Employee Headshot Policy: What to Standardize and a Template
TL;DR: Quick Answer
A headshot policy answers five questions: style standard, consent and usage, update triggers, new-hire onboarding, exceptions. One page suffices.
Standardize the frame (background, crop, register), never the person; photos are personal data, so consent for public uses is explicit and offboarding removal is stated.
Trigger-based updates (appearance change, role change, 2-3 year backstop) beat calendar cycles.
The new-hire clause is where AI generation changes the policy: one selfie during onboarding, matching photo the same week.
Direct answer: An employee headshot policy answers five questions: what the photos look like (style standard), who they belong to and where they may be used (consent and usage), when they get updated (triggers), how new hires get one (onboarding), and who owns exceptions. Most companies need one page, not a handbook chapter. Here is what to standardize, the legal points worth taking seriously, and a template to adapt.
What to standardize, and what to leave alone
Standardize the frame, not the person: background, crop, lighting style, and formality register. That is what makes a directory look coherent. Leave individual expression, grooming, and appearance alone beyond ordinary workplace norms; policies that reach past the frame into how people look generate friction and, in some jurisdictions, legal exposure. The practical test: two photos taken a year apart under your policy should look like they belong to the same company, not like the same person.
Consent and usage rights
The photo shows an identifiable person, which makes it personal data under GDPR and similar regimes. The policy should state where photos appear (directory, website, proposals, social), obtain consent for those uses explicitly rather than bundling them, and define what happens at offboarding: photos come down from public surfaces within a stated window. Employees should also know whether providing a public-facing photo is required for their role or optional; for most roles, internal-directory photos are a reasonable requirement while public website presence is consent-based.
Update triggers and cadence
Calendar-based refresh cycles fail quietly: the photo day gets postponed and the directory ages. Trigger-based policies work better: update when appearance changes materially (recognition is the standard), on role changes that alter where the photo appears, and at a maximum age (two to three years) as the backstop. The policy should make updates cheap to request, because the expensive part of stale directories is usually process friction, not employee reluctance.
See your headshot before you pay
Upload one selfie and get a professional result in about 60 seconds. No credit card.
Try it freeNew hires and the consistency problem
The policy breaks in week one of every new hire unless it answers how someone who joined after photo day gets a matching photo. The traditional answers, wait for next year or accept a mismatched local shot, both undermine the standard. This is the case where AI generation changes the policy itself: with a locked company style, a new hire uploads one clear selfie during onboarding and receives a photo that matches the whole directory the same week. The policy line becomes one sentence: new employees complete their headshot during onboarding using the company style.
A one-page template
Purpose: consistent, current professional photos across [directory, website, proposals]. Style standard: [background, crop, register], maintained centrally. Participation: internal directory photo required; public website inclusion by consent. Consent: uses listed above, granted at onboarding, withdrawable for public surfaces. Updates: on material appearance change, role change, or every [2-3] years, whichever first. New hires: headshot completed during onboarding via [process]. Offboarding: public photos removed within [30] days. Exceptions: [owner/role] decides. Adapt the brackets, keep it to a page, and link it from onboarding. For the rollout mechanics behind the policy, see the company headshots guide; for budgeting the program, the cost breakdown covers all routes.
Frequently asked questions
Can an employer require employee headshots?
Generally yes for internal business uses like directories and badges, applied consistently and with reasonable accommodation. Public-facing use is better handled by consent; requiring it broadly invites avoidable disputes.
Do employee photos fall under GDPR?
Yes: an identifiable person's photo is personal data. State the purposes, obtain explicit consent for public uses, secure storage, and remove public photos promptly at offboarding.
How often should company headshots be updated?
On recognition-breaking appearance changes, role changes affecting where the photo appears, and a two-to-three-year backstop. Trigger-based beats calendar-based because it tracks reality instead of scheduling.
How do new hires get matching headshots?
With photographer-based programs, they wait for the next session or submit a mismatched photo. With a locked AI style, they upload a selfie during onboarding and match the directory immediately, which is why the policy line can be one sentence.
Related reading
Frequently Asked Questions
Can an employer require employee headshots?▼
Generally yes for internal business uses like directories and badges, applied consistently and with reasonable accommodation. Public-facing use is better handled by consent; requiring it broadly invites avoidable disputes.
Do employee photos fall under GDPR?▼
Yes: an identifiable person's photo is personal data. State the purposes, obtain explicit consent for public uses, secure storage, and remove public photos promptly at offboarding.
How often should company headshots be updated?▼
On recognition-breaking appearance changes, role changes affecting where the photo appears, and a two-to-three-year backstop. Trigger-based beats calendar-based because it tracks reality instead of scheduling.
How do new hires get matching headshots?▼
With photographer-based programs, they wait for the next session or submit a mismatched photo. With a locked AI style, they upload a selfie during onboarding and match the directory immediately, which is why the policy line can be one sentence.
Ready to get started with TeamShotsPro?
Generate professional AI headshots in 60 seconds.
Try it free
About the Author
Founder & CEO, TeamShotsPro
Matthieu van Haperen runs TeamShotsPro and writes about professional photography, team branding, and practical ways distributed teams can keep employee imagery consistent.
Connect on LinkedIn →