Section 9 Trap: School Sports Day Photo Consent You're Missing

Applies to	Schools & Educational Institutions operating in India
Primary law	DPDPA 2023 · Section 9
Penalty ceiling	₹200 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

The Legal Reality Schools Get Wrong

Your school’s sports day photographer captured 300 images. Within 48 hours, those photos appear on your school website, WhatsApp parent groups, Fedena (your school management system), and your YouTube livestream. Under DPDPA Section 9, every single image of a child under 18 is restricted personal data. Verifiable parental consent—not implicit, not buried in a general school policy, not collected on sports day morning—must be collected before the camera starts.

A parent sees their child’s image without consent. One complaint to the Data Protection Board (accepting cases since May 2026) triggers a violation notice. Your school cannot claim “consent was implied by participation” or “parents attended, so they knew photos were happening.” Section 9 requires explicit, documented, verifiable consent signed by a parent or guardian before processing begins. Without it, you face a penalty up to ₹200 crore per violation—and 300 unconsented photos = 300 violations.

What a Compliant Parental Consent Form Must Include

Your template must contain these 7 elements. Missing even one creates an enforcement gap:

1. Clear identification of the data controller — the school’s name, registration number, principal’s name, and postal address. The parent must know who is collecting and storing their child’s image.

2. Explicit purpose statement — not “school events” but “photography at the 2026 Annual Sports Day on [specific date] for publication on school website, YouTube livestream, admission brochures, and school yearbook.” Separate each use case.

3. Biometric processing disclosure — facial images are biometric data under DPDPA. Your form must state: “Your child’s face will be processed to identify them in photographs.” Many schools skip this and lose enforceability.

4. Retention period — how long the school retains digital and print images. Example: “School website: 5 years. Yearbook: permanent. Admission brochure: until next edition.” Vague retention (“as long as needed”) fails Section 8 requirements.

5. Recipient list — if photos go to your web developer, marketing vendor, or YouTube’s servers (outside India), you must disclose this. Section 9 combined with Section 5 requires transparency on who sees the child’s data.

6. Right to withdraw and erasure rights — parents must be able to request deletion. Your form must state: “You can withdraw consent and request photo deletion by emailing [email]. We will comply within 30 days, except for already-published yearbook copies.”

7. Signature block with date — both parent/guardian name AND signature (digital or physical). A WhatsApp emoji thumbs-up or email reply is not verifiable consent. Document must be signed and dated.

---

The Template

[SCHOOL NAME] PARENTAL CONSENT FORM — SPORTS DAY PHOTOGRAPHY 2026

Important: This form must be signed by a parent or legal guardian before your child participates in photography at the sports day event.

---

Data Controller Details

School Name: [Insert full legal name of school]
School Registration Number: [CBSE/ICSE/State Board registration]
Principal Name: [Name]
School Address: [Full postal address]
Contact Email: [School email]

Event Details

Event Name: Annual Sports Day 2026
Event Date: [DD/MM/YYYY]
Photography dates: [If multi-day]

---

What Personal Data Will We Collect?

Your child’s name, age, class, house/house colour, facial image (photograph), running/sports event participation, placement/medal (if applicable).

Why Are We Collecting This?

To create a photographic record of your child’s participation in the 2026 Annual Sports Day. These images will be used only for the following purposes (mark those that apply):

• Publication on school website (www.schoolname.edu.in)
• School YouTube channel livestream and video archive
• School annual yearbook (print + digital)
• School admission brochure and prospectus
• Internal school records and documentation
• School social media (Instagram/Facebook) — [if applicable, specify account]
• Internal school WhatsApp groups shared only with parents and staff
• Other: [Specify]

Important: We will NOT use these images for:

• Commercial sale or licensing
• Third-party marketing or advertising
• Facial recognition or behaviour profiling
• Sharing with external vendors without your consent

---

Is This Biometric Data?

Yes. Photographs containing your child’s face are biometric personal data under India’s DPDPA 2023. This means:

• Your child’s facial features will be processed and stored digitally.
• Only you (parent/guardian) can give permission for this.
• Your child cannot override this consent decision.

---

How Long Will We Keep These Images?

• School website: 5 years from the date of the event, then deleted.
• School yearbook: Permanently archived (both print and digital).
• Admission brochure: Until the next edition is published (typically 1 year).
• Internal school records: 7 years as per school retention policy.
• YouTube: Permanently, unless you request removal (see below).
• School WhatsApp groups: 30 days, then auto-deleted.

---

Who Will See These Photos?

Your child’s images may be seen by:

• School staff and management
• Parents and students in official school groups
• Visitors to the school website and YouTube channel (public)
• School vendors (photographer, videographer, web hosting company based in [India/Outside India])
• Prospective parents viewing admission materials
• [Any other relevant party — be specific]

---

Your Rights

Right to Withdraw Consent: You can withdraw this consent at any time by emailing [school email] with your child’s name and class. However, images already published on the school website, YouTube, or yearbook cannot be removed retroactively.

Right to Erasure: You can request that your child’s images be deleted from active school records within 30 days of the event. Email [school email] with “ERASURE REQUEST: [Child’s name and class].” We will delete digital copies but cannot remove printed yearbooks already distributed.

Right to Access: You can request a copy of all photographs featuring your child by emailing [school email].

Right to Lodge a Complaint: If you believe your child’s data has been misused, you can file a complaint with the Data Protection Board of India at [dpdpb.gov.in] or contact the school’s Data Protection Officer at [DPO email].

---

Data Protection Officer Contact

Name: [DPO Name]
Email: [DPO Email]
Phone: [Phone]

---

Parent/Guardian Consent

I have read and understood the above information. I give permission for my child’s photograph and personal data to be collected and used as described above.

I understand that:

• My child’s facial image is biometric data and requires my explicit consent.
• Photos will be retained for the periods specified above.
• I can withdraw this consent by emailing the school.
• The school cannot use these photos for commercial purposes without a separate agreement.

Parent/Guardian Name (Print): ________________________

Parent/Guardian Signature: ________________________

Relationship to Child: [ ] Mother [ ] Father [ ] Legal Guardian [ ] Other: _____________

Date: ____ / ____ / ______

Child’s Name: ________________________

Child’s Class & Section: ________________________

Child’s Date of Birth: ____ / ____ / ______

---

For School Use Only

Date Consent Received: _____________
Received by (Staff name): _____________
Consent Status: [ ] Complete [ ] Incomplete [ ] Unsigned
Storage Location (Physical/Digital): _____________
Scanned & Backed Up: [ ] Yes [ ] No

---

How to Deploy This

Timeline: Distribute this form at least 14 days before the sports day event. Do not photograph any child whose parent has not signed this form.

Distribution method:

• Print copies sent home with students
• Email via Fedena/school app (with digital signature option)
• Link to Google Form version (ensure you can export signed responses)
• Hard copies at PTM (Parent-Teacher Meetings) at least 2 weeks prior

Signature rules:

• Physical signatures on paper copies OR
• Digital signatures via email reply (“I consent” in reply to a PDF attachment counts as verifiable consent only if you save the email thread)
• Do NOT accept verbal consent or WhatsApp messages — these are not verifiable under Section 9
• Digital signature tools (DocuSign, Adobe Sign) are preferred and create audit trails

Storage & records:

• Store signed originals in a locked cabinet in the principal’s office
• Scan all signed forms into a password-protected folder (Fedena, OneDrive, or encrypted storage)
• Maintain a consent register with:
  • Child’s name
  • Parent/Guardian name
  • Signature date
  • Consent status (complete/incomplete/withdrawn)
  • Photographer assigned
  • Photo upload date
  • Publication date
• Keep this register for 7 years minimum

Refusals & non-consent:

• If a parent refuses to sign, that child cannot appear in any sports day photograph
• Brief the photographer in advance with a list of children for whom consent was not granted
• If a non-consenting child appears in a candid shot, blur their face before any publication
• If a parent withdraws consent after photos are taken but before publication, delete those images
• If a parent withdraws consent after publication on the website or yearbook, you cannot retroactively remove published copies but must remove them from future distributions

Cross-system documentation:

• Update Fedena/Edupro/Juno records to flag which children have consent status “approved,” “pending,” or “refused”
• Ensure your school photographer has access to this list before the event
• Brief all staff (PTAs, teachers, volunteers) distributing yearbooks that erasure requests may come in

---

What Happens Without This Document

Scenario 1: No Consent Form at All (300 children, one complaint)

You photograph and publish 300 images from the sports day without collecting any written consent. One parent (whose child’s image appears in the yearbook you distributed to 500 families) files a complaint with the Data Protection Board. The Board finds:

• You processed restricted personal data (child’s facial image) without verifiable parental consent
• No privacy notice was provided
• No retention policy was disclosed

Penalty exposure: ₹200 crore for the violation of Section 9 (children’s data). This is calculated as one violation per child (300 children = 300 potential violations, but typically assessed as a single enterprise violation for the pattern). In practice, fines range from ₹2–20 crore depending on Board assessment, but the ceiling is ₹200 crore.

⚠ The Board can also order: immediate takedown of all images from the website, yearbook recall (requiring reprint costs), suspension of all photography activities, and mandatory appointment of a Data Protection Officer.

Scenario 2: Consent Form Exists But Has Missing Elements

Your consent form covers 5 of the 7 required elements (you forgot to disclose biometric processing and retention periods). One image ends up on the school’s YouTube livestream and is screenshot by a third party and shared externally. Parent complains that they didn’t know the image would be permanent on YouTube.

Penalty exposure: ₹50–200 crore for incomplete consent (Section 5/9 violation). The Data Protection Board will argue that consent was not informed because material facts (biometric nature, YouTube permanence) were hidden.

Scenario 3: Consent Collected But Not Verifiable

You collected consent via a WhatsApp message chain where 180 parents replied “yes” to a message about sports day photography. 2 parents did not reply. You photograph all 300 children anyway, treating non-reply as implicit consent. One parent whose child wasn’t photographed but whose child appears in another student’s background photo complains that you have no verifiable consent.

Penalty exposure: ₹50–200 crore. WhatsApp replies are not verifiable under Section 9 because (1) you have no signature, (2) the chain can be edited, (3) you cannot prove the parent actually read and understood the message.

---

FAQ — School Sports Day Photography Consent

Can we collect sports day consent from children directly if they are 18+ (college students)?

No. Even if a student is 18+, they are still a child under DPDPA Section 9 if the school is an educational institution. You must still collect parental/guardian consent. Only if the student is 18+ and not under school jurisdiction (e.g., a university student not enrolled in a school) can you collect consent directly from them. For school-based institutions (including senior secondary and pre-university), assume all students are restricted data subjects under Section 9.

What if a parent signs the consent form but later asks for their child to be removed from published photos on the school website?

You must remove the child’s image from the live website within 30 days under the right to erasure (Section 12). However, if the yearbook has already been printed and distributed to 500 families, you cannot recall physical copies. For future distributions, exclude that child’s images. For YouTube livestreams already published, you must set the video to private or unlisted to prevent new access, though archived copies cannot be fully erased if third parties have downloaded them.

Do we need separate consent forms for different sports day events (inter-house competitions vs. relay races vs. prize distribution)?

No, one form covering “Annual Sports Day 2026” suffices if all photography occurs on the same day/event. However, if your school holds sports day over two separate days with different cohorts of children, you should issue separate forms or clarify the multi-day scope in the first form. For events held on different dates or with different purposes (e.g., sports day photos for yearbook vs. a separate athletics carnival for external promotion), issue separate forms.

If a school photographer is hired as an external vendor, who is responsible for collecting consent—the school or the photographer?

The school is the data controller and is legally responsible for collecting and maintaining verifiable consent. The photographer is a processor. Your photographer should never collect consent directly from parents; they should receive a list from the school of children whose parents have already consented. If the photographer collects photos without that list and publishes them, both the school and photographer are liable.

---

DPDPAReady’s Template Library deploys consent forms, privacy notices, and DPA agreements for your industry in 48 hours — start at dpdpaready.in.