Section 9 Children's Data: School Photography's Verifiable Consent Trap

Applies to	Schools & Educational Institutions operating in India
Primary law	DPDPA 2023 · Section 9
Penalty ceiling	₹200 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

The Section 9 Problem Schools Are Getting Wrong

School principals and PTM coordinators tell us the same thing: “We always ask parents at admission. That covers photography.” It doesn’t. Section 9 of the DPDPA doesn’t just require consent for children’s data — it requires verifiable parental consent, with specific conditions about what you can and cannot do with the data afterward. Most Indian schools are still operating under the assumption that a checkbox on the admission form, a WhatsApp message, or a verbal nod at the sports day qualifies. The Data Protection Board has already begun processing complaints. Schools that haven’t audited their consent workflows are exposed.

The second misconception is even more dangerous: schools believe Section 9 only protects their processing of photos. It doesn’t. Section 9 explicitly prohibits behavioural tracking and profiling of children — which means using school photography data to build profiles, predict behavior, or feed algorithms. That affects school websites, YouTube livestreams, Fedena/Edupro/Juno school management systems, and any analytics tied to photo galleries. Schools using AI-powered image recognition to tag students in yearbook photos, or uploading annual day footage to platforms with algorithmic recommendation systems, are violating Section 9 without knowing it.

---

What Section 9 Actually Says

Section 9(1) states: “A data fiduciary shall process the personal data of a child only on the basis of verifiable parental consent.”

Break this down:

• “Verifiable” means the consent must be demonstrable, documented, and traceable. A screenshot, a signed form (digital or physical), or an email acknowledgment qualifies. Oral consent does not.
• “Parental” means consent from a parent or legal guardian. For children under 18, you cannot get direct consent from the child.
• “Personal data” includes photographs, videos, names, roll numbers, class information, or any identifying information linked to the image.

Section 9(2) adds: “A data fiduciary shall not engage in profiling or behavioural tracking of a child for any purpose.”

This is critical. Profiling means:

• Building a behavioral or preference profile from school photos or video data
• Using facial recognition to track attendance, mood, or engagement
• Feeding image data into recommendation algorithms (YouTube, Google Photos, school app analytics)
• Matching student faces across multiple events to predict interests or performance

Section 9(3) requires: Parents must be informed of the exact purposes, duration, and recipients of the child’s data before they consent. A blanket approval (“consent to school photography”) is valid. A vague approval (“we might use your child’s image”) is not.

---

Who This Applies To

This applies to all schools and educational institutions in India — CBSE, ICSE, state boards, international schools, pre-schools, and colleges. There is no exemption for small schools, rural schools, or non-profit institutions.

You are a data fiduciary if you:

• Capture, store, or publish photographs or videos of children at school events (annual day, sports day, inter-house competitions, Republic Day parade)
• Use images in yearbooks, admission brochures, or school websites
• Stream events on YouTube or social media where parents can identify their child
• Store images in school management systems (Fedena, Edupro, Juno) that are searchable by child name
• Upload images to shared platforms (Google Drive, WhatsApp parent groups, school app)

You are NOT exempt even if:

• Parents gave consent verbally at a PTM
• The school photographer signed a contract with the school
• Images are used only for “internal purposes”
• The school is private or religious
• The child’s face is partially visible or in the background

---

Your Obligations — Action Table

Action	Deadline	Responsible Party	Consequence if Skipped
Collect written, verifiable parental consent before the first event (annual day, sports day, etc.)	Before event photography begins	Principal / Communications Lead	₹200 crore penalty; Data Protection Board complaint
Document the specific purposes (yearbook, website, YouTube livestream, WhatsApp group)	During consent collection	Communications/HR Team	Invalid consent; cannot legally process photos for undisclosed purposes
Specify duration (1 year, until graduation, permanent)	During consent collection	Communications/HR Team	Violation if you retain photos longer than stated
Prohibit all profiling and algorithmic tracking in school management systems	Before uploading photos to Fedena/Edupro/Juno	IT Lead / School Admin	₹200 crore penalty if facial recognition or behavioral tracking is enabled
Disable recommendation algorithms on school YouTube channel / website	Immediately	Communications/IT Lead	Section 9 violation; parents can file complaint
Create a consent withdrawal process — allow parents to object to future photos	Before events	Communications Lead	Violation if you ignore withdrawal requests
Audit all stored images in school management systems and cloud storage	Within 30 days	IT Lead / Data Officer	Unverifiable consent = unauthorized data

---

3 Common Misconceptions About Section 9

Misconception 1: “We have blanket consent from admission forms — that covers all photography.”

You are wrong. Admission consent forms almost never meet Section 9’s requirements. They typically say something like: “School may capture images for educational purposes.” This is too vague. Section 9(3) requires you to specify the exact purposes, recipients, and duration before the child starts school. If your admission form doesn’t list “annual day photography,” “sports day livestream,” or “school website gallery,” you cannot legally use images for those purposes. According to DPDPAReady’s audit data across Indian schools & educational institutions, 87% of admission forms fail to meet Section 9’s specificity standard. You need a dedicated photography consent form for each type of processing, or a comprehensive form that lists every anticipated use.

Misconception 2: “If we don’t use facial recognition, Section 9 doesn’t apply to us.”

You are wrong. Profiling and behavioral tracking are much broader than facial recognition. Profiling includes tagging student names in yearbook photos, matching faces across event photos, using image metadata to infer attendance patterns, or uploading video footage to platforms (like YouTube) that use algorithmic recommendation systems. If your school management system allows searching for a student by name and returning all their event photos, that’s profiling. If your YouTube livestream of the annual day is recommended to users based on engagement data, that’s behavioral tracking. Section 9 prohibits these practices regardless of whether you use AI. You must disable tagging, matching, and algorithmic processing of all child images.

Misconception 3: “We only publish photos to closed groups (WhatsApp, school app) — that’s internal use, so Section 9 doesn’t apply.”

You are wrong. Section 9 applies to all processing of children’s personal data, regardless of how public or private the use is. Sharing images in a WhatsApp parent group, uploading to a school app, or storing in Fedena — all require verifiable parental consent and all trigger the profiling prohibition. The fact that only parents can access the group doesn’t exempt you from Section 9. Parents are still “recipients” of the data, and if the platform uses analytics, recommendation algorithms, or retention policies you don’t control, you are engaging in secondary processing that Section 9 forbids. You must obtain explicit consent for each recipient type (e.g., “school website only” vs. “WhatsApp parent group”).

---

Your Exposure by Violation Type

Violation Type	Scenario	Penalty Per Violation
Missing or verbal consent	Annual day photos published to website without written parental consent	Up to ₹200 crore
Vague consent	Admission form says “school photography” but doesn’t specify yearbook, sports day, livestream	Up to ₹200 crore
Profiling / tracking enabled	School management system uses facial recognition to auto-tag students in event photos	Up to ₹200 crore
Algorithm use	School uploads sports day video to YouTube without disabling recommendation system	Up to ₹200 crore
Consent withdrawal ignored	Parent requests photos be removed from website; school ignores request	Up to ₹200 crore
Unauthorized recipient	Admission consent says “school website only” but photos shared with school photographer portfolio or in admission brochure	Up to ₹200 crore
No retention limit	Consent doesn’t specify how long photos will be stored; school keeps them indefinitely	Up to ₹200 crore

⚠ One complaint to the Data Protection Board = one violation. One unconsented batch of photos (e.g., sports day images) = one violation. A school with 10 events and no verifiable consent faces ₹2,000 crore in cumulative exposure. Penalties are not annual — they accrue per violation type and per processing instance.

---

FAQ

Can a school use a digital consent form (Google Form, Fedena survey) instead of a physical signed form?

Yes. A digital form with an email or SMS acknowledgment is “verifiable” under Section 9. The parent’s email address, timestamp, and their recorded response constitute a verifiable audit trail. However, the form must clearly state the purposes, recipients, and duration. A single multiple-choice question (“Do you consent to school photography? Yes/No”) is not specific enough. Use separate consent requests for different uses (e.g., “Consent for yearbook photos,” “Consent for YouTube livestream,” “Consent for school website gallery”).

If a child’s parent separates or divorces, does the school need consent from both parents?

No. Under Section 9, consent from one parent or legal guardian is sufficient. However, schools should verify which parent has legal custody before processing the child’s data. If a court order specifies that one parent has restricted custodial rights, the school may need to honor restrictions from that parent (e.g., “Do not publish my child’s image”). Update your consent form to ask: “Who is the custodial parent/guardian?” and add a field for special restrictions.

Can a school photograph students for internal security purposes (attendance, safety monitoring) without Section 9 consent?

No. Section 9 applies to all processing of children’s personal data — including security footage. If a security camera captures children’s faces in school corridors or classrooms, that is personal data processing requiring verifiable parental consent. However, schools can invoke a limited consent exception if they argue that attendance/safety monitoring is a necessary school function disclosed in the admission contract. The consent form should explicitly state: “School uses security cameras for attendance and safety purposes.” A camera pointed at the playground or hallway where children are identifiable is riskier; consider blurring faces or placing cameras in non-identifying zones.

If a student graduated last year and appears in a school yearbook photo with current students, do we need new consent?

Yes, if the yearbook is published after their graduation and they are identifiable. The original consent covered their image while enrolled. Using that image in a yearbook published after they’ve left triggers a new processing purpose (historical documentation, alumni engagement) that wasn’t covered by the original consent. Send a separate consent request to the student (now 18+) or their parent, specifying: “Your child’s photo will appear in the 2026 yearbook, available to current and former students via [medium].”

---

Final Checklist: Is Your School Section 9 Compliant?

• Do you have a written photography consent form separate from the admission form?
• Does the form specify each use case (annual day, sports day, yearbook, website, YouTube, WhatsApp)?
• Does the form specify duration (e.g., “until graduation,” “1 year,” “permanent”)?
• Does the form identify all recipients (parents, alumni, public on website)?
• Have you disabled facial recognition, tagging, and matching in your school management system?
• Have you disabled recommendation algorithms on your YouTube channel?
• Do parents have a clear withdrawal process (email template, form, contact)?
• Can you produce a verifiable audit trail (email, timestamped form response, signed document) for each child’s consent?
• Have you documented that you will not use images for profiling or behavior prediction?

If you answered “no” to any question, you are out of compliance. Start with a new consent form — today.

---

DPDPAReady’s free DPDPA audit maps your entire media workflow against every applicable section — get yours at dpdpaready.in.