Privacy and data protection
A drone with a camera processes personal data whenever images can identify a person, even if you never publish them. Under the GDPR, you need a lawful basis, a defined purpose, and you must respect data minimisation, storage limitation, and integrity and confidentiality. People have rights of access, rectification, erasure, and objection. A data protection impact assessment (DPIA) may be required for systematic monitoring of public areas.
Privacy is broader than data protection: it includes respect for private and family life and the home. National rules may restrict photography of people or private property. The fact that a place is public does not mean anything may be recorded. Operators should avoid capturing identifiable people unnecessarily, use privacy settings, secure footage, and delete data when no longer needed.
Traps: thinking privacy only matters if you post online; assuming “public place” means no rules; recording into gardens or windows; keeping footage indefinitely “just in case”; and ignoring bystanders’ reasonable expectations. If you are filming for a purpose, be able to explain the lawful basis and retention period.
Worked example: you fly to inspect your own roof, but the camera also records a neighbour’s garden. You angle the camera to minimise capture, check national privacy rules, and delete the incidental footage once the inspection is complete. This reflects minimisation and storage limitation.