The complete guide

Photos, videos and the DPDP Act

Schools, event organisers, photographers and companies create and share more personal data as pictures than in any other form. This guide explains how India's Digital Personal Data Protection Act, 2023 applies to photographs and video of people, from the moment they are taken to the day they are deleted.

Short answer

A digital photo or video of an identifiable person is personal data. From 13 May 2027 the organisation that decides how it is used needs a lawful basis for each use, usually consent for anything public; must give a clear notice, get verified parental consent for children, keep the images secure, honour withdrawals and erasure requests, and report breaches. Purely personal or family use is outside the Act.

When is a photo personal data?

The Act covers personal data in digital form, and data collected offline that is later digitised (Section 3). A photograph or video is personal data when it shows a person who can be identified, directly or together with other information. A clear face is enough; a name tag, bib number or caption can also make someone identifiable.

Two exclusions matter for photos. Data processed by an individual for a purely personal or domestic purpose is outside the Act, so a family's own wedding album or a parent's photos of their child's sports day are not covered. And the Act does not create a special "sensitive" or "biometric" category: a face is personal data like any other, although the nature of the data affects risk and penalties.

Who is responsible?

The Data Fiduciary is whoever decides why and how the images are processed (Section 2(i)). A Data Processor processes them on the fiduciary's behalf under a contract (Section 2(k)). The fiduciary stays responsible for what its processors do (Section 8(1)).

Situation	Usually the fiduciary	Usually a processor
School event photos	The school	Event photographer, gallery platform, ERP
Conference or exhibition	The organiser	Photographer, AV crew, ticketing and gallery platforms
Company offsite or campaign	The company	PR, events and video agencies
Wedding for a family	The family's own use is outside the Act	The photographer, when delivering only for the family
Photographer's portfolio or ads	The photographer, for that use	Their hosting or editing vendors

A lawful basis for each use

Section 4 allows processing only for a lawful purpose, with consent or for one of the specific legitimate uses in Section 7. There is no general "legitimate interest" ground. The same photo can need different bases for different uses.

Use of the photo	Typical basis
Private album for the people in it and their families	Consent is the simplest basis; take advice before relying on anything else
Staff ID cards and access control	Employment legitimate use (7(i))
Internal school records and displays	Parental consent, or the narrow Rule 12 exemption where it genuinely applies
Website, social media, prospectus	Consent for that purpose
Paid advertising and marketing	Consent for that purpose
Finding a guest's photos by face search	Consent from the person searching for their own photos
Photographer's portfolio	Consent from the people shown

Notices people can actually read

Before or when you ask for consent, give a notice that describes the personal data and the purposes, how to withdraw consent and raise a grievance, and how to complain to the Data Protection Board (Section 5). Rule 3 asks for it to be standalone and itemised. For photography that means listing each use separately: album, internal use, website, social media, print, advertising. Put it where people decide: the registration page, the admission form, or venue signage with a link to the full text. People must have the option to read it in English or a language of the Eighth Schedule (Section 5(3)).

Consent that works for photographs

One unticked box per purpose. A single "I agree to photography" box is not specific consent (Section 6(1)).
Don't make attendance or admission conditional on publicity consent; that is hard to square with "free" and "unconditional".
Make withdrawal as easy as agreeing (Section 6(4)), and make sure it reaches your photographer and gallery platform (Section 6(6)).
Keep evidence: who agreed to what, when, and which notice version they saw. The burden of proof is on you (Section 6(10)).

Children's photos

Anyone under 18 is a child. Before processing a child's personal data you need verifiable consent from a parent or lawful guardian, with due diligence that the person is an identifiable adult (Section 9(1), Rule 10). You must not process children's data in ways likely to harm their well-being, or track, behaviourally monitor or target advertising at them (Section 9(2), (3)).

Rule 12 exempts educational institutions and some other classes from parts of Section 9 for specified purposes such as educational activities and the safety of enrolled children. Those exemptions do not cover publicity: posting a child's photo on the school's website or Instagram needs its own basis, normally parental consent for that use.

Group photos and unrecognised faces

A group photo is only as cleared as the least-cleared person in it. If one child's parent agreed to the private album but not the website, the photo should not go on the website as it is. Options: pick another frame, crop, blur, or keep it to the uses everyone agreed to. People you cannot identify should be reviewed by a person rather than assumed to be cleared.

Face recognition and face search

Matching faces to find a guest's photos, or to apply permissions automatically, is processing of personal data like any other: it needs a lawful basis, a stated purpose, security and a retention limit. Keep face data separate for each organisation and event, delete it when the purpose ends, and never reuse it for anything else. For children, automated recognition raises Section 9(3) questions about tracking and monitoring: get specialist advice and offer manual tagging as an alternative.

Sharing and delivery

Prefer access-controlled galleries with expiry over open links that anyone can forward.
Treat WhatsApp groups as uncontrolled: once a photo is posted, it can be forwarded anywhere.
Give every vendor that touches the images a written contract covering purpose, security, access and deletion (Section 8(2)).
Keep access and download logs; Rule 6 expects logs to be kept for at least a year.

Retention, erasure and takedown requests

Erase personal data when consent is withdrawn or the purpose no longer needs it, unless the law requires you to keep it, and make your processors erase it too (Section 8(7)). People can ask for correction and erasure (Section 12). For photos, give one clear way to request removal, act on it across the galleries and channels you control, and record what you did. Be honest that copies others have already downloaded cannot be recalled.

When photos leak

A personal data breach must be reported to the Data Protection Board and to each affected person (Section 8(6)). Rule 7 asks for intimation without delay and a detailed report to the Board within 72 hours. An exposed gallery link or a stolen laptop with event photos is a breach. Decide in advance who leads, who informs the Board and how affected families or attendees are told.

Penalties

The Schedule sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for not reporting a breach or for breaching the children's-data duties, and ₹50 crore for most other breaches. The Board decides any amount after an inquiry, weighing the factors in Section 33(2). Nothing in the Act charges per photo. Section 33 guide.

Checklist

List where photos and videos are taken, stored and shared, including vendors and WhatsApp groups.
Decide a basis for each use and write it down.
Publish an itemised notice and ask for consent per purpose.
Verify parents for under-18s and keep publicity separate from school purposes.
Use access-controlled galleries and keep logs.
Sign processor contracts with photographers and platforms.
Set retention periods and a takedown process with an owner.
Write a breach plan with names and timings.

Printable version: photo-sharing checklist. Or take the 2-minute readiness check.

Frequently asked questions

Is a photograph personal data under the DPDP Act?

Yes, when it is in digital form (or later digitised) and shows a person who can be identified. A recognisable face is enough. Photos taken and used purely for personal or domestic purposes, such as a family's own wedding album, are outside the Act.

Do we need consent for every photo?

You need a lawful basis for each purpose, not a signature for each photo. For most publicity, marketing and public posting that basis is consent. Some internal uses may rest on a Section 7 legitimate use, such as employment purposes, or for schools on the narrow Rule 12 exemptions. Record which basis you rely on for each use.

What if one person in a group photo has not agreed?

Then the photo should not be used for that purpose as it stands. You can choose a different photo, crop or blur that person, or keep the image to uses everyone has agreed to, such as the private family album.

Is face recognition banned under the Act?

No. The Act has no separate biometric category and does not ban face recognition. Face data is personal data, so it needs a lawful basis, security and limits on purpose and retention. For children, Section 9(3) bars tracking and behavioural monitoring, so automated recognition of children needs specialist advice and a manual alternative.

When do these rules apply?

The main duties, including notice, consent, children's data, security, breach reporting, rights and penalties, apply from 13 May 2027 under the commencement notification of 13 November 2025.

Can a parent make us delete a photo that has already been shared on WhatsApp?

You must stop further processing and erase what you control, and tell your processors to do the same. You cannot recall copies that other people have already downloaded or forwarded, and it is better to say so honestly.

Articles by sector

Schools and education

Events and conferences

Photographers and studios

Corporate HR and comms

Marathons and sports events

Hospitality and venues

Retail, brands and media

All organisations

Want this applied to your own photos?

A 30-minute readiness call covers where your photos go, what applies to you and what to fix first. DPDP MediaGuard is available as a scoped pilot for permission checks before photos are shared.

Book a readiness call

Prepared by DPDPA Ready for general information. It is not legal advice and does not certify compliance. Timelines and penalty amounts were checked against the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and the commencement notification of 13 November 2025 (November 2026). For a decision about your organisation, speak to qualified counsel. How we write and correct these guides.