A teacher discovers that an old school-event photo gallery opens for anyone who has its link. Start by restricting access, preserving a small factual record and asking the school’s designated privacy or incident lead to assess what happened. A private-looking URL is not the same as a verified list of viewers.
First: contain access without destroying evidence
- Tell the person responsible for the gallery and the school’s incident lead. Record who noticed it and when; avoid forwarding the link to more people.
- Using an authorised administrator account, disable public link access or restrict the gallery to the intended people. Ask IT or the gallery provider for help if the school does not control it.
- Record the action and time, the gallery owner and the type of images involved. Preserve relevant access logs, link settings and correspondence where available, following the school’s incident process. Do not collect or circulate more children’s images than necessary.
- Test the old link in a signed-out browser or ask IT to do so. Also check embedded previews, duplicate links and vendor-hosted copies. A failed link test does not prove that no copies were downloaded earlier.
Next: establish what the school knows
Record when the link was created, who was supposed to see the gallery, how it was shared and when access was restricted. Check whether access was limited by individual accounts, whether downloads were enabled and whether the platform keeps useful access records. An absence of logs is not proof that nobody accessed the gallery.
Identify the categories of children and images potentially involved without creating an unnecessary new list. Note what remains uncertain, who owns each investigation step and when the team will review it. A photographer or gallery vendor may need to confirm their own settings and copies.
Decide who needs to be informed
Escalate promptly to the school’s leadership and privacy or legal adviser. They can assess the facts, potential harm, contractual commitments and any applicable reporting or notification duties under the law in force at the time. Do not assume that every exposed link triggers the same reporting requirement or deadline. Explain to affected families when appropriate, using verified facts and a contact point for questions.
Reopen only after a deliberate review
Before families receive access again, check the intended audience, the school’s relevant permissions and restrictions, the platform’s access settings and the owner who can respond to problems. Prefer individually controlled access where the platform supports it. Set an appropriate review or expiry date and make clear that recipients should not forward the gallery or republish other children’s images. Such instructions reduce risk but cannot prevent screenshots or copies.
If a child’s inclusion or the proposed use is uncertain, hold the affected image for review. Where feasible, separate images and audiences so one broad link does not expose an entire event album. Ask the vendor what happens to existing links and downloads when access is revoked; behaviour differs by platform.
A short incident record for the school
Record: discovery time and reporter; gallery owner and location; intended audience and exposed access setting; containment action and test; categories potentially affected; logs and uncertainties; adviser decision on communications or reporting; and the person and date for follow-up. Keep this record securely and limit its circulation.
For adjacent steps, read our photographer handover checklist and event-photo retention register. MediaGuard supports school media workflows; wider privacy readiness can be scoped with relevant partners. Confirm the capabilities and integrations needed for your school during discovery.
Sources and scope: Read India’s DPDP Act, 2023 and DPDP Rules, 2025, whose provisions commence in phases; check current notifications and your facts with an adviser. Google Photos’ sharing guidance illustrates why platform-specific access controls matter. This operational checklist is not a determination of a legal breach or of any particular notification duty. Sources checked 6 November 2026.
What does this mean for your school?
Turn the guidance into a practical plan for your school, from policies and staff to parent permissions and media.
