What is the appropriate legal basis for processing an employee's image in an internal newsletter?

ANSWER

Where an employee's data are processed for internal purposes, the legal basis for processing may be the legitimate interests of the controller (Article 6(1)(f) GDPR).

It is important that processing of the employee's data for internal purposes serves to improve and streamline the company's operations and internal employee communication, and not the disclosure of the image to persons outside the organisation.