New ICO Journalism Guidance Sets Clear Standards for Archiving and Processing Images

30 September 2026

In its July 2023 Data Protection and Journalism Code of Practice, the Information Commissioner's Office (ICO) has clarified how GDPR rules apply to journalism, including how news organisations handle archived images as well as current reporting practices.

The guidance, issued after the Commissioner's statutory review of journalism-related data usage in 2022, establishes strict standards for the lawful, transparent and accurate collection, processing and storage of information about living individuals.

The ICO has confirmed that no technology removes organisations' obligations. Personal data must be provided immediately upon request, with policies in place to retrieve electronically archived information for this purpose. Archives maintained for public interest, scientific or historical research, and statistical analysis represent the only exceptions to standard retention limits, where the alternative would be deletion or anonymisation.

Organisations must clearly inform individuals about personal data handling practices and rights limitations through their Privacy Notices.

The guidance clarifies that the journalism exemption under Section 32 protects freedom of expression as guaranteed by Article 10 of the ECHR. This exemption isn't automatic and organisations must justify each case individually.

Photographs or video that can identify individuals constitute personal data. While anonymising such material helps organisations use data lawfully, it doesn't eliminate the requirement for full legal compliance.

Practically, all organisations with 250+ employees must maintain detailed records of archiving processes, especially for sensitive or criminal offence data. They must also publish a comprehensive Privacy Notice outlining legal bases, retention periods and security measures.

The requirement for accuracy involves nuance. News archives don't need updating with later facts, but any known errors must be corrected.

News organisations must now establish policies for capturing personal images, set retention periods, implement specific security measures and create procedures for access rights. Non-compliance carries risks of significant fines or more serious consequences.

Key considerations include:

1. Practical privacy notices. The public should clearly understand why personal data is collected and the limits of consent, particularly given the intrusive potential of filming.

2. Retention specifics. Clear policies must determine which images are kept, their storage duration, and procedures for sanitising or destroying them.

3. Basic data security. Effective security controls are essential, governing access permissions, storage methods and distribution (such as providing material to journalists in the field).

While not legally binding, news organisations would be prudent to integrate the ICO's guidance into their operations and technology systems as if it were law.