GDPR and whiteboard photos: when does it apply?
Short answer
Under GDPR, if a whiteboard contains personal data — names, contact details, employee performance information, customer data — a photograph of that board creates a new personal data record subject to GDPR rules including data minimization, storage limitation, and access rights. This applies to any organization with EU data subjects, regardless of where the photo is taken.
## When GDPR applies to a whiteboard photo
GDPR applies to the processing of personal data relating to individuals in the EU. "Processing" includes storing, transferring, and analyzing. A whiteboard photo is a document — taking the photo, saving it, and sharing it are all processing activities.
GDPR applies if the board contains:
- Names of employees, customers, or prospects who are EU residents
- Email addresses, phone numbers, or other contact information
- Performance data, salary information, or HR decisions
- Health information (also subject to additional Article 9 protections as special category data)
- Any information that can identify a specific individual
GDPR generally doesn't apply if the board contains:
- Only strategic plans, product features, or business processes with no named individuals
- Aggregated or anonymized data
## The specific obligations
Data minimization: Don't capture or store more personal data than necessary for the purpose. If you only need the action items from a meeting, BoardSnap's text output (which you control) is more data-minimized than a full photo of the board.
Storage limitation: Don't keep photos with personal data longer than necessary. Delete the raw photo once you've extracted what you need.
Access control: Personal data photos shouldn't be in shared drives accessible to people who don't need them.
Data subject rights: Individuals have the right to know what data you hold about them and to request deletion. A whiteboard photo containing someone's name is in scope.
## Practical steps for GDPR compliance
- Before photographing: consider whether the board contains personal data and whether the photo is necessary
- Capture in BoardSnap rather than saving to the general camera roll — this limits the number of copies
- Use BoardSnap's text output to extract what you need, then delete the raw photo
- Don't share the photo externally unless there's a legal basis
- If your organization processes EU personal data, include whiteboard photos in your data inventory and retention policy
Note: This is general information, not legal advice. Consult your Data Protection Officer or legal counsel for organization-specific guidance.
Frequently asked
Is BoardSnap GDPR compliant?
BoardSnap is built to handle user data responsibly. For specific GDPR compliance questions, review the privacy policy at boardsnap.ai/privacy and contact [email protected] with any data protection inquiries.
Does photographing a whiteboard with names on it require consent?
GDPR requires a lawful basis for processing — consent is one basis, but legitimate interests or performance of a contract may also apply. The requirement isn't always explicit consent, but there must be a valid lawful basis. Consult your DPO for your specific context.
See it work in ten seconds.
BoardSnap is free on the App Store. Snap a board — get a summary and action plan.