A model release is a contract. The right to be forgotten is a statutory right under data protection law. The two are not the same kind of instrument, and the assumption that one cancels the other — in either direction — is the source of a recurring class of disputes between photographers and models. The release is treated by photographers as a final settlement of usage rights; the right to erasure is treated by models as an absolute override. Neither characterisation is accurate, and the gap between them is where the practical work of managing this relationship sits.
This article is for photographers and models working in jurisdictions where GDPR (or a directly equivalent regime such as the UK GDPR, Brazilian LGPD, or — for state-resident likeness questions — California's combination of CCPA and right-of-publicity statutes) applies. It is not legal advice. It is a working description of how the contractual and statutory layers interact, where the incongruences sit, and how both parties can structure their working relationship to reduce the friction.
The key takeaway
A signed model release does not extinguish a model's data protection rights. A GDPR erasure request does not automatically undo a valid contract. Both instruments operate in parallel, and both have to be managed in parallel — through scoped releases, named lawful bases, and a documented process for handling data subject requests.
This guide is for you if...
For photographers
- You want releases that hold up when scope is contested
- You need to handle takedown and erasure requests properly
- You work across jurisdictions and need to understand GDPR
- You want to reduce disputes before they escalate
- You're building an audit-ready archive and consent process
For models
- You want to understand what you're signing away
- You're considering an erasure or objection request
- You want to keep statutory rights despite a signed release
- You need to negotiate scope, not just sign templates
- You're working with photographers across borders
Two different instruments, two different sources of authority
The model release is a private contract. It grants the photographer (and sometimes downstream publishers, platforms, licensees) specific permissions to use the model's likeness for specified purposes. The scope is whatever the contract says it is. Releases vary enormously — from one-paragraph editorial-use confirmations to multi-page assignments of broad commercial rights. The legal force comes from contract law: offer, acceptance, consideration, capacity, and the rules of the relevant jurisdiction.
The right to be forgotten is something else entirely. It is a statutory right under Article 17 of the GDPR, retained by the data subject regardless of what contracts they have signed. The right exists because data protection law treats personal data — including photographs of identifiable people — as a category that natural persons cannot fully alienate. Even a freely signed contract cannot extinguish certain statutory rights in advance. The two instruments sit on different legal foundations, and confusing the two is the root of most of the conflict that follows.
A model release is not a privacy waiver. A privacy waiver is not really a coherent legal instrument under GDPR in the first place. Statutory data-subject rights are not pre-waivable, and treating the release as if it does that work is where the incongruence begins.
What a model release actually does — and doesn't — do
A well-drafted model release does several useful things. It records that the subject consented to being photographed, defines the scope of permitted uses, sets the territory and duration, and may include warranties from both parties. For the photographer, it establishes the contractual right to use the images within the agreed scope, including, where applicable, the right to license them onward. For the model, it sets the limits beyond which the photographer cannot go without further permission.
What the release does not do is settle the data protection layer. Whether the photographer can lawfully process the images as personal data — store them, share them, publish them, retain them — depends on identifying a lawful basis under Article 6 of the GDPR. The release may be evidence of consent (Article 6(1)(a)), or it may sit alongside a separate lawful basis such as legitimate interests (Article 6(1)(f)) or the performance of a contract (Article 6(1)(b)). Different lawful bases trigger different data subject rights, which is why the choice matters.
This is the first practical incongruence: photographers often draft releases that look like permission slips, but the statutory framework requires them to also be — or to coexist with — a documented lawful basis under data protection law. A release that doesn't identify which lawful basis is being relied on leaves the photographer exposed and the model uncertain about which rights they retain.
What the right to be forgotten actually does — and doesn't — do
Article 17 is not an absolute right. It applies where one of six specific grounds is met: the data is no longer necessary for the original purpose; consent is withdrawn and no other lawful basis exists; the data subject objects and there are no overriding legitimate grounds; the data was unlawfully processed; erasure is required by law; or the data was collected from a child in specific contexts. None of these are automatically triggered by a model deciding they would prefer the images no longer existed.
It is also subject to exceptions under Article 17(3). Retention may remain lawful where it is necessary for freedom of expression and information, for compliance with a legal obligation, for archiving in the public interest, scientific or historical research, or — significantly for photographers — for the establishment, exercise, or defence of legal claims. These exceptions are real and they matter, but they have to be applied case by case rather than asserted in the abstract.
The second practical incongruence sits here: models sometimes treat the right to erasure as a button that, once pressed, deletes content everywhere. It is not. It is a structured request with specific grounds, specific exceptions, and a deliberative process. A photographer who refuses to engage with such a request entirely is mishandling it. A model who treats it as a guaranteed delete-all override is also mishandling it.
The lawful basis problem, in plain terms
The most consequential question in any model-release relationship under GDPR is: what is the lawful basis for processing? The answer determines what happens when the relationship sours.
If consent is the lawful basis (Article 6(1)(a)), the model can withdraw that consent at any time. Withdrawal must be as easy as giving consent in the first place. Once consent is withdrawn, the photographer needs another lawful basis to continue processing, or processing must stop and — in many cases — the data must be erased. This is a fragile basis for commercial photography because it gives the model unilateral cancellation power.
If legitimate interests is the lawful basis (Article 6(1)(f)), the photographer relies on a documented assessment that their legitimate interests in using the images are not overridden by the model's rights and freedoms. The model cannot simply "withdraw" — there was no consent to withdraw — but they can object under Article 21, and the photographer must then demonstrate compelling legitimate grounds to continue. This is sturdier than consent but not unbreakable.
If performance of a contract is the lawful basis (Article 6(1)(b)), processing must actually be necessary for the contract, not merely useful or convenient. This basis is narrower than photographers often assume and rarely covers the full lifecycle of commercial image use beyond what's strictly needed to fulfil the agreed assignment.
The release should say which of these the photographer is relying on. Releases that don't address this leave the question to be resolved later, often under adversarial conditions.
The point most releases miss
A model release that grants broad usage rights but doesn't identify the GDPR lawful basis is doing only half the job. The contractual grant tells you what the photographer may do; the lawful basis tells you what data protection rights the model retains. Both layers exist in parallel. Drafting the release as if only the first layer matters is the most common failure mode in this area.
Where the conflicts actually arise
In practice, disputes between photographers and models around release scope and data protection rights cluster in a small number of recognisable scenarios.
Scope creep. The release was signed for editorial use, the photographer later licenses for advertising. The release was signed for stills, the photographer produced video from the same session. The release was signed for a specific publication, the photographer's archive is later sold or transferred. These are contract questions in the first instance — did the use fall within the granted scope — but they also become data protection questions, because uses outside the contractual scope often lack a lawful basis under data protection law as well.
Reputational change. The model's circumstances change — career, public profile, personal life — and content that was acceptable at the time of the shoot is no longer acceptable to them. Nothing in the original release is invalidated, but the model has data protection rights that may apply going forward. The honest reading is that the original contract remains good for the uses already made, but the right to object — and in some cases the right to erasure — applies to future processing.
Platform takedown vs. archive deletion. A model asks for content to come down from a publishing platform. The photographer removes the public listing but retains the files. The model later discovers the files still exist. Whether this is compliant depends on the exact request, the lawful basis, and what the photographer's retention policy says — but the gap between "remove the listing" and "erase the data" is a recurring source of misunderstanding.
Third-party distribution. The photographer licensed images onward; the model approaches the photographer for removal. Erasure obligations under Article 17(2) require the original controller to take reasonable steps to inform downstream controllers of the request. This is rarely costless, and few releases set out the practical mechanism for handling it.
What photographers should do
Draft releases that are specific
The single biggest source of trouble is vague scope. Specify the media — stills, video, audio — separately. Specify the uses — editorial, commercial, third-party licensing, derivative works — separately. Specify the territory and the duration. Specify whether the photographer may transfer the rights and to whom. A release that grants "all rights, all uses, in perpetuity, worldwide" is enforceable in some jurisdictions but is also far more likely to be contested. Tighter scope makes both parties' expectations clearer.
Identify the lawful basis explicitly
State, in the release, which Article 6 lawful basis the photographer is relying on for processing the images as personal data. For commercial photography this is most often legitimate interests, sometimes accompanied by consent for specific uses where consent is genuinely the appropriate basis. Document the legitimate interests assessment separately, in line with normal GDPR compliance practice.
Set out the request-handling procedure
The release should explain how the model exercises data subject rights: where to send a request, what information to include, what timelines apply, what the photographer will do in response. This isn't an admission of weakness — it's the documented procedure that data protection law expects controllers to have anyway. Including it in the release surfaces the process before any dispute arises.
Maintain audit trails
Keep records of when and where images were shot, who was present, what was signed, which platforms the content was published to, and what subsequent communications occurred. In the event of a dispute, this is what protects both parties from accusations that the facts of the original engagement are different from what either side now remembers.
Distinguish unpublishing from erasure
If a model asks for content to be removed, find out what they're actually asking for. "Take it down" might mean unpublish from the platform, or it might mean erase from the archive entirely. The two have different implications under both contract and data protection law. Confirming which is being requested, in writing, prevents most of the follow-on disputes.
What models should do
Read scope carefully before signing
The release defines what the photographer may do with the images. "All media, all uses, in perpetuity" gives away substantially more than "editorial use only, two years, EU territory." If the release is broader than the assignment requires, ask why, and ask for it to be narrowed. Releases are negotiable, and photographers who refuse to negotiate scope at all are signalling something about how they intend to use the work.
Insist on media-specific language
A stills release does not cover video. A video release does not cover audio. If the shoot involves multiple media, the release should address each one separately, with separate consideration of scope. Bundling everything into a single grant is convenient for the photographer and risky for the model.
Keep your own copies
Every release, every email confirming usage, every change to scope — keep your copies in a place you control. Photographers' records may not survive business changes, and the burden of evidence in a later dispute is often heavier on whichever party has the worse documentation.
Understand the statutory rights you retain
Under GDPR you retain the right to access, rectification, erasure (within Article 17 grounds), restriction, objection, and data portability. These are not contingent on the release. They are statutory and survive any contractual language to the contrary. Knowing which rights you have, and on what grounds, is the difference between an effective request and one that the photographer can decline on procedural grounds.
Make requests in writing, with grounds
An erasure request that just says "delete everything" is easier to dispute than one that cites the specific Article 17 ground, identifies the lawful basis being challenged, and sets out what is being asked for. The clearer the request, the harder it is to ignore or mishandle, and the more likely it is to be resolved without escalation.
BentBox is a curated marketplace built on verified identity and documented consent
ProntoID-verified creators, human-reviewed content, and a platform process for handling data subject and takedown requests in a structured way.
Become a BentBox creatorHow both sides can manage the tension better
The honest reading of the contract / right-to-erasure overlap is that neither side gets a clean answer in advance. The release does real work — it establishes what the photographer may do contractually. The right to be forgotten does real work — it preserves statutory rights the model cannot waive. The two layers operate in parallel rather than in sequence.
The practical conclusion is that the relationship needs to be structured as if both layers exist, because they do. That means releases that name the lawful basis, scope that's specific enough to be enforced, request procedures that are documented in advance, and a mutual understanding that withdrawal of consent (where applicable) is forward-looking — it does not unwind past licensed uses, and it does not automatically delete every file. It also means that when a model exercises a statutory right, the photographer engages with the request on its merits rather than treating the signed release as a complete answer.
This is not a one-size-fits-all template. Jurisdictions differ. The UK GDPR diverges in places from the EU GDPR. Image rights and personality rights — distinct from data protection — vary substantially across Europe and are particularly strong in some civil-law jurisdictions. Outside the GDPR area, equivalent regimes (LGPD in Brazil, POPIA in South Africa, state-level statutes in the US) produce similar tensions but with different mechanics. A release that works in one jurisdiction may not in another, and serious commercial work usually warrants jurisdiction-specific legal advice rather than reliance on generic templates.
A practical checklist for the working relationship
- Have the scope conversation before the shoot, not at the contract signing. Talk through which media, which uses, which territories, which duration. The model should understand what they are granting before they read the document.
- Use a release that names the lawful basis explicitly. State whether processing relies on consent, legitimate interests, or contract necessity, and document the reasoning separately. Generic releases that don't address data protection are working only at the contract layer.
- Separate the media in the document. Stills, video, audio, behind-the-scenes content, derivative works — each should be addressed individually with its own scope. Bundled grants are the single most common source of later disagreement.
- Build a documented request-handling procedure. Set out how a data subject request is made, what timelines apply, what the response process looks like. This is a GDPR compliance baseline regardless, and including it in the release sets expectations before any dispute arises.
- Distinguish unpublishing from erasure in advance. Agree how each will be handled, and what each costs. Most platform takedowns are reversible; erasure from the archive is not. The model should know which they are asking for, and the photographer should know which they are being asked to do.
- Get specialist advice for cross-border work. Where the photographer, the model, and the publishing platform are in different jurisdictions, the data protection and image rights position is materially more complex. A model release drafted for one country's law may not protect either party adequately in another.
The summary
The signed model release and the right to be forgotten are not in opposition. They are different instruments addressing different legal questions, and they are both real. The contractual grant determines what the photographer may do; the statutory right determines what the model retains regardless. The recurring mistake — by both sides — is to treat one as cancelling the other. It doesn't, in either direction.
The relationship works best when both parties accept the dual structure from the start: a specific, scoped release with a named lawful basis; a documented procedure for handling data subject requests; and a mutual understanding that statutory rights survive contractual language and that contractual rights survive the assertion of statutory ones, within their respective limits. Most of the actual disputes in this space are downstream of one or both parties trying to compress this two-layer reality into a single document that does work it cannot do.
This article is general information about the interaction between model releases and data protection rights. It is not legal advice. Photographers and models with specific questions — particularly in cross-border situations or where a dispute is already underway — should consult qualified legal counsel in the relevant jurisdiction.
Frequently asked questions
Does a signed model release override the GDPR right to be forgotten?
No. A model release is a contract granting usage rights to a photographer or publisher. The GDPR right to erasure is a statutory right held by the data subject. Statutory rights cannot be contracted away by the data subject in advance. A valid release means the photographer has a lawful basis to use the images for the agreed purposes, but the model can still exercise data protection rights — including objection and, in some circumstances, erasure — and the photographer must engage with those requests on their merits.
If a model withdraws consent, does the photographer have to delete everything?
It depends on the lawful basis the photographer relied on. If processing was based on the model's consent under Article 6(1)(a), withdrawal generally ends the lawful basis going forward, and erasure may follow unless another basis applies. If processing was based on legitimate interests under Article 6(1)(f), withdrawal of consent is not the relevant mechanism — the model would instead exercise the right to object under Article 21, which triggers a balancing test rather than automatic erasure. The distinction matters and should be addressed in the release itself.
Is a photograph of an identifiable person personal data under GDPR?
Yes. Under UK and EU GDPR, a photograph of an identifiable natural person is personal data. The photographer or publisher acts as data controller in respect of how that image is collected, stored, and used. This is true regardless of whether a model release was signed — the release governs contractual usage rights, not the underlying data protection obligations.
Can a photographer refuse a takedown request if a model release was signed?
Not on the strength of the release alone. The photographer can refuse only if a recognised ground under Article 17(3) applies — for example, processing necessary for freedom of expression, for the establishment or defence of legal claims, or where legitimate interests demonstrably override the data subject's request after a balancing assessment. A contractual grant of usage rights is not itself an Article 17(3) ground, and treating it as a complete answer to an erasure request is a recurring source of disputes.
What should a model release actually contain to reduce later disputes?
Scope should be specific: which media (stills only, video, audio), which uses (editorial, commercial, third-party licensing), which territories, which duration, and whether resale or transfer to third parties is permitted. The release should identify the lawful basis under data protection law, name the controller, describe how data subject requests will be handled, and set out a documented procedure for withdrawal, objection, or erasure requests. Vague or all-encompassing language is the most common cause of later disagreement.
Does removing content from a platform count as compliance with an erasure request?
Not necessarily. Removal from a public-facing platform is one step, but erasure under Article 17 may also require deletion from the controller's archives, working copies, backups within retention windows, and notification to third parties to whom the data was disclosed. The exact scope depends on the request and the lawful basis previously relied on. Platforms hosting the content are typically separate controllers or processors with their own takedown processes that the photographer should know how to initiate.
About the author: Jane Sundbury
Jane Sundbury leads marketing and communications at BentBox, where she works with creators and models to help them publish, position, and market their work effectively on the platform. Her focus is on giving creators the practical knowledge — how to present a Box, how to grow an audience, how to stay inside the lines of the platform's content standards and applicable law — that makes the difference between a profile that converts and one that doesn't.