I am mostly on the side taking pictures.

The companies I worked for all had a standard “model release form” which people signed before a photo shooting. These were updated with GDPR requirements some time ago. For events it’s a blanket note in the invitation and a mention in the beginning (opt-out possible).

Management of these is a bit hand-made in my experience. Essentially gathering the forms as pdf in a shared folder close to the original pictures / project documentation.

But that works ok because in the last 18 years or so, I can remember one person wanting to withdraw their approval. We pulled many more pictures from the library ourselves because people were no longer with the company.