Nobody turns up to a UGC shoot thinking they are processing personal data. You film in a kitchen, a neighbour walks past, the phone stays recording, somebody sends their ID number by message so they can be invoiced, and by the end of the day there is a folder of material identifying several people who signed nothing.
Law 25.326 does not talk about shoots, it talks about personal data, and it defines that data as information of any kind referring to identified or identifiable persons. A recognisable face in a video belongs there, which is why it is worth knowing what the law requires before piling up hours of footage.
What gets collected without anyone noticing
The problem is not the data you deliberately ask for. It is the data that stays behind.
| What is left after the shoot | Who the subject is | What you need |
|---|---|---|
| Rushes with people in the background | every identifiable person | keep them out of frame, or get consent |
| Ambient audio with other people's conversations | whoever is speaking | cut it, because consent here is impractical |
| ID or tax numbers sent for invoicing | the person who sent them | keep them only as long as needed |
| Comments containing health details | whoever commented | treat as sensitive and never reuse |
| A contact list of creators or clients | each contact | a stated purpose and a right of access |
By contrast with an image release, which gets thought about because the brand asks for it, everything above accumulates on its own and nobody decides anything. That is exactly the point.
Consent here has a form
This is the difference that most surprises anyone coming from another framework. Article 5 requires free, express and informed consent, and adds that it must be recorded in writing or by another means treated as equivalent.
It is not enough that the person saw the camera and did not object. It is not enough to have "go ahead, film" said in passing. Written form, or something equivalent that leaves a record, is part of the requirement.
For a shoot that translates very simply: the paper somebody signs is not a client formality, it is the form the law gives to consent. And if the shoot happens where people can walk through, the sensible decision is about framing rather than signatures, because getting a passer-by's consent is impossible in practice.
What has to be said when data is collected
Article 6 lists what the person has to know at the moment their data is requested. It is not small print: it is prior information.
They must be told what the data will be used for and who will receive it, that a database exists and who is responsible for it, whether answering is compulsory or voluntary, what happens if they do not answer, and that they have the right to access, correct and delete.
Translated into a message asking a creator for their tax number, no legal text is needed: it is enough to say what it is for, who keeps it and until when. Three lines almost nobody writes, and they resolve most of the problem.
Purpose is the rule broken most often
Article 4 says data may not be used for purposes different from or incompatible with those that motivated its collection.
It is the rule broken most often in this trade, and almost always with good intentions. The footage was shot for one campaign, it looked good, and six months later the brand uses it in another piece; the creator list built for a casting gets reused to pitch something else; the happy client video gets recycled as a testimonial on a different channel.
None of that is automatically unlawful, but none of those reuses was in the original purpose, and so it requires asking again. The cheap way to avoid it is to write the purpose realistically from the start, rather than writing the narrowest possible one and then breaking it.
Footage reused in another campaign
It is the most frequent case and the one that most resembles an acquired right. The brand paid for the shoot, holds the files and uses them again for something else.
Two permissions that almost always get confused are worth separating. The rights assignment over the video governs what the brand may do with the piece; the consent of the person filmed governs what may be done with their data. A contract can settle the first and say nothing about the second, and then the reuse is uncovered on the side nobody looked at.
The casting list that gets recycled
A call goes out, forty replies arrive with name, phone, city and sometimes age, three people are chosen, and the list stays. Months later somebody uses it to pitch another campaign.
The thirty seven who were not chosen gave their data for a specific purpose that has ended. The right move is to delete them when the call closes, or to ask at collection time whether they want to be kept for future searches, which is one checkbox and one sentence.
The testimonial that changes channel
A client records a testimonial for the website and later turns up in a paid ad, or the other way round. The medium changes, the reach changes and sometimes the country it is shown in changes.
It is the case where it pays most to write the purpose broadly but honestly from the outset: saying it will be used on owned channels and in advertising, and saying it beforehand, costs the same as saying it badly.
Sensitive data, which shows up more than you would think
Article 2 defines as sensitive, among others, data relating to health or sexual life. In UGC these appear constantly without anyone calling them that.
A creator saying she uses a product for a skin condition is giving health data about herself. A comment under the video where somebody asks about their own treatment is too. And a casting call asking about sizes, pregnancies or medical conditions is collecting sensitive data with a Google form.
The prudent conduct is the same in all three cases: do not collect what you do not need, never reuse it outside the original purpose, and do not display it on screen or in the description.
The rights the other person can exercise
Articles 14 to 16 give the subject three rights that are exercised, not requested as a favour: access their data, correct it when inaccurate, and ask for its deletion, with short deadlines and at no cost.
For a brand or a creator working with several people, that means somebody will eventually write asking for a video to be taken down or their data erased. The difference between a problem and an errand is whether you know where the material is.
Which is why the administrative part of this is not a legal register but a tidy folder: knowing what was filmed, of whom, with what permission and until when. It is the same notebook that serves the licences.
What to do before the first shoot
- Decide the framing based on who might appear, not the other way round. Moving the camera is cheaper than collecting ten consents.
- Have your own consent text, short, stating purpose, media, term and rights. One text, reusable.
- Store rushes with a deletion date, and delete them. Keeping everything forever is what turns an old shoot into a new problem.
- Keep invoicing data separate from creative material. They are different purposes and have no reason to live in the same folder.
The reasonable objection is that this looks disproportionate for somebody filming alone at home. It is, if the shoot really is alone. It stops being so the moment a second person appears on camera, a casting form goes out or a contact list exists, and those three moments arrive sooner than expected.
One clarification about database registration is also worth making: article 21 requires registering databases that provide reports with the control authority. It is an obligation that exists and that does not describe most creators' situation, so it is worth checking with the authority rather than assuming either that it applies or that it does not.
Sources
- Law 25.326 on Personal Data Protection, full text
- AAIP, personal data protection
- Decree DNU 274/2019, Lealtad Comercial
Checked on 12 September 2026. This guide is not legal advice. Where this guide and the official source disagree, the source prevails.
