GDPR + State Privacy Compliance for US Photo Booth Operators

The five-question lawful-basis / privacy-policy test

For every category of data you collect, GDPR requires a lawful basis (the EU framing) and US state laws require a clear privacy-policy disclosure (the US framing). Run every data category through this five-question test before you collect it:

• Why am I collecting this data? (purpose)
• Is it necessary for the contract with the bride? (Contract basis under GDPR)
• If not, is it for a legitimate business interest the bride would expect? (Legitimate Interest under GDPR)
• If not, do I have explicit, freely-given, specific consent? (Consent under GDPR; equivalent state-law disclosure)
• How long do I keep it, and when does it get deleted?

The retention schedule every photo booth operator needs

Holding personal data forever is non-compliant under GDPR and increasingly under state law (CCPA in particular requires "reasonable" retention). Document a retention schedule per data category with automatic deletion at the end of the period. Use this as a starting point and adjust based on your CPA's record-keeping advice and your state.

The DPA checklist for every supplier

Every external service that handles your customer data is a "processor" (GDPR) or "service provider" (CCPA). You as the operator are the "controller" / "business". A written agreement is required by both regimes. Most SaaS providers (BoothZen, Stripe, Mailchimp, etc.) publish a standard agreement you sign electronically. Before signing, check the agreement covers:

• Subject matter and duration of the processing
• Nature and purpose of the processing (e.g. "booking management")
• Categories of data subject (brides, guests, staff)
• Obligations of the processor (security, sub-processors, audits)
• Sub-processor list (who else touches the data) and right to object
• International transfer mechanism (SCCs + Data Privacy Framework)
• Notification timeline for data breaches (no longer than 72 hours under GDPR; varies by state)
• Return or deletion of data at end of contract

Photo galleries: where most operators get privacy wrong

A wedding photo booth gallery contains images of dozens or hundreds of guests, none of whom signed your contract. Lawful basis under GDPR is Legitimate Interest with opt-out; under CCPA/CPRA the relevant disclosure is in your privacy policy with a "Right to Delete" workflow.

Practical fixes: print a small "we will photograph guests" sign at your booth, offer guests the chance to opt out, and accept and process deletion requests within 30 days (GDPR) / 45 days (CCPA). For high-risk events (religious institutions, schools, minors), upgrade to explicit consent via a checkbox on the touchscreen.

Data subject requests: 30-day GDPR / 45-day CCPA

A bride or guest can ask for everything you hold on them at any time. GDPR gives you one month; CCPA gives you 45 days. Most operators panic when the first request lands. Pre-build the workflow now and you will never have to.

In BoothZen we ship a one-click "export all data for this contact" button on every customer record — it produces a JSON dump and a PDF summary you can email back. If your platform does not have this, build a manual checklist now: contact record, all bookings, all messages, all uploaded photos, all payment records.

The 72-hour breach window (GDPR) and US state notification rules

If personal data is exposed (a stolen laptop, a sent-to-the-wrong-bride invoice, a compromised email account), GDPR gives you 72 hours from awareness to notify the supervisory authority. US state laws vary — California requires "in the most expedient time", while Texas defines "without unreasonable delay" and many states default to 30 or 60 days.

Have a written breach-response plan before you need it. Five lines is enough: who to call (your privacy counsel or CPA), where to report (state AG + ICO if any EU/UK residents affected), what to record, who to notify, and how to prevent recurrence. Regulators are meaningfully more lenient with operators who self-report quickly than with those who hope nobody notices.