What happens to an actor's 3D scan data after a production
ImageVault · Updated
In short
After a production wraps, an actor's scan data usually stays on the servers of the production and one or more VFX vendors, governed by the performer's contract, their union agreement and data-protection law. Performers can ask in writing who holds it and, in the UK and EU, exercise GDPR rights of access and erasure; an independent custodian gives them a single controlled archive instead.
What a scan package contains
A typical performer scan, captured in a photogrammetry rig or a mobile scanning unit on set, produces hundreds of calibrated high-resolution stills, a 3D mesh of the face or full body, texture and displacement maps, and often reference video or a 360° turntable. Facial performance capture and voice recordings may be added. A full package for a principal actor can run from tens of gigabytes to a terabyte.
Where it goes after the shoot
The scanning company delivers the data to the production, which passes it to the VFX vendors working on the shots that need it. Each of them may keep copies — on project servers, in backups and in asset libraries — long after the project ends. On a large production several companies across several countries can hold copies of the same performer.
The performer is rarely told where the files are, and productions themselves often cannot say with confidence which vendor still holds what.
Who controls it
Possession is not the same as permission. What a production may do with the data is set by the performer's contract, the applicable union agreement and the law. Under SAG-AFTRA's Article 39, for example, using a digital replica beyond the production it was made for needs fresh consent and payment, and producers may not keep biometric data for unrelated purposes. Data-protection law adds its own limits wherever the data is processed in the UK or EU.
The risks of leaving it where it is
For the performer, scattered copies mean uses they never agreed to and no way of knowing about them. For the production, every copy is a liability.
- A leak gives anyone the highest-fidelity source there is for a deepfake.
- Reuse without fresh consent breaches union terms and, in several US states, statute.
- Retention without a lawful basis breaches the GDPR, where fines scale with turnover.
- No access record means no way to prove what did or did not happen.
How to find out who holds your scans and ask for deletion
Write to the production company, or have your representative write, asking which companies received your scan data, what each holds now, and when it will be deleted. In the UK and EU you can make a subject access request under the GDPR to any company you believe holds the data, and request erasure where there is no longer a lawful basis to keep it. Keep copies of every reply.
ImageVault offers an alternative to chasing copies: the performer's scans are held in one archive, released to a production only under a specific, approved licence with two-factor confirmation from the recipient, and every access is recorded in a tamper-evident ledger. Productions that use it can show exactly where a performer's data went and when their access ended.