Drone data protection

When drone imagery counts as personal data

Personal data is information about an identified or identifiable person. Drone footage becomes personal data when someone can be identified from it, either directly or from context, such as a face or a person seen in their own garden. The ICO notes that height and zoom make this easier than it looks, and the CAA's privacy guidance points out that the law applies even when the capture is unintentional.

The ICO separates hobbyists flying for purely personal reasons from people and organizations using drones professionally. Its guidance says organizations using drones are controllers for any personal data the drone captures. The CAA makes the same point more briefly: if you record images for commercial use, you must meet further requirements as a data controller.

Some data needs extra care. The ICO reads health data broadly, covering anything that reveals something about a person's health, and says you are processing special category data if you set out to infer such things or treat people differently because of them, however sure you are of the inference. That needs an Article 9 condition as well as a lawful basis. Ordinary photos are not biometric data, but they become so after specific technical processing, such as building templates for face matching. This matters most for thermal and close-up work, and the thermal inspection guide covers the survey side.

The UK GDPR is based on the EU GDPR, but they are now separate laws and differ in places. Whether the EU GDPR applies to a UK operator flying a job in an EU state depends on its territorial scope rules in Article 3. These look at whether the processing is linked to an establishment in the EU, or whether you offer services to, or monitor the behavior of, people in the EU. The European Data Protection Board's guidelines explain the tests. Take local advice before working abroad.

Controller or processor: agree roles with each client

A controller decides why and how personal data is used. A processor handles it on a controller's behalf and follows their instructions. On a drone job the answer depends on who makes those decisions, so settle it before the first flight and write it into the contract.

If the client sets the brief and tells you what to capture, how to deliver it and when to delete it, you may be acting as their processor. The UK GDPR then requires a written contract (electronic form counts) that sets out the processing and your obligations, and you may only act on the client's instructions. If you go beyond them, for example by keeping footage for your own showreel, the law treats you as a controller for that use.

Where you decide what to record, how long to keep it and what to do with it, you are a controller. Some jobs make you and the client joint controllers, which needs an arrangement setting out who does what. The ICO's drone guidance starts from the view that an organization flying a drone is a controller, so think the processor label through before you rely on it.

Controllers must pay the ICO a data protection fee unless an exemption applies. The tier depends on staff numbers and turnover. The ICO has an online self-assessment that shows whether you need to pay and which fee applies.

Lawful basis, privacy notices and the people you film

Every use of personal data needs a lawful basis under Article 6 of the UK GDPR. Consent is hard to get from people who happen to be in shot. Legitimate interests is often more workable, but it means weighing your purpose against the effect on the people filmed and keeping a record of that assessment.

The Data (Use and Access) Act 2025 amended UK data protection law, and the ICO says all of its data protection provisions are now in force. It added a recognized legitimate interests basis, which removes the balancing test for a set list of purposes such as public security, so check that list before relying on it for commercial work. The ICO says its drone guidance is under review because of the Act and may change.

People being filmed often cannot tell who is flying or why. The ICO expects controllers to deal with this and suggests practical steps such as:

• Registering with the CAA, which helps link a flight to its operator
• Putting up signs where you are operating
• Publishing a privacy notice online that you can point people to
• Telling people before you record, where possible
• Writing the information down and keeping it easy to find where telling people on the spot is not practical

Impact assessments, retention and security

The UK GDPR requires a data protection impact assessment (DPIA) before any processing that is likely to result in a high risk, and always for systematic monitoring of a publicly accessible area on a large scale. The ICO's drone guidance expects a DPIA that covers recording from height and capturing people who are not the subject of the job. It also treats the DPIA as the place to decide whether a drone is the right tool at all.

The ICO's guidance points to ways to limit what you collect and keep, and to secure it:

• Make sure crews can switch recording and streaming on and off, and avoid continuous recording unless the DPIA justifies it
• Consider equipment with a narrower field of view, or that only records above a set height, and build this into buying decisions
• Keep the camera on the subject, such as the roof, and away from neighbouring property
• Keep footage for the shortest time the purpose needs, then dispose of it properly
• Store footage securely, for example with encryption and access controls, bearing in mind that a drone that crashes or flies beyond visual line of sight can be lost with its data

What a consultant does, and what to ask before hiring

A drone operations consultant can help you build data protection into the operation: drafting the DPIA, writing recording and retention procedures for the operations manual, preparing privacy notices and site signs, and checking that client contracts say who is controller. A consultant cannot promise how the ICO or a court will view a case, and contract wording or a live complaint calls for a solicitor. Consultants listed on DOC are vetted (identity, legal entity, sanctions screening and professional indemnity insurance), and regulator experience shows as verified only where it has been evidenced.

Questions worth asking before you hire:

• Have you written DPIAs for drone work like ours, and can we see a redacted example?
• How would you decide whether we are a controller or a processor on our main contracts?
• What recording, retention and deletion rules would you put in our operations manual?
• Will you work alongside our solicitor on contract terms, or should we arrange that separately?
• Who owns the documents you produce?

Common mistakes

Data protection gaps often come to light only when a neighbour complains, a client asks for your DPIA or an aircraft goes missing. The usual ones are:

• Assuming footage has no privacy angle because nobody was the target of the shot
• Recording from take-off to landing when only the survey itself was needed
• Accepting a processor role in a contract, then reusing the footage for marketing
• Writing a DPIA once and never updating it for new sites, sensors or clients
• Keeping raw footage indefinitely on laptops and memory cards with no encryption
• Not checking whether the ICO data protection fee is due