POPIA and Event Photography: What SA Companies Must Get Right Before Their Year-End Function

That's the compliance floor. Here's how to actually meet it without ruining the party.

Why photography suddenly became a POPIA problem

POPIA's grace period ended on 30 June 2021, and the Information Regulator has been steadily enforcing since. A photograph of an identifiable person is "personal information" under Section 1 of the Act. Uploading that photograph to LinkedIn, a company website or a WhatsApp broadcast counts as "processing" — and processing requires lawful justification under Section 11 of POPIA.

Companies get caught out because they assume employment automatically implies consent. It doesn't. As Mayet Attorneys note, employer consent to photograph staff must be "freely given, specific, informed and voluntary" — coerced blanket consent buried in an onboarding contract fails the test (Mayet Law, 2024).

The three lawful bases you'll actually use

1. Consent. The safest route for external-facing use (social media, marketing decks, the corporate website). It must be documented, specific to the purpose, and revocable.

2. Legitimate interests. Section 11(1)(f) allows processing where it's necessary for the legitimate interests of the responsible party. Internal newsletters and archival records often qualify — but you need a written balancing test on file.

3. Contractual necessity. If the photograph is required to perform a contract (e.g. staff ID cards, security access photos), consent isn't required. This one rarely applies to events.

The event-day checklist that keeps you compliant

• Post visible signage at every entrance: "By entering this event you acknowledge that photography and video may take place. If you prefer not to be photographed, please collect a red lanyard at reception."
• Maintain a red-lanyard opt-out register — cheap, low-friction, and a strong defensibility signal
• Include a POPIA clause in your photographer's contract confirming SA-hosted galleries, consent-driven publication and image deletion timelines
• Never photograph minors without written parental/guardian consent — POPIA elevates children to special personal information
• Brief the photographer verbally: "Red lanyards do not appear in the gallery."

Where most Gauteng companies fail

Three patterns show up repeatedly. First, no signage at all — the "everyone knows we take photos" defence, which the Regulator has been unimpressed by. Second, using photos for marketing that were captured on a legitimate-interest basis for internal comms only (that's purpose creep, expressly prohibited by Section 15). Third, storing edited galleries indefinitely on foreign-hosted platforms — a cross-border transfer issue under Section 72.

What Event Photography SA does differently

Every booking includes a printable POPIA consent-signage pack in English, isiZulu and Afrikaans, a red-lanyard opt-out register template, and a written commitment that galleries are hosted on South African servers with defined retention windows. The photographer signs a data-processing addendum with your organisation before the event — putting you on the right side of Section 21.

Sources: POPIA Section 11 official text · Mayet Law POPIA year-end guidance · Michalsons Photography Law · Information Regulator SA