Student Photos at Sports Academies Need Verifiable Parental Consent Under DPDPA Section 9

Applies to	Sports Events & Marathons operating in India
Primary law	DPDPA 2023 · Section 9
Penalty ceiling	₹200 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

The Legal Reality: Your Academy’s Student Photos Are Children’s Data

Most sports academies treat student photography the same way they’ve done for 20 years—a simple release from parents on the academy form, or worse, no written consent at all. Under DPDPA Section 9, that’s no longer legal. Student photos are personal data of children, and Section 9 explicitly requires verifiable parental consent before any collection, processing, or publication. This isn’t a recommendation. It’s a compliance obligation.

The Data Protection Board began accepting complaints in May 2026. Your academy doesn’t need a breach or a regulator visit to face exposure. A single parent complaint about an unconsented photo on your website, WhatsApp group, or social media can trigger a Board investigation. The penalty for violating Section 9: up to ₹200 crore per violation. One batch of unconsented student photos = one violation.

---

What Most Sports Academies Get Wrong About Student Consent

The biggest mistake: assuming that because parents signed the academy admission form, they’ve already given consent for photography. They haven’t. Admission consent and photography consent are separate obligations under DPDPA. A parent consenting to medical records, training schedules, or fee collection does not count as consent to photograph their child and publish that image.

The second mistake: collecting verbal consent or a WhatsApp message saying “okay to share photos.” DPDPA Section 9 requires verifiable consent—meaning written, dated, signed documentation that clearly identifies what photos will be taken, how they’ll be used, who will see them, and for how long. A WhatsApp approval is not verifiable. A signature on a generic form without specific detail about photography purposes is not verifiable.

The third mistake: thinking that publishing photos on a “private” academy WhatsApp group means you don’t need consent. You do. Publishing to 50 parents on a group chat is still processing and sharing personal data of a child. Section 9 makes no exception for “internal” or “closed” audiences.

---

How to Collect Verifiable Parental Consent: Step-by-Step

Step 1: Create a Standalone Photography Consent Form (Not Bundled With Admission)

Write a separate form titled “Photography and Image Use Consent.” Do not embed it in your admission or fee agreement. The form must include:

• Student name and date of birth (identifies the child)
• Parent/guardian name and legal relationship to the child
• Specific purposes: “Training documentation,” “tournament/match photography,” “academy website,” “social media,” “printed certificates,” “team videos”—list each separately
• Who will see the photos: parents only, all academy members, public social media, third-party vendors (coaches, nutritionists)
• Retention period: “Photos will be kept for [X months/years] from the date of collection” (align with your actual data retention policy)
• Explicit consent checkboxes for each purpose (not a single “yes”)—parents must tick each purpose they allow
• Date and signature line (handwritten or e-signature)
• Parent/guardian declaration: “I am the legal guardian of [child name] and have authority to give this consent”

Why this matters: DPDPA Section 9 requires consent that is specific (per purpose), informed (parent understands each use), and verifiable (dated, signed, traceable). A generic admission form fails on all three counts.

Step 2: Collect Consent Before Any Photography Happens

Do not photograph first and ask for consent later. Section 9 requires prior consent. This means:

• Collect the signed form at least 7 days before your first sports day, tournament, or training session
• If a new student joins mid-season, collect their form before they appear in any photos
• If you’ve already photographed students without consent, you cannot retroactively collect consent to legalize past processing—you can only use it going forward

Why this matters: Processing without prior consent is a violation. The fact that you collect consent later does not erase the breach.

Step 3: Document and Store Consent Records Separately From Photos

Create a consent register (digital or physical) with:

• Student name + date of birth
• Parent/guardian name + signature
• Date of consent
• Specific purposes consented to (tick the box or note the purposes)
• Retention expiry date
• Any restrictions (e.g., “social media only,” “not on website”)

Keep this register separate from your photo folders. If the Data Protection Board investigates a complaint, you must produce this register to prove you had consent before you published the photo. If consent records are mixed with photos or missing, you have no proof.

Why this matters: Verifiable consent means you can verify it on demand. A consent form locked in a filing cabinet that you can’t produce in 48 hours is not verifiable.

Step 4: Implement Use-Restriction Controls

Many academies collect consent for “training documentation only” but then post all photos to Instagram. This is a breach—you processed data for a purpose beyond what the parent consented to.

Before you publish or share any photo:

1. Cross-check the photo against your consent register — did the parent consent to this specific use? (e.g., social media posting, printed certificate, email to parents)
2. If consent is missing or restricted, do not publish. Delete the photo or store it separately for internal use only.
3. For “social media” consent, require explicit permission for each platform (Instagram, Facebook, TikTok). Consent to “Instagram” does not extend to TikTok reels.

Why this matters: Section 9 locks you to the purposes named in the consent form. Exceeding those purposes is a violation, even if you have a signature.

Step 5: Set Up Annual Consent Renewal and Erasure Protocols

DPDPA Section 9 gives children (and parents on their behalf) a right to erasure. You must have a process for this.

At the start of each academy year:

1. Re-collect consent — old forms expire (update them annually with the new calendar year)
2. Ask parents explicitly: “Do you want all photos of [child] from last year deleted from our website and social media?”
3. Honor erasure requests within 30 days — delete from all platforms, not just archive

Document every erasure request and completion date.

Why this matters: If a parent asks you to delete photos and you don’t, you’re in violation of Section 12 (erasure obligations). Combined with Section 9, that’s two violations, two penalty exposures.

---

What This Costs You If You Get It Wrong

A typical breach scenario at a medium-sized academy (100 students):

Scenario: You photograph your cricket tournament with 40 students (under 18). You post 200 photos to your Instagram and website without collecting consent. Three months later, a parent files a complaint with the Data Protection Board.

Investigation finds:

• No consent forms for any of the 40 students
• Photos remain on Instagram (public processing)
• No retention policy documented
• No consent register

Board’s assessment: One violation (40 students × 1 consent breach = 1 violation under Section 9; publication is a separate processing violation = 2 violations total).

Penalty exposure: ₹50 crore to ₹200 crore (the Board will likely order you to delete all photos, notify affected parents, and pay compensation for privacy harm—estimated ₹5,000–₹50,000 per affected child in settlement).

Remediation costs:

• Legal defense: ₹10–30 lakh
• Photo deletion, website rebuild: ₹3–5 lakh
• Compensation payouts: ₹2–10 lakh (if 40 parents settle)
• Total direct cost before Board penalty: ₹15–45 lakh

Even a smaller breach with 10 students without consent can cost ₹8–15 lakh in legal + remediation fees before any Board penalty.

⚠️ Section 9 violations carry up to ₹200 crore penalties and are enforceable immediately after the Data Protection Board issues an order. You cannot appeal to a higher authority to stay the penalty.

---

FAQ

Can we collect consent for student photos through a Google Form or email, or must it be handwritten?

E-signatures (email, Google Form with signature field, DocuSign) are verifiable under DPDPA if they are dated, time-stamped, and linked to the parent’s email. However, handwritten signatures are simpler to defend in a Board investigation because they’re harder to dispute. If you use e-signature, save the timestamped form AND the completion email as proof. Do not rely on a printout alone—retain the digital record with metadata.

If a parent consents to sports day photos but not social media, and we accidentally post a student’s photo on Instagram, what’s our liability?

That’s a Section 9 violation (processing beyond consented purpose) plus a Section 5 violation (processing without appropriate consent). You’re liable for ₹50 crore per violation. You must immediately delete the photo, notify the parent, and document the remediation. Deleting the photo does not erase the breach—the parent can still file a complaint, and the Board can penalize you for the duration the photo was live. This is why use-restriction controls (Step 4) are critical.

Do we need fresh consent every year, or is multi-year consent acceptable?

You must re-collect consent annually. DPDPA Section 9 treats children’s data as having higher protection standards—consent is not presumed to carry forward. Best practice: collect fresh consent at the start of each academy year. If a student is with you for 5 years, you need 5 separate consent forms, each dated for that specific year. This also gives parents a moment each year to revoke or modify their consent.

If a student turns 18, do we need the parent’s consent anymore, or can we collect consent directly from the student?

Once a student turns 18, they are no longer a “child” under DPDPA Section 9, and you collect consent from them directly. However, for students under 18, you must have verifiable parental consent. If a student is 18 by the time you process their photo (e.g., college-level cricket tournament), you need consent from the student, not the parent. Document the student’s date of birth and consent date to prove they were 18+ at the time of processing.

---

Your Next Step

DPDPAReady’s free DPDPA audit maps your entire sports academy photo workflow against Section 9 and all processing steps—identifying which students’ photos are at risk, whether your consent forms meet verification standards, and how your retention practices align with law. Get yours at dpdpaready.in.

Your first photography session after today should never happen without a signed consent form in your register.