Before publishing an identifiable person, distinguish permission to show that person, copyright in the photograph and the lawful processing of personal data. A model release is not a universal GDPR certificate.
Three questions, not one checkbox
First, establish your right to use the photograph. Next, assess permission to publish the person's image under the applicable law. Finally, determine the data-protection basis and information requirements for your actual activity. Paying a photographer does not automatically answer all three questions.
In Poland, Article 81 of the Copyright Act generally requires permission to disseminate a person's image, with statutory exceptions. These include specific circumstances involving paid posing, public figures performing public functions and a person who is only a detail of a wider whole. Do not turn those exceptions into a blanket rule for every paid shoot, group portrait or public location.
Document a specific decision
Article 81 does not impose a universal paper-signature requirement. Nevertheless, keep a clear record identifying the person, photographs, publisher, purpose and agreed channels. A compliment about the photographs is not an explanation of permitted use.
Prepare the intended publication plan before asking. A portfolio, a paid advertisement and another company's promotion may involve different purposes. Discuss names, tags, duration and any planned modifications. This is a practical planning list, not ready-to-sign legal wording.
Handle privacy information properly
Where GDPR applies, choose the appropriate basis before processing. If relying on consent, it must meet the applicable conditions and be demonstrable. Give the relevant privacy information; simply writing "GDPR compliant" is insufficient. Consider access to files, retention, recipients and platforms as part of the real workflow.
For children, check who can represent them and assess the particular publication carefully. Do not adapt an adult form merely by changing the signature line.
Can someone withdraw consent?
GDPR consent can be withdrawn. The consequences of withdrawing image-publication permission and any contractual dispute require separate assessment. Do not promise that every third-party copy can be erased from the internet.
Does a template guarantee protection from claims?
See our Instagram publication checklist. General Polish-law information, not individual legal advice. References reviewed 24 September 2026: Copyright Act Article 81; GDPR Articles 6, 7, 13 and 17; EDPB Guidelines 05/2020.
Cover: editorial illustration. It does not depict an actual KARIROOM room, included equipment, client session or preset result.