What may a club do with photos of members and children?

A committee wants two things at once: pictures on the site and no trouble with parents. This piece sets out what the Dutch DPA (Autoriteit Persoonsgegevens) writes about it itself, and where practice in the Netherlands differs from what clubs assume.

8 min readupdated March 17, 2026checked August 30, 2026

the short answer

A photo in which somebody is recognisable is personal data, so you need a lawful basis to publish it. For members under sixteen the parent gives that consent, and you do not have to ask for it again every season. A match report by the webmaster can fall under journalistic purposes, but promotion and portraits of one child do not.

An audience with their hands in the air during a performance — the performance, just before the applause

When does the GDPR apply to a photo from the club?

As soon as somebody is recognisable in it. The Dutch DPA writes that you can assume people in your photos are almost always identifiable, and that you do not need to know their name for that: a recognisable build can be enough (autoriteitpersoonsgegevens.nl).

There is one exception that clubs often use wrongly. The household exemption applies when somebody keeps photos private or shares them within a very small circle at most, in a family chat for instance. A father putting his own photos in the team app falls under it. The club doing it does not, because the exemption does not cover organisational use.

Who gives consent for a child under sixteen?

The parent or guardian. From sixteen the member gives consent themselves. The Dutch DPA puts it this way for schools: if the pupil is younger than sixteen, you need consent from the parents (autoriteitpersoonsgegevens.nl). The same line applies at a sports club, and Dutch club lawyer Arthur van der Hoeff says so in as many words (sportknowhowxl.nl).

Consent has to be freely given, unambiguous, and specific to a particular processing operation and a particular purpose. That last requirement is the one most often missed: consent for the club magazine is not consent for Facebook. And you may not make membership depend on it, because then the consent is not free. A child who may not be photographed still has to be able to play football.

Do you have to ask for consent again every season?

No, and this is where most articles on the subject go wrong. The Dutch DPA states it for schools without any detour: you do not have to ask for consent again every school year, you can arrange this at enrolment. Kennisnet says the same and does advise reminding parents once a year that they can change or withdraw their consent (kennisnet.nl).

Two moments where you do arrange it again. If the processing changes, because the photos now go to a sponsor as well for instance, the old consent is no longer specific enough. And when a member turns sixteen, you preferably inform them yourself. Put it on the enrolment form and keep track of who said yes: you have to be able to demonstrate that you have the consent.

Is a photo in the clubhouse different from a photo on the website?

Legally, less than you hope. Van der Hoeff writes that the safe route applies to photos put online and to photos in a club magazine or a leaflet alike. A clubhouse exception that covers the noticeboard does not exist.

What does differ is reach, and that counts in your assessment. A photo on a public club site is findable by anyone and ends up in Google. A photo in an album behind a link that only the parents of that team have is not. For schools the Dutch DPA names a portal that only parents and pupils can log into as an appropriate measure, in so many words.

That gives you a split you can explain to the committee in two sentences. Pictures for the participants go in an album with a link and an end date. Pictures the club uses outwardly are a second purpose, with separate consent and a smaller selection. How you set those two albums up alongside each other is in the guide on tournament photos.

Does a match report count as journalism?

It can, and that is less far-fetched than it sounds. Article 43 of the Dutch GDPR Implementation Act (Uitvoeringswet AVG) sets aside large parts of the law for processing solely for journalistic purposes (wetten.overheid.nl). The term is read broadly and no press card is needed for it. Congressus writes that the sports club webmaster who puts match photos on the site falls under it (congressus.nl), and verenigingen.nl also names the press release to the local paper (verenigingen.nl).

Note the word solely in the law. Put the same photo under a call to join or in a sponsor's message and the purpose is no longer solely journalistic. And the Dutch DPA points organisations photographing at an event to consent in the first place (autoriteitpersoonsgegevens.nl). Build a report on this, not a photo policy.

A full room with people mingling — the clubhouse, when everybody came in at once

And what about the opposing team and their parents?

This is the problem no step-by-step guide solves, so we will just say it. Your tournament photos have children from four other clubs and their parents in them. You have consent from none of them, going round eighty visitors is not realistic, and the visiting club cannot give that consent on behalf of its members. This is not solved, it is managed. What clubs do:

Legitimate interest as the basis, with a decision on record. Van der Hoeff advises that the club's highest body takes that decision, as the KNVB did for broadcasting amateur matches.
Informing people at the gate. The Dutch DPA names a sign at the entrance as a way to say what you do with the pictures and that people can object.
Wide shots instead of portraits. Avoid one child standing out in the frame, because that is where the balance tips.
Always honouring an objection. Legitimate interest carries the right to object, and that means you take a photo down months later too.
Not making the album public. Behind a link with an end date the reach is a fraction of that of a page in Google.

how we do this

An album behind a link, with moderation if you want it

The album is not in Google and there is no browsable page with other clubs in it. Turn approval on and nothing joins the album before the administrator has seen it, and deleted files stay recoverable for fourteen days.

Make your club's album See how it works

What a committee asks

Do we as a club have to keep a record of processing activities?

Yes. The KVK, the Dutch chamber of commerce, writes that a club has to draw up a privacy statement and a record of processing activities: which personal data you process, why, and how you secure it (kvk.nl). Images belong in it. And according to that same page you may not simply send a membership list to your members.

Can we put a photo of the winning team on Facebook?

Only with a lawful basis. A match report by the webmaster can fall under journalistic purposes. A post meant to recruit members does not, and then you need consent from everybody recognisable in it.

A parent wants their child off the site. Do we have to do that?

Yes. Consent may always be withdrawn, and that has to be as easy as giving it. If you work on legitimate interest, the right to object applies. In both cases taking it down is the right answer.

What if a member does not give consent?

Then you publish no recognisable photos of them. It may not affect their membership or their place in the team, because otherwise the consent was not freely given. Keep track of who said no.

Does this apply to photos the coach puts in the team app?

As long as he shares them as a parent within a small circle, that falls under the exception for personal or household use. If the same photos go to the club website, the club is doing it and the GDPR applies.

Is this the same as at a company party?

The rules are the same, the relationship is not. With an employer the question is whether consent is genuinely freely given, at a club it is children and their parents. That side is written up separately.