![[Freelance]](../gif/fl3H.png)
Register as a data controller
THE Freelance here presents a new advice section, coming soon to the NUJ Freelance Fees Guide. Please do get in touch if you have questions.
Data protection law is an important safety measure for all citizens and can be useful to investigative journalists. The other side of that is that if you are in Europe and you process personal data of any kind about other people – and that includes photographs – you must register as a “data controller”. In the UK you register with the Information Commissioner's Office (ICO): see link below for general information.
You should be aware that the register of data controllers is public and that the address from which you register will be available to the world. If the nature of your work means that this is a problem for you and you are a member of the National Union of Journalists,
If you are a journalist in the UK or Ireland or working for outlets in the UK or Ireland and you are not a member of the NUJ, join now.
As a rule of thumb: if you do journalism, you should register. If you work only as a sub-editor or a picture editor and all the data (files) involved are stored only on your clients' systems, never on yours... you may not need to.
Photographs can be personal data. The details get a bit philosophical: the ICO tutorial on what is personal data (see the link below) gives the example of a photographer capturing a beach scene for the paper: not personal data. A reader spots on the beach a colleague of theirs who was supposed to be at a funeral and sends the picture to their employer, who puts it in a personnel file: the same photograph is now personal data.
If you take a photograph of an NUJ Branch meeting and caption it naming those depicted, it is not just personal data but “special category personal data” because it relates to trade union membership.
In February 2026 registration with the ICO cost £52 per year.
Your duties
The following is only very general advice. See advice from the ICO and the Data protection and journalism code of practice, linked below.
You have a duty to keep personal data that you process secure. You must inform the ICO if there is a breach of security and should do so within 72 hours. In some circumstances the ICO can ask you to inform your data subjects.
You must take special care with “special category data”:
- personal data revealing racial or ethnic origin;
- personal data revealing political opinions;
- personal data revealing religious or philosophical beliefs;
- personal data revealing trade union membership;
- genetic data;
- biometric data (where used for identification purposes);
- data concerning health;
- data concerning a person’s sex life; and
- data concerning a person’s sexual orientation.
You may receive “subject access requests” seeking to know what information you hold on a data subject, or requests to correct data you hold. Whether these are a form of bureaucratic harassment to make the story just too much work would be a matter for the court in each case.
You will almost always be justified in invoking the exemptions for free expression to avoid giving any information. You must give individual reasons for each request. If you were to supply any information, you would be obliged to “redact” it so that you do not give out information about anyone else.
Journalists sometimes make subject access requests, for example to discover what data are held on us by law enforcement or other bodies.
A consequence of every data subject's right to correct data held on them is the “right to be forgotten”. Journalism – “exercising the right of freedom of expression and information” – is, however, partly exempted from this. Members should seek advice from the NUJ if you receive such a request.
Not everything you do is journalism
If you operate a mailing list or a website with a registration feature, these activities may be considered as part of your business and not part of your journalism. People whose information you hold for these purposes would then have, for example, the right to demand that you correct or erase it.
Information Commissioner's Office ico.org.uk
Register with the ICO ico.org.uk
What is personal data? ico.org.uk
How to get legal assistance for NUJ members