Who answers for personal data when a brand commissions a video and someone else shoots it at home? The question sounds administrative and it decides very concrete things: who keeps the rushes, for how long, and who gets the complaint if something goes wrong.
What this is about, and what it is not
Worth marking out from the first line, because these are two areas that touch and do not overlap.
The right to one's own image and its assignment are a civil and contractual matter: what the person appearing signs, for which uses, for how long and in which territories. That is dealt with separately, in the image rights contract for UGC creators in Spain, and is not repeated here.
This article covers the other half: data protection during production. A different regime, a different authority, different obligations, and one practical consequence the rights assignment does not cover at all, which is what happens to the material once the campaign is over.
Who answers for the processing
The first question is not what gets signed, but who decides about the data. Everything else follows from that.
| Situation | Who decides about the processing | What it implies |
|---|---|---|
| The creator shoots to their own script and delivers the finished piece | they do, over the material they generate and keep | they answer for their rushes, their storage, and the people they filmed |
| The brand sets the script, the shots and what is kept | the brand | it has to be reflected in the commission, with written instructions |
| Both decide purposes and means together | both | a documented allocation of responsibilities |
It is not a label you pick for convenience: it follows from who actually decides. A tightly specified commission, with a shot list and an obligation to hand over all raw material, describes a different situation from receiving a product and an idea and shooting as you like.
The legal basis is not always consent
It is the reflex answer and not always the right one. Consent is one of the bases in article 6 of the General Data Protection Regulation, not the only one, and it has an awkward feature for a campaign: it can be withdrawn.
By contrast, a contractual relationship is not undone by a message: for the person fronting the video under commission, that basis and legitimate interest enter the analysis, each with its own conditions and limits.
For people with no relationship to the production at all, the approach is different, and that is where the most improvised case sits.
The people walking past
The ground where most improvisation happens. Shooting in a street, a coffee shop or a gym captures people who have signed nothing and who often have not even noticed.
The answer is not an authorisation you cannot collect, it is the design of the shot: tight framing, controlled backgrounds, quiet hours, blurring in post when someone identifiable appears. That solves the data question and the image question at once, and it is cheaper than either of them separately.
Leaning on the fact that a person appears "in the background" is a weak basis in a commercial piece, and no campaign should be built on it.
The rushes, which is where the problem lives
A campaign generates far more material than it publishes. Forty minutes of takes for a thirty-second video is normal, and that material contains the inside of a home, family voices, sometimes a child who wandered into the shot.
For how long, and who holds them
Three decisions need to be written down here, and almost no commission contains them.
Who keeps the rushes. The creator only, the brand only, or both. Each option has different consequences.
For how long. A concrete duration, tied to something real: the term of the licence, a limitation period, the campaign cycle. "Indefinitely" is not a duration.
What happens at the end. Effective deletion, with confirmation, including copies in storage services and on the phone the footage was shot with, which is where material survives every formal deletion.
When the material leaves the European Union
It happens more often than it seems. A brand based outside the EU, an intermediary agency, an editing or storage tool hosted elsewhere.
It is not a prohibition: it is a requirement of safeguards and transparency that must be foreseen and documented before anything is sent. The question to ask at signature is simple and almost never asked: where are these files going to be stored and who will be able to access them?
Shoots in sensitive places
A clinic, a pharmacy, a physiotherapy centre, a dental practice. Special categories of data, in the sense of article 9 of the Regulation, which carry a reinforced regime.
A shot of a waiting room can reveal that an identifiable person attends a treatment. That fact does not become innocuous because the video is about something else, and it is not solved by the sign at the entrance.
The workable route is to shoot outside opening hours, with the space empty and with extras who have accepted their part. It costs more organisation and removes the problem entirely.
The operational clauses
Five lines in the commission avoid this whole conversation later.
- Who decides about the processing and in what capacity each party acts.
- Which material is delivered and which never leaves the shooter's own equipment.
- Retention period for the rushes, with a date or an event that sets it.
- Deletion at the end, with written confirmation and express mention of copies.
- Storage location and any transfers foreseen outside the European Union.
None of the five replaces the image authorisation, which is a different document and a different regime.
Sources
- Organic Law 3/2018 on Data Protection and the guarantee of digital rights
- AEPD, complying with your obligations
- AEPD, Facilita RGPD tool
- AEPD, right to erasure
Checked on 10 September 2026. This guide is not legal advice and does not replace an examination of the individual case. Where this guide and the official source diverge, the source prevails.
