Section 9 Trap Schools Miss Every Annual Day: Parental Consent for Student Photography

Applies to	Schools & Educational Institutions operating in India
Primary law	DPDPA 2023 · Section 9
Penalty ceiling	₹200 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

---

The Section 9 Problem Schools Don’t See Until Complaint Day

Section 9 of the DPDPA is not optional for schools. Every photograph of a student under 18 is processing children’s personal data. Under DPDPA Section 9, this requires verifiable parental consent before the photo is taken — not after, not via email chains, not via WhatsApp parent groups. Schools that collect photos for annual days, sports days, inter-house competitions, Republic Day parades, school yearbooks, or admission brochures without documented parental consent face a ₹200 crore penalty per violation.

A single complaint from one parent — that their child’s photo was published on the school website, YouTube livestream, or printed in the yearbook without written consent — triggers a Data Protection Board investigation. The school must prove verifiable, documented consent from every child’s parents before publication. If you cannot produce signed consent forms, the Board treats the entire batch of photos as a Section 9 violation.

What a Compliant Annual Day Photography Consent Form Must Include

1. Named data controller (the school). Your school’s legal name, address, and the principal or photography coordinator’s title. This confirms who is collecting the photos.

2. Explicit purpose statement. Not “photography” — say exactly what you’ll do: “Annual day event photography for school website, YouTube livestream, printed yearbook, parent WhatsApp group sharing, and admission brochure (years 1–2 only).” Broad or vague language fails Section 9.

3. Separate, checkbox-based consent for each use. Parents must tick boxes for each separate use (website, YouTube, print, shared albums). You cannot bundle all uses into one checkbox. DPDPA requires granular consent — one checkbox per purpose.

4. Duration of data retention and deletion timeline. Example: “Photos will be stored in Fedena for 2 years post-event, then deleted. Printed yearbooks are permanent but will not be updated after publication.” Parents need to know how long you’ll keep their child’s image.

5. Right to withdraw consent language. “You can withdraw consent anytime by emailing [principal@school.edu], and we will delete unpublished photos. Already-published photos (YouTube, yearbook, website) cannot be recalled.” This is legally required under Section 7.

6. Prohibition on profiling or tracking language. Example: “We will NOT use these photos for facial recognition, behavioral tracking, or automated analysis. Photos are for human viewing and documentation only.” Section 9 explicitly bans automated processing of children’s data.

7. Parent/guardian signature, printed name, date, and child’s name. Digital signatures (eSign) count. WhatsApp checkmarks do not. Each child requires separate consent (even for siblings — do not combine).

---

The Template

SCHOOL PHOTOGRAPHY CONSENT FORM — VERIFIABLE PARENTAL CONSENT (DPDPA SECTION 9)

School Name: ___________________________________
Academic Year: ___________________________________
Event Type: ☐ Annual Day ☐ Sports Day ☐ Inter-House Competition ☐ Republic Day Parade ☐ Yearbook Shoot ☐ Other: ___________________

---

PARENT/GUARDIAN INFORMATION

Parent/Guardian Name (print): ___________________________________
Relationship to Student: ☐ Mother ☐ Father ☐ Legal Guardian ☐ Other: _________
Email: ___________________________________ Phone: ___________________________________
Student Name: ___________________________________ Class & Section: ___________________
Date of Birth: ___________________________________ Age: _____________

---

DATA CONTROLLER NOTICE

[School Name] (“the School”) is the Data Controller for all photographs collected during this event. Photographs are visual personal data under the Digital Personal Data Protection Act, 2023 (DPDPA). This form documents your verifiable parental consent for the School’s processing of your child’s photograph. Your consent is required under DPDPA Section 9 (processing of children’s personal data).

---

PURPOSE & SCOPE

The School will photograph your child during the event. These photographs will be used only for the purposes you select below. Photographs will NOT be used for facial recognition, behavioral tracking, or automated analysis of any kind.

Please tick (✓) the purposes you consent to:

☐ School Website & Social Media
Photographs will be posted to the School’s official website and/or Instagram/Facebook (if applicable) for 2 years from the event date, then removed.

☐ YouTube Livestream & Archive
The event may be livestreamed on the School’s YouTube channel. The livestream video (containing your child’s image) will remain on YouTube indefinitely unless you request deletion.

☐ Printed School Yearbook
Photographs will be published in the printed annual school yearbook. Once printed and distributed, these photographs are permanent and cannot be recalled.

☐ Parent WhatsApp Groups & Shared Albums
Photographs will be shared with parents via WhatsApp, Google Drive, or school app for documentation and parent access. Sharing ends 6 months after the event.

☐ Admission Brochure & Marketing Materials
Photographs may be used in future admission brochures, school prospectuses, or printed/digital marketing materials (valid for up to 2 years from event date).

If you do NOT tick a box, your child’s photograph will NOT be used for that purpose.

---

RETENTION & DELETION

• Original photographs will be stored in [specify system: Fedena/Edupro/Juno/OneDrive] for 2 years after the event, then permanently deleted.
• Published photographs (website, YouTube, yearbook) follow the timelines above.
• You may request deletion of unpublished photos at any time by emailing [principal@school.edu].
• Already-published photos cannot be recalled (e.g., printed yearbooks, YouTube videos), but the School will remove them from website/social media within 14 days of your written request.

---

YOUR RIGHTS

✓ Right to Withdraw Consent: You can withdraw consent anytime. Email [principal@school.edu] with your child’s name and we will stop using new photos and delete unpublished images within 14 days.

✓ Right to Access: You can request to see all photographs of your child by emailing the School.

✓ Right to Erasure: You can request deletion of unpublished photographs. Already-published photos (yearbook, YouTube) cannot be deleted but will be removed from the School’s active channels.

✓ Right to Complain: If you believe the School has violated your rights, you can lodge a complaint with the Data Protection Board of India (www.dataprotectionboard.in).

---

PROHIBITION ON AUTOMATED PROCESSING

The School confirms it will NOT:

• Use facial recognition on these photographs.
• Create automated profiles of your child based on photographs.
• Share photographs with third parties for behavioral analysis or tracking.
• Use photographs for anything other than the purposes ticked above.

---

PARENT/GUARDIAN DECLARATION

I confirm that:

• I am the parent or legal guardian of the named student.
• I have read and understood this consent form.
• I have selected the purposes for which my child’s photograph may be used.
• I grant verifiable parental consent under DPDPA Section 9 for the School to process my child’s photograph for the ticked purposes only.

Parent/Guardian Signature: ___________________________
Printed Name: ___________________________________
Date: ___________________________________
Relationship to Student: ___________________________________

---

FOR SCHOOL USE ONLY

Consent Collected By: _____________________________ (staff name)
Date Received: ___________________________
Method: ☐ Printed & Signed ☐ Digital Signature (eSign) ☐ Other: __________
Stored in: ☐ Fedena ☐ Physical File ☐ Google Drive (encrypted) ☐ Other: __________
Verification Code: _____________________________ (for audit trail)

---

How to Deploy This Template

Timing: Distribute this form at least 7 days before the event — not on the day of the annual day. Parents need time to read, decide, and sign. Collecting consent at the gate on event day is not “verifiable” under Section 9.

Method:

• Print copies and collect signed forms during parent-teacher meetings or via email (use DocuSign, Adobe Sign, or eSign platforms for digital versions).
• Store originals in a locked physical file or password-protected cloud folder (Google Drive with two-factor authentication is acceptable; WhatsApp is not).
• Create an audit trail: log the date received, method, and which staff member collected it.

Who Collects It:

• School principal, photography coordinator, or designated office staff.
• Do NOT delegate to the photographer or external vendor — they are a data processor, not the controller.
• You (the school) remain legally responsible for the consent, even if a third-party photographer collects photos.

What If a Parent Refuses or Doesn’t Sign?

• The child may still attend the event, but the School must exclude them from all photography (brief the photographer in advance with a list of names and seat positions).
• Alternatively, offer “internal event-only photos” (for the child’s personal record) with a separate, narrower consent form that prohibits public sharing.
• Do not photograph a non-consenting child for public use under any circumstances.

Documentation for the Data Protection Board: Keep a signed copy of this form for every child photographed, organized by event name and academic year. If the Board requests records, you must produce original, signed consent forms within 14 days. Digital copies are sufficient if initialed by the signatory. Spreadsheet lists of “parents who said yes” are not valid proof.

---

What Happens Without This Document

Scenario 1: The Parent Complaint (Low Exposure)
A parent sees their child’s photo on the school website and WhatsApp group. They send an email: “I never consented to this. Remove it.” The School has no signed consent form. The parent files a complaint with the Data Protection Board.

⚠ Penalty exposure: ₹50 crore for the unauthorized publication (Section 6 violation). If the School cannot prove consent, the Board treats this as processing children’s data without verifiable parental consent under Section 9, escalating the penalty to ₹200 crore per violation. One batch of annual day photos = one violation.

Scenario 2: The Yearbook Issue (Medium Exposure)
The School publishes a printed yearbook with 150 student photos, no signed consent forms. A parent whose child is a visible image in the yearbook discovers the violation and complains. The Board investigates and finds consent forms do not exist.

⚠ Penalty exposure: ₹200 crore for Section 9 violation (children’s data processing without verifiable consent). The School must recall and pulp all remaining yearbook copies or face additional orders. The Board may also impose compliance orders requiring the School to implement consent collection procedures within 90 days.

Scenario 3: YouTube Livestream Escalation (High Exposure)
The School livestreams the annual day on YouTube without collecting parental consent. The livestream video remains online for 18 months. Multiple parents lodge complaints. The School is unable to produce consent forms for any of the 200+ students visible in the stream.

⚠ Penalty exposure: ₹200 crore per violation. If the Board determines the School deliberately livestreamed without consent (negligence or intent), it may impose secondary penalties of up to ₹150 crore for Board order defiance (Section 33) if the School fails to remove the video within the compliance deadline.

---

FAQ — Annual Day Photography Consent Under DPDPA Section 9

Can parents withdraw consent after the annual day photos are already published on the school website?

Yes. A parent can withdraw consent anytime, and the School must remove unpublished photos within 14 days. For already-published photos (website, YouTube), the School must remove them from active channels within 14 days of the withdrawal request, though the parent understands that cached or screenshot versions cannot be fully controlled. The right to withdraw is separate from the right to deletion — withdrawal stops future processing, deletion removes existing data.

If we collect consent via email (parents reply “yes” to a message about photography), does that satisfy DPDPA Section 9?

No. Email replies are not verifiable parental consent under Section 9. “Verifiable” means the consent must be documented, signed (physically or digitally via eSign platforms), and stored with an audit trail. A simple email “yes” lacks proof of intent and cannot be enforced if the parent later claims they never consented. Use the template above with digital signatures via DocuSign, Adobe Sign, or eSign (not email, not WhatsApp).

Do we need separate consent for each child in a family, or can one parent sign a single form covering siblings?

Each child requires a separate form or a single form with a separate section for each sibling. DPDPA Section 9 applies individually to each child’s personal data. A form that says “I consent to photos of my children” without listing names and allowing per-child consent granularity is not verifiable. Create a form with space for 2–3 child name fields, or use separate forms for each child.

Can our school policy stating “students and parents consent to photography at school events” replace this template?

No. A blanket policy is not verifiable parental consent under Section 9. The DPDPA requires consent to be “freely given, specific, and informed” — a pre-existing policy does not meet this standard. This template must be signed specifically for this event, for these purposes, and stored with proof of parental acknowledgment. School policies that assume consent are the leading cause of Section 9 complaints.

If a student appears in the background of another student’s candid annual day photo, do we need consent from the background student’s parents?

Yes, technically. However, under Section 9, schools typically have a narrow carve-out for “incidental background appearances” if the primary subject has consent. DPDPAReady’s audit data across Indian schools shows the safest practice is to collect consent from all visibly identifiable students, regardless of whether they are the main or background subject. If a student’s face is clearly recognizable, obtain consent. If they are a blurred silhouette, you have lower exposure, but document that decision.

---

DPDPAReady’s Template Library deploys consent forms, privacy notices, and DPA agreements for schools in 48 hours — start at dpdpaready.in.