonial off the website no later than you promised in the consent text;
3. social media – delete or edit the posts with that testimonial;
4. advertising – stop the ads that use it;
5. others – if you gave the testimonial to a partner, tell them it must be erased (Article 19 GDPR). Because you published the testimonial, Article 17(2) GDPR also requires you, taking account of available technology and the cost of implementation, to take reasonable steps to inform other controllers processing it that the person has asked for links to it and copies of it to be erased.

Withdrawal does not work retroactively: processing before withdrawal remains lawful (Article 7(3) GDPR). So leaflets already handed out do not have to be recalled, but do not hand out the remaining ones or print new ones with that testimonial.

If you keep a record of processing activities, describe publishing testimonials as a separate process: purpose – marketing; basis – consent; data categories – name, job title, company, photo, testimonial text. Article 30(1)(b) and (c) GDPR require the purposes and categories in the record.

Go through the testimonials already on your website. For each one, check whether you have the person's consent. Where you do not, send the sample text or remove the name and photo.

With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities, and see which processes deserve attention.

Is a customer's verbal approval over the phone enough?
The GDPR sets no form for consent, but you must be able to demonstrate it (Article 7(1)). So after the call, ask the customer to confirm by email.

Do we need consent if the testimonial has no name?
If the person cannot be identified from the text, it is not personal data. Check that the text contains no details by which people who know them would recognise them.

The customer has left the company on whose behalf they gave the testimonial. Must we take it down?
No, leaving the company does not withdraw consent. But the job title in the testimonial is no longer accurate, so ask the person whether to keep it, update the title or remove it.

Can we publish an event photo in which customers are visible?
If people in the photo can be recognised, Article 2.22 CK applies: the photo may be published only with their consent, unless an exception in paragraph 2 applies, for example the photo was taken in a public place. At a private event, mention in the invitation that photos will be taken and where they will be published, let those who do not want to be photographed opt out, and publish only photos whose subjects have agreed; for advertising, always only with consent.

• Consent to process data: how to ask for it and prove it
• Employee photos on the website and social media: how to handle them
• Is a website privacy policy mandatory? (in Lithuanian)
• Can we send a newsletter to existing customers? (in Lithuanian)

The law and the risk: Personal data published without consent: what to do and what to demand – dat.lt

• Definition of personal data – Article 4(1) GDPR; when a person is identifiable – recital 26
• Consent as a legal basis – Article 6(1)(a) GDPR
• Proof, separation and withdrawal of consent – Article 7(1), 7(2) and 7(3) GDPR
• Information when collecting data – Article 13 GDPR
• Erasure after withdrawal of consent – Article 17(1)(b) GDPR; data made public – Article 17(2)
• Notifying recipients of erasure – Article 19 GDPR
• Exemption from keeping a record – Article 30(5) GDPR
• Purposes and categories in the record – Article 30(1)(b) and (c) GDPR
• Right to one's image – Article 2.22 of the Civil Code (CK), paragraphs 1 and 2

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679, 04.05.2016); Civil Code – e-tar.lt consolidated edition from 2026-07-31 (the text of Article 2.22 CK is unchanged in the published future editions from 2026-09-27, 2026-12-09 and 2027-11-01). This text is general information and is not individual legal advice.