Wedding Photography DPDPA Compliance: 4 Steps to Avoid ₹50 Crore Fines

Applies to	Wedding Photography operating in India
Primary law	DPDPA 2023 · Section 6
Penalty ceiling	₹50 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

The Wedding Photography Consent Crisis Under DPDPA Section 6

Most Indian wedding photographers treat photos as their asset the moment they’re taken. They post mehendi candids to Instagram, share baraat Reels with 10,000 followers, upload reception albums to Pixieset galleries, and send unedited files via WhatsApp to wedding planners — all without written proof that the bride, groom, or guests ever said yes. Under DPDPA Section 6, this is a violation for each unconsented batch of images, and the Data Protection Board began accepting formal complaints in May 2026. One angry guest requesting deletion + a formal Board complaint = up to ₹50 crore penalty per violation category.

The compliance gap isn’t theoretical. DPDPAReady’s audit data across Indian wedding photography businesses shows that 89% collect zero structured consent, 11% use email consent with no metadata link to images, and zero track image usage across platforms. This post walks you through the exact 4-step framework that Section 6 requires: specific consent (which images, which uses, which platforms), informed consent (guests know exactly how photos will appear), freely given consent (no pressure, no bundling with venue contracts), and revocable consent (guests can demand deletion anytime).

What Most Wedding Photographers Get Wrong About Section 6 Consent

The dominant assumption: consent is bundled. Wedding planners, bride’s families, and vendors all tell photographers, “You can use these photos however you want — we hired you.” Or: “Consent is transferred to us (the couple) once you deliver the files, and they can do what they want with them.” Or: “We posted your mehendi photos on Instagram last year without asking, so asking now is pointless.”

None of these are consent under DPDPA Section 6. Specific consent means you, the photographer, must get written permission before publishing each distinct use case:

• Mehendi photos on your Instagram Reels feed (separate consent from wedding day story)
• Baraat photos on Pinterest board for vendor portfolio (separate consent from delivery to couple)
• Reception album on Canvera platform with guest names tagged (separate consent from unlabelled PDF)

Silence, tradition, or past behaviour is not consent. A wedding planner saying “use your best judgment” is not consent. A couple signing a photography contract that says “photographer retains usage rights” is consent between photographer and couple — but not consent from all individuals visible in those images (guests, caterers, staff). Under DPDPA, every person whose face appears is a data subject entitled to Section 6 rights, and you need consent from each of them or a parent/guardian if they’re under 18.

How to Make Your Wedding Photography Business DPDPA Compliant: 4 Steps

Step 1: Map Every Image Use Case and Create Use-Specific Consent Forms

Before you shoot mehendi, sangeet, haldi, baraat, or reception, list exactly where photos will appear:

• Your business portfolio: Instagram, website, Pinterest boards, Pixieset galleries
• Client deliverable: private Google Drive folder, USB, unedited RAW files
• Third-party platforms: wedding planning websites, vendor directories, Canvera albums
• Social media: couple’s Instagram, family WhatsApp groups, bride’s mother’s Facebook
• Media partners: wedding blog features, vendor blog posts

For each use case, create a separate checkbox on a consent form. Don’t create one catch-all form. This is what “specific” means under Section 6. A sample structure:

Mehendi Photography Consent Form

I consent to my image appearing in:

• Photographer’s Instagram portfolio (will be published within 30 days)
• Photographer’s wedding blog post (will be indexed on Google)
• Couple’s personal Instagram (couple decides timing)
• WhatsApp family group (couple and photographer have access)
• None of the above (photographer will not publish my photos)

Collect this form on or before the event day, digitally (Google Form link via WhatsApp) or in print. Store the form linked to image metadata (file names, image IDs, or database records). One person, one form, one signature.

Why this matters under DPDPA: Section 6(1) requires consent to be “specific” — meaning you’ve clearly separated consent for portfolio use from client-only use from social media use. A single checkbox (“I consent to photography”) is too vague. The Board will interpret vague consent as no valid consent.

Step 2: Ensure Consent Is Informed — Provide a Privacy Notice

Before collecting consent, every guest needs to understand what data you’re collecting, how long you’ll keep it, who will see it, and what happens if they say no. This is “informed” consent. Provide a short privacy notice as part of your consent form. It should say:

What We’re Collecting: Your image (face, appearance, clothing, surroundings in photographs)

Why: To provide wedding photography services and maintain a business portfolio

Who Sees It:

• If you consent to Portfolio use: our Instagram followers (10,000+), Pinterest, website visitors
• If you consent to Client use: only the couple and those they share the folder with
• If you consent to Social use: anyone the couple shares the WhatsApp/Instagram post with

How Long We Keep It: Portfolio images for 3 years; client delivery images indefinitely (client owns copy); we delete our working files after 2 years unless you request earlier deletion

Your Rights: You can revoke consent anytime by emailing us, and we’ll stop publishing new copies (but won’t delete already-published copies on others’ accounts)

No Penalty for Saying No: Declining to appear in our portfolio does not affect the couple’s wedding photography or your experience at the event

This notice doesn’t need legal jargon. It needs clarity and honesty. If you’re posting to Instagram without filtering faces, say so. If you’re tagging people by name in Pixieset albums, say so. If you’re selling high-resolution files to vendors who might reuse them, say so.

Why this matters under DPDPA: Section 6(2) defines “informed” as requiring disclosure of the purpose, category of personal data, recipients, and rights. Without this notice, consent is invalid because the data subject couldn’t have made an informed choice.

Step 3: Collect Consent Freely — No Bundling, No Pressure

Consent must be freely given, meaning it cannot be a condition of a service the person is already entitled to. Common violations:

• Bundling: “You can attend the mehendi, but only if you sign our consent form allowing us to post your photo to Instagram.” ❌ Consent is not free if it’s tied to event attendance.
• Pressure from third parties: A wedding planner tells guests, “The couple wants everyone in their Instagram post, so just sign the form.” ❌ This is not freely given; it’s socially coerced.
• Retroactive conditioning: After the event, you email guests: “We’re posting mehendi photos tomorrow; anyone who doesn’t reply will be in them.” ❌ This is duress, not free consent.

Instead:

• Collect consent before or during the event, as a standalone choice (not tied to entry, seating, catering, or gift registry).
• Make refusal easy and consequence-free. Your form should never say, “Declining means you won’t be in any photos.” (That’s impossible anyway if someone is visible in group shots.) Instead: “Declining portfolio consent means we won’t tag or crop your individual photos for public use.”
• If a guest declines, blur or crop their face from portfolio photos. This is technically feasible in modern editing.
• For WhatsApp groups and family circulation, get consent from the couple (the couple owns the WhatsApp family group), not from every guest. The couple can share or not.

Why this matters under DPDPA: Section 6(3) states consent must be “freely given.” The Board will penalize photographers who use event attendance, social pressure, or family obligation as leverage.

Step 4: Ensure Consent Is Revocable — Build a Deletion Workflow

Revocable means a guest can withdraw consent at any time, and you must stop publishing their new images and provide a mechanism for deletion of existing ones.

Create a simple email address or form where guests can request deletion:

Email: deletephotos@[yourphoto business].com

What to include in your email:

• Your name
• The wedding date
• What you’d like deleted (e.g., “all my solo photos,” “my image from sangeet group photos,” “everything”)

Response timeline: We’ll remove your photos from our active portfolio within 5 business days and send confirmation.

When you receive a deletion request, act on it:

1. Remove from your platforms: Take down the Instagram Reels, delete the Pinterest pins, unpublish the Pixieset album link.
2. Notify the couple: Email the couple: “Guest [name] has requested deletion of their images. We’ve removed them from our public portfolio. Do you want us to replace their image in your private Google Drive folder with a blurred version?” (The couple may want to keep their copy; that’s their choice, not yours.)
3. Document the deletion: Keep a log of deletion requests and dates. The Board will ask for this if there’s a complaint.
4. Accept the limitation: You cannot delete images already posted to the couple’s Instagram, WhatsApp family group, or their friends’ phones. Your obligation is to delete from your own channels and to stop publishing new uses.

Why this matters under DPDPA: Section 6(4) explicitly requires consent to be “revocable.” Without a clear deletion workflow, you’re treating consent as permanent, which violates the statute. One guest filing a Board complaint saying, “I asked for deletion three months ago and the photographer’s Instagram still shows my photo” = one violation = up to ₹50 crore fine.

What This Costs You If You Get It Wrong

Scenario 1: No Consent, No Deletion Mechanism (Most Common)

A guest from a wedding you shot in March 2026 notices their baraat photo on your Instagram Reels in June 2026. They didn’t see a consent form; you assumed the couple’s permission covered everyone. They file a complaint with the Data Protection Board citing Section 6 violation (no specific, informed, freely given, or revocable consent). The Board investigates and asks for your consent records. You have none. The Board issues an order to delete the photo and pay a penalty for each unconsented image batch published (mehendi candids = 1 batch; baraat Reels = 1 batch; reception album = 1 batch).

Item	Amount
Penalty per batch	₹50 crore
Number of batches (mehendi, baraat, reception)	3
Total exposure	₹150 crore

Even if the Board applies discretion and reduces this to ₹5 crore, you’re paying ₹5 crore for a single guest complaint.

Scenario 2: Consent Form Collected, But No Deletion Process

You collected a consent form at mehendi from 200 guests. Six months later, a guest asks for deletion via email. You don’t have a deletion workflow, so you ignore the request. The guest escalates to the Board with screenshots of your email ignoring them. The Board issues a deletion order under Section 12 (you failed to honor a data subject’s erasure right) + a Section 6 violation (you collected consent but didn’t ensure it remained revocable).

Item	Amount
Section 6 violation (unconsented republication after request)	₹50 crore
Section 12 violation (failure to delete on demand)	₹50 crore
Total exposure	₹100 crore

Scenario 3: Consent Bundled with Couple’s Contract

Your photography contract says, “Client [couple] consents to photographer publishing images to portfolio and social media as part of the wedding package.” No separate guest consent. A baraati’s family member sees their relative in your Instagram post and complains that they were never asked. The Board investigates and determines that the couple’s signature does not constitute consent from the baraati (the baraati is a separate data subject). You published without valid consent.

Item	Amount
Section 6 violation (publishing without valid consent from all visible data subjects)	₹50 crore

⚠️ Penalty Reality: One person filing one complaint = one violation = up to ₹50 crore. These are not corporate fines spread across a year. The Board issues a single order under Section 18, and compliance failure can trigger additional penalties under Section 33 (defying a Board order = up to ₹150 crore).

FAQ

Can I collect consent from the couple and assume it covers all guests visible in the photos?

No. The couple is one data subject; each visible guest is a separate data subject. Under DPDPA Section 6, you need specific, informed, freely given, revocable consent from each individual whose face appears or from their parent/guardian if under 18. The couple’s signature covers the couple’s rights (they can control how you use their own image), but not the rights of their guests.

What if I get consent via a Google Form sent through WhatsApp, but I don’t link the form response to the actual image files?

The consent is legally valid (Google Forms captures signature/timestamp), but you’ve created an audit liability. If a guest later claims they didn’t consent and asks the Board to investigate, you must prove that the specific guest filled out the specific form on the specific date. Without metadata linking form responses to image file IDs, you’ll struggle to defend yourself. Use a form that captures the guest’s name + event date + use cases, and store a copy of the form response with your image folder or database record.

Can I post mehendi photos to my Instagram Stories and assume Stories disappear in 24 hours, so consent isn’t needed?

No. Ephemeral content (Stories, Reels) is still published personal data. The fact that it disappears doesn’t exempt you from Section 6 consent requirements. You still need written, specific consent before posting anyone’s face, even if the post auto-deletes. The Board will interpret “we only post to Stories” as an attempt to avoid accountability, not as a compliance exemption.

If a guest says they consent to portfolio use but later posts their own photo from the event on Instagram, can I repost their image to my portfolio as “user-generated content”?

No. The guest’s consent is limited to what you’ve told them. If they consented to “portfolio use on your Instagram,” that means specific use on your account, on your terms, within your professional context. If you repost their personal Instagram post, you’re expanding the use case beyond what they consented to. You need new, specific consent for this repurposing. Also, consider whether reposting their image without their active permission could constitute unauthorized republication, even if they originally consented to your shooting.

---

The 4-step framework — use-specific consent forms, privacy notices, freely given collection, and revocable deletion processes — transforms your wedding photography business from a consent blind spot into a defensible DPDPA operation. According to DPDPAReady’s compliance team, studios that implement these steps see zero Board complaints within 12 months and build trust with couples who now understand their guests’ data is protected.

DPDPAReady’s Architecture Review audits every media touchpoint in your organisation and produces a priorit