Not every cloud service is the same, and not every overseas server raises the same issues. Ask where the files are stored, who operates the service, who has access, how long files are kept and how deletion works. Malaysian personal data rules have changed recently, so ask a qualified adviser about transfers outside Malaysia.
Gallery links feel simple. You click, you see photographs. Behind the screen, files sit on servers run by someone, somewhere, for some period. For most events, that is a quiet detail. For events with sensitive guests, children or strict corporate rules, it deserves a question or two.
This guide belongs to our overview of event photography privacy, permission and image use. It is not legal advice and does not describe any service as available. We confirm the arrangement for your booking in writing.
Why storage is a privacy question
A photograph of an identifiable person can be personal data. If so, the way it is stored and moved matters. Malaysia's Personal Data Protection Act 2010 applies to personal data processed in commercial transactions. The Act was amended in 2024, and the amendments took effect in stages during 2025. They cover matters such as processors' security duties, breach notification and the rules on transfers outside Malaysia.
The Personal Data Protection Department publishes the current text and guidance. Check its site, and ask a qualified adviser what applies to your event. We do not interpret the law for you.
Questions about the service
| Question | Why it matters |
|---|---|
| Who operates the gallery? | Identifies who holds the files |
| Where are the servers? | Raises the question of transfer outside Malaysia |
| Who can access the files? | Staff, subcontractors, other clients |
| How are they protected? | Passwords, access controls, encryption |
| How long are they kept? | Limits long-term exposure |
| How does deletion work? | Decides whether removal requests can be met |
| What happens in a breach? | Who tells whom, and how quickly |
Not every service gives clear answers. If a provider will not explain, treat that as information.
Not all services are alike
A large international platform, a local hosting company and a private drive differ in practice. So do "storage" and "gallery with sharing features". Do not treat all cloud services, or all overseas recipients, as the same. Ask about the actual arrangement for your files.
Delivery and storage are different
Delivery is how files reach you. Storage is where they live. A photographer may deliver through one route and keep a working archive in another. Ask about both. Our guide on private gallery access and onward sharing covers the delivery side.
Subcontractors and helpers
A photographer may use editors, assistants or outside services. Each is a possible point of access. Ask who may handle your files, whether they are bound by written duties and whether any of them are outside Malaysia. This is a simple question and a fair one. A clear answer is a good sign.
Corporate policies
Some organisations have their own rules on where staff images may be stored. Share them with us early. We will say plainly whether our arrangement fits, and what would need to change if it does not.
Backups and archives
Do not make one gallery your only copy. Keep your own backup. Our photo archive planner helps you decide how long to keep what, and where.
Automated tools
Some services add features such as automatic tagging or search. These raise their own questions, covered in facial recognition and automated guest-photo search and AI editing and image-processing services in the workflow. If your files could be used to train a model, see using event photographs in AI training or external datasets.
A worked example
For example, a law firm holds a staff retreat and wants photographs of its people delivered securely. The firm asks the photographer where files are held, who can see them and whether any copy leaves Malaysia. The photographer replies in writing. The firm asks its adviser to review the reply against its own policy.
The firm chooses a password-protected gallery with a six-week expiry, takes its own backup, and asks that the working files be deleted after delivery. It records the decision in its register.
What we confirm in writing
We state how we deliver and store files for your booking, who has access and when files are removed. If your policy requires something different, tell us early so we can say whether we can meet it.
Checklist
- Ask where files are stored and who operates the service.
- Ask who can access the files, including staff and subcontractors.
- Ask whether files are transferred outside Malaysia.
- Agree a retention period and deletion process.
- Ask how a security incident would be reported.
- Keep your own backup of the final set.
Tell us whether your event involves sensitive guests or strict internal rules. We will state in writing how we deliver and store your files, and what we need you to decide.
Ask how our photos are storedCommon questions
Are photographs personal data?
Photographs of identifiable people can be. Malaysia's Personal Data Protection Act 2010 governs personal data in commercial transactions. How it applies to your event depends on the facts, so ask a qualified adviser.
Does it matter if the server is overseas?
It can. Malaysian rules on transfers of personal data outside Malaysia were amended in 2024, and the Personal Data Protection Department has issued related guidance. Ask a qualified adviser, and ask the service provider where data is held.
Who is responsible if the service has a breach?
Responsibility depends on roles and agreements. The photographer, the client and the service provider may each have duties. Ask who handles notification, and what the contract says.
Can we choose where files are stored?
Sometimes. It depends on the service and on what your photographer uses. Ask what options exist and confirm the arrangement in writing. Do not assume.
How long should files stay in the cloud?
Only as long as needed. Decide a retention period, and a process for deletion. Keep your own backup of the final set so you do not depend on one service.
Sources checked
Ask how our photos are stored
Tell us whether your event involves sensitive guests or strict internal rules. We will state in writing how we deliver and store your files, and what we need you to decide.
What happens next: You send your event details on WhatsApp. Our team reads the brief, asks what is missing, then confirms in writing whether the date, venue and coverage can be booked, with a quotation. Opening WhatsApp does not send anything, and a message is not a booking until both sides confirm.
Last reviewed: