- Date
GDPR for AI Headshots: What EU Teams Need Before a Rollout
Before an EU team rolls out AI headshots, HR and legal need a vendor checklist — not a law-firm memo. Ask where employee photos sit, how long models last, who the subprocessors are, how deletion works, what legal basis you will use for staff portraits, and whether an admin can lock style and invite people. Headshots.so is a Danish company with EU-hosted databases, AES256, and models auto-deleted after 30 days. This page is procurement language. It is not legal advice.
English “corporate headshot” guides skip data location. Wednesday’s comparison ranked generators. This post is the B2B trust pass: the questions you put to us and to every other vendor before the first invite. Mail hey@headshots.dk if counsel wants the product facts in writing.
What should EU HR and legal lock before an AI headshot rollout?
Lock six things before the first selfie upload: data location, retention, subprocessors, deletion, the legal basis for employee photos, and team admin controls. A Danish company with EU-hosted databases and a 30-day model delete is easier to file than a US or Singapore tool that only prints “GDPR” in the footer. Treat this as procurement. Your counsel picks the legal basis. We do not.
Headshots.so already frames GDPR on the site: encrypted photos, European servers, delete anytime, commercial rights, locked matching backgrounds, admin invites. 180+ companies have used the same engine. Team list price from the homepage is $45 per person, 15% off at 15 people. That is product copy. It is not your DPIA.
Which questions belong on every AI-headshot RFP?
Put the same seven questions to every vendor — including Headshots.so, and including US or Singapore tools that market GDPR in 2026. Ask where primary storage sits, whether app servers or failover leave the EU, when models and uploads are deleted, who the subprocessors are, how an employee can erase files, and whether an admin can invite people and lock backgrounds. Write the answers into the record. A privacy-policy sentence is not the file.
- Where is primary storage, and do app servers or backups leave the EU?
- How long are uploads, generated images, and trained models retained?
- Who are the subprocessors, and are they SOC 2 or ISO 27001 certified?
- Can the employee and the admin delete uploads and generated photos anytime?
- How will you support the legal basis our counsel chooses for employee portraits?
- Can an admin invite colleagues and lock matching backgrounds?
- How do you handle EU AI Act Article 50 transparency for AI-generated images?
Where will employee photos actually sit?
Ask for the database region, not a slogan. Headshots.so hosts databases in the EU and encrypts with AES256. Image providers are SOC 2 and ISO 27001 certified — homepage FAQ, not a Headshots certificate. As of 2026 vendor marketing, some US tools store primarily in Frankfurt with US processing; some Singapore entities store photos in Western Europe with US app servers. Ask. Do not treat a marketing page as an audit.
Two names that come up often — as 2026 vendor marketing, not as something we audited: BetterPic (US company, primary storage in Frankfurt, some US processing) and HeadshotPro (Singapore entity, photo storage in Western Europe, US application servers and US failover). HR should still ask for the current region map. Marketing pages move.
What happens to models, uploads, and deletion rights?
Ask for three clocks: uploads, finished portraits, and the trained model. On Headshots.so, AI models are auto-deleted after 30 days, and a user can delete uploads and generated photos anytime. That matches the public FAQ. If a vendor only deletes “on request,” write the SLA. If they train a foundation model on staff faces, that is a different risk than a session model that disappears in 30 days. Your record should say which one you bought.
What does EU AI Act Article 50 add for teams from 2 August 2026?
Article 50 of the EU AI Act began applying on 2 August 2026. It is a transparency rule for certain AI systems and for some AI-generated content — not a stamp that a headshot vendor is “AI Act certified.” Ask any vendor how they mark or disclose AI-generated images, and what they expect you as the deployer to say on LinkedIn or the intranet. We do not claim Headshots is fully assessed against Article 50 beyond the product pages.
Put the question on the checklist. Counsel maps provider versus deployer duties. An intranet portrait is not the same fact pattern as a public deepfake. This page will not pretend otherwise. Read Article 50 itself if you need the obligation on the record.
How does Headshots.so answer the checklist?
Headshots.so answers with a Danish company, EU-hosted databases, AES256, SOC 2 and ISO 27001 providers, 30-day model delete, user-controlled deletion, a commercial license, and team admin that locks matching backgrounds and sends invites. Support is hey@headshots.dk in Denmark. The site frames GDPR — including “delete your photos anytime.” 180+ companies. Team pricing from the homepage: $45 per person, 15% off at 15 people. That is the product file. It is not your DPIA.
| Question | Headshots.so (product pages) | Ask any vendor |
|---|---|---|
| Data location | EU-hosted databases | Primary storage, app servers, failover? |
| Encryption | AES256 | In transit and at rest? |
| Providers | SOC 2 + ISO 27001 providers | Current subprocessor list? |
| Models | Auto-deleted after 30 days | Session model or foundation model? |
| Deletion | Uploads and generated, anytime | Employee and admin? |
| Team | Locked backgrounds, admin invites | Can you control look and access? |
Your national data-protection authority — and the EDPB — publish employment-data guidance. Read them there. Do not quote this article as law. The legal basis for employee portraits is your call. Consent at work is often fragile. We do not invent DPA quotations.
FAQ
These are the five questions EU HR and legal ask before a team rollout: whether this is legal advice, where the files sit, what gets deleted, what Article 50 adds, and what teams cost. The answers reuse the same 2026 product facts as the table, so you can quote them without rereading the guide. None of them replace your counsel.
Is this legal advice? No. It is a practical vendor checklist for HR. Your counsel picks the legal basis and writes the DPIA. Read your DPA, not this page, as the last word.
Do employee photos stay in the EU on Headshots.so? Databases are EU-hosted. Encryption is AES256. Image providers are SOC 2 and ISO 27001. That is the homepage FAQ. Still ask for the current region in writing if legal wants it on file.
Can staff delete uploads and generated photos? Yes. The user can delete uploads and generated photos anytime. AI models are auto-deleted after 30 days. That is the product-page deletion story — not an archive contract.
What should we ask about Article 50? Ask how the vendor marks or discloses AI-generated images, and what you as deployer should state on LinkedIn, the intranet, or the site. Article 50 applied from 2 August 2026. We do not overclaim Headshots beyond the product pages.
What does Headshots for teams cost, and where do we start? $45 per person. 15 people = 15% off. Locked backgrounds, admin invites, commercial license, about 15 minutes after about 10 selfies. 180+ companies. Write to hey@headshots.dk.
Ready to roll the team out?
When five or more colleagues need the same background on the directory and LinkedIn, start on Headshots for teams. Admin invites. You lock the style. The pack is 96 headshots per person, ready in about 15 minutes after about 10 selfies. Below five people, individual packs are usually simpler. Data-location and deletion questions go to hey@headshots.dk — a Danish inbox, not a chatbot in another time zone.
