Does GDPR Apply to Worker Certificate Photos?

Quick answer

Treat certificate photos like other HR-adjacent records: collect what you need for competence evidence and client checks, keep them secure, restrict who can download them, and do not keep them longer than your retention policy allows. Avoid informal WhatsApp archives with no access control.

Why certificates are personal data

They usually show names, photos, dates of birth or card numbers. Combined with employer and site assignment, they identify individuals. “It’s just a CSCS card” is not a privacy analysis.

• Store files in a controlled system, not shared open drives
• Limit admin rights to people who need to verify evidence
• Avoid emailing full packs to wide distribution lists when a portal will do
• Have a retention and deletion approach for leavers

Practical controls for matrices

1. Explain to workers why you collect certificate images.
2. Collect via a secure upload path where possible.
3. Keep evidence tied to the requirement row — easier to delete later.
4. Review access when people change H&S or admin roles.
5. Follow your organisation’s privacy notice and DPO guidance.

Clients and subprocessors

When you upload evidence to a client portal, you are often sharing personal data with another controller or processor. Share the minimum needed for the check. Your contracts and privacy documentation should cover these flows — software vendors should not invent that for you.

Honest limits

FieldClear stores evidence you upload so you can organise training records. This guide is not legal advice and does not determine your lawful basis or retention periods. Speak to your privacy lead or solicitor for advice on UK GDPR compliance. FieldClear does not certify competence or provide accreditation.