Drones, data protection and TV production: Navigating the regulatory risks

Written by Ilan Jones, Associate in our Media & Entertainment team.

Drones are now a staple of TV production, offering everything from sweeping landscapes to dynamic crowd shots. But their use comes with complex rules. Producers must balance aviation regulations with data protection and privacy obligations to avoid legal and reputational risks.

When is drone footage considered personal data under UK GDPR?

Drone footage frequently captures images of individuals who can be identified, either directly or indirectly. Under the UK GDPR and the Data Protection Act 2018, such footage qualifies as personal data. This means producers can become data controllers with obligations to process that data lawfully, fairly and transparently.

Imagine filming an outdoor concert. The aerial shot captures thousands of attendees, many clearly identifiable. Even if the footage is incidental, it still counts as personal data. Without a lawful basis for processing, this footage could present regulatory risks.

What guidance has the Information Commission* issued on drone use in TV production?

The Information Commission has published guidance on surveillance technologies, including drones. It stresses the need for privacy by design, data minimisation and impact assessments.

*Following the enactment of the Data (Use and Access) Act 2025, the Information Commissioner’s Office (ICO) has been abolished and replaced with the Information Commission.

Aviation and broadcast regulation

Alongside data protection law, drone filming for TV must meet both aviation and broadcast rules. In the UK, the Civil Aviation Authority (CAA) regulates drone operations, requiring registration, pilot competence and adherence to airspace restrictions. Any footage intended for broadcast will also need to comply with Ofcom’s Broadcast Code, particularly when filming private property, people in their homes, or sensitive sites.

Do producers need consent for drone filming under GDPR?

Filming with drones raises questions about consent. While it may be impractical to obtain written consent from every individual in a crowd scene, producers must still have a clear lawful basis for filming under UK GDPR. Carrying out a Data Protection Impact Assessment (DPIA) before filming can help demonstrate that risks have been considered and mitigated.

Privacy rights under Article 8 of the European Convention on Human Rights must be respected, particularly where filming intrudes into private life. Drones heighten these risks by enabling novel perspectives, such as filming into private spaces, even when unintended. Without careful planning and appropriate safeguards, a striking aerial shot can quickly turn into a legal problem.

Practical GDPR compliance steps for producers using drones

Producers can take practical measures to manage risks:

• Conduct DPIAs before using drones, particularly in public or sensitive settings.
• Minimise data collection by limiting filming angles, duration and resolution where possible.
• Put clear contributor agreements in place to cover aerial footage rights.
• Train production staff on GDPR obligations and ensure data protection is embedded in production planning.
• Review policies on retention and secondary use of drone footage.

What is the future of drone regulation in UK broadcasting?

As drone technology advances, regulation is tightening. The CAA has already signalled stricter rules in urban areas and for larger drones, and the Information Commission has suggested that it may issue film-specific guidance on privacy. For producers, the priority is clear: build compliance into creative planning. Staying engaged with updated, consultations and advice will keep productions both compliant and competitive.

Drones are now integral to TV production, but they bring privacy risks that cannot be ignored. Creative innovation must sit alongside regulatory responsibility, supported by proactive planning and robust contracts.

We regularly support production houses, broadcasters and trade bodies, combining broadcast compliance and data protection law expertise.