Privacy and data protection
When the law applies
A drone with a camera processes personal data whenever the images can identify a living person, and UK GDPR and the Data Protection Act 2018 apply to that processing even if you never sell the footage. The principles are familiar: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Identify your lawful basis and, for systematic monitoring, complete a data protection impact assessment. Underpinning all of this is the reasonable expectation of privacy of the people below you.
Applying it in the air
Plan the flight so you do not need to overfly gardens, windows or private land; record only what the task requires; avoid audio; tell people where practicable; store footage securely with a defined retention period; and know how you would answer a subject access request. Images can also engage nuisance, harassment and misuse-of-private-information concerns independent of data protection.
Traps: 'I am a hobbyist, so data protection does not apply' - the household exemption covers purely personal and domestic activity, and publishing or sharing footage can take you outside it. And 'it is a public place, so there is no privacy' - public spaces still contain identifiable individuals and still engage the law.
Rule of thumb - minimise, justify, delete: before every flight with a camera, ask what is the minimum you need to capture, why, and when you will delete it. If you cannot answer the third question, you have not finished planning.