News Media & Section 4: 3 Legal Grounds for Photojournalism Data

Applies to	News media organizations and photojournalism agencies operating in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-06
Source	DPDPAReady Compliance Team

A newspaper publishes a protest photo. The subject sues—no consent form, no written ground. The editor searches DPDPA Section 4 at midnight. What did they miss?

Section 4 is India’s data processing permission slip. Without a valid ground listed there, every subject photo, quote, location, or identifying detail you capture becomes a compliance violation—potentially costing ₹150 crore.

News media operate under a common myth: news privilege is automatic. DPDPA Section 4 disagrees. You must prove one of six grounds for every image you process.

What Section 4 Actually Says

Section 4 of DPDPA 2023: “A data fiduciary may process personal data of a data subject only on the basis of any one or more of the following grounds: (a) with the consent of the data subject; (b) for performance of a contract to which the data subject is a party; (c) for compliance with any law for the time being in force; (d) for protection of vital interests of the data subject or any other person; (e) for the performance of any function of the State; (f) for legitimate interests of the data fiduciary or any other person, provided that such processing does not cause unjustified harm to the data subject.”

That last phrase—“provided that such processing does not cause unjustified harm”—is where most media stumble.

Step 1: Identify Which Ground Justifies Your Photo

Before hitting publish, assign the photo to ONE of these grounds. Not “maybe one works later”—now.

Ground (a): Consent

• Explicit, written agreement from the subject before capture or publication
• “I agree to be photographed and published in [publication] for [purpose]”
• Specificity matters: “published in Times Now for evening news on protest coverage” is valid; “used anywhere anytime” is not
• When to use: Portraits, interviews, posed photos, any subject who sees the camera
• Red flag: Street candids where the subject is unaware—consent is absent, so Ground (a) fails

Ground (c): Compliance with Law

• You’re processing the photo because a law requires it
• RTI request for a government official’s photo? Ground (c)
• Police asking for a suspect photo in an investigation? Ground (c)
• When to use: Rare. Mainly when a statute, court order, or regulator directive mandates publication
• Not valid for: “Publishing news is lawful” (being legal to publish ≠ being required by law)

Ground (e): State Function

• Your news org is performing a government function (rare outside official broadcasters like DD/AIR)
• When to use: Virtually never in private media
• Skip this unless you’re a state-owned broadcaster

Ground (f): Legitimate Interests

• You’re processing the photo because the public interest in knowing the story outweighs the subject’s privacy
• A politician accepting bribes? Legitimate interest in exposing corruption
• A climate protest leader? Legitimate interest in documenting the event
• Critical caveat: “Does not cause unjustified harm”—if you blur the subject’s face, crop out identifying details, or anonymize, you’ve reduced harm
• Red flag: Publishing the subject’s home address, family members’ photos, or intimate details alongside the protest photo = unjustified harm, Ground (f) fails
• This is a test, not a blanket pass: Every use of Ground (f) must document why the public interest outweighs privacy for this specific photo in this specific context

Ground (d): Vital Interests

• Processing to prevent imminent physical danger to the subject or others
• A missing-child photo published to find them before harm occurs
• When to use: Rare, emergency-only situations
• Not the default for daily journalism

Ground (b): Contract

• You’ve signed an agreement with the subject to use their photo in exchange for money, credit, or service
• A photographer licensing images to wire services
• When to use: Commercial licensing, wire service agreements, stock-photo deals

Step 2: Document the Ground in Writing

“We used Ground (f)—legitimate interests” is not documentation. Here’s what DPDPA regulators expect:

Create a Data Processing Ground Record for each photo set (or at minimum, for each story):

Story/Campaign: [e.g., "Mumbai Monsoon Flooding—June 2026"]
Publication: [e.g., "Times Now Evening Bulletin"]
Data Collected: Subject photo, name, age, location
Grounds Relied Upon: [select one or more: Consent (a) / Contract (b) / Legal Compliance (c) / Vital Interest (d) / State Function (e) / Legitimate Interest (f)]

IF GROUND (A)—CONSENT:
  Consent Form Attached: [Yes/No]
  Consent Date: [dd/mm/yyyy]
  Scope of Consent: [e.g., "Published in Times Now for monsoon coverage only; no social media without re-consent"]

IF GROUND (F)—LEGITIMATE INTERESTS:
  Justification: [e.g., "Public interest in monsoon disaster response outweighs subject's privacy interest in being identified as flood victim"]
  Harm Assessment: [e.g., "Subject's face visible but name anonymized; no home address, family details, or financial data disclosed"]
  Retention Plan: [e.g., "Photo deleted 6 months after publication unless legal archive requirement applies"]

Sign Off: [Editor Name, Date]

This document is your defense if a regulator calls.

Step 3: Implement Safeguards for Each Ground

For Consent (Ground a)

• Print or email the subject a simple 2-sentence consent form before the interview/shoot: “I consent to [publication name] photographing me for news purposes on [date]. I understand this photo may be published in [platform].”
• Retain the form for 3 years (DPDPA record-keeping)
• If the subject refuses, do NOT photograph them; if you already have archival footage, delete it or anonymize

For Legitimate Interest (Ground f)

• Apply a visual anonymization test: Could the subject’s identity be obscured without losing the news value? Blur the face, crop tighter, use a silhouette. If yes, do it.
• Document the specific public interest: “Monsoon victim” is legitimate; “person wearing branded clothing in flood” is not
• Plan retention with an expiry: “6 months after publication for news archive; permanent deletion after” is proportionate
• Flag sensitive categories: If the photo reveals health status, caste, religion, or financial hardship, the legitimate-interest bar is higher—justify why disclosure serves the news value not voyeurism

For Legal Compliance (Ground c)

• Keep a copy of the court order, statute, or regulator directive that mandates the photo’s use
• It’s not enough to be legally allowed; it must be legally required

For Vital Interests (Ground d)

• Document the emergency: “Missing child alert, police request on [date], published within 2 hours”
• Cease use once the danger passes (child found)

Why News Media Get This Wrong

Myth 1: “Public figure exemption.” Reality: DPDPA has no public-figure carve-out. A politician’s photo still needs Ground (a), (c), (e), or (f)—you must justify it.

Myth 2: “News privilege = automatic Ground (f).” Reality: Legitimate interest is not automatic. A candid street photo of an ordinary person does not generate automatic public interest. You must document the news value and how you’ve minimized harm.

Myth 3: “Anonymized = free to publish.” Reality: Anonymization is a harm-reduction tactic, not a ground-replacement. You still need Ground (a) or (f) to process the original photo. Anonymization makes the harm smaller, so Ground (f) is easier to justify—but it doesn’t eliminate the need for a ground.

Myth 4: “We got consent once, so we can reuse forever.” Reality: Consent is specific to purpose and platform. If you got consent for “Times Now evening bulletin,” reusing on Instagram Reels requires new consent or a new ground (e.g., legitimate interest for ongoing news archive).

Checklist: Before Publishing

• I have identified ONE ground from Section 4 that applies to this photo
• If Ground (a): Signed consent form in hand, dated, scoped to this publication/platform
• If Ground (f): I have documented the public interest and harm assessment
• If Ground (c): I have a copy of the law/court order requiring publication
• I have anonymized or minimized identifying details where possible (reduces unjustified harm)
• The data processing ground record is filed and signed
• Retention period is set (when will this photo be deleted?)
• For sensitive data (health, caste, religion, finances): Extra justification added

A Real Scenario

A photojournalist captures an image of a woman receiving medical aid at a floods-relief camp. Her face is visible, her name is unknown, but her distress is evident. The story is “Healthcare Crisis in Flood Zones.”

Which ground?

• Not Consent (a): Subject was unaware of the camera; you have no form.
• Not Legal Compliance (c): No law mandates this photo.
• Not Vital Interest (d): The flood is documented; the woman is not in imminent danger from non-publication.
• Likely Ground (f)—Legitimate Interests, if:
  • The woman’s face is blurred or silhouetted to reduce identification
  • The caption describes the healthcare crisis without naming her
  • The photo is deleted 6 months after publication (unless archived for public record)
  • Editorial notes document: “Public interest in healthcare access > subject’s privacy interest in anonymity, given visual anonymization and limited retention”

Not Ground (f) if:

• Her name is captioned: “Supriya Das, 42, awaits insulin” (now unjustified harm—she’s identifiable and health data is exposed)
• She’s followed on social media based on the photo (mission creep beyond news)
• The photo is licensed to a health insurance company (new purpose, new ground needed)

Frequently Asked Questions

Q: Do I need written consent for every photograph? A: Only if you rely on Ground (a)—Consent. If you justify the photo under Ground (f)—Legitimate Interests—consent is not mandatory, but you must document why public interest outweighs privacy and how you’ve minimized harm. Practically: consent forms are simpler and faster. Get them when you can.

Q: Can I publish a protest photo without consent if it’s “public interest”? A: Yes, under Ground (f)—Legitimate Interests—if: (1) the person is a key figure in the protest (not a bystander), (2) their face is not blurred, but you’ve anonymized other details (name, home address, family), and (3) you’ve documented why the photo serves news value beyond mere visibility. A bystander caught in the crowd? Blur their face and use Ground (f) with anonymization. No documentation, no ground—you’re exposed to ₹150 crore in penalties.

Q: If a subject requests deletion after publication, must I comply? A: Under DPDPA Section 12, subjects have erasure rights, unless retention is required for legal obligation (archive), news function, or public interest. Practically: A protest photo published 1 year ago and still archived on your website? You should delete it or anonymize it on request, unless there’s a compelling retention reason. Document your retention policy upfront.

Q: What if we license photos to a wire service—what ground covers that? A: Ground (b)—Contract. The wire service agreement specifies how photos will be used, geographic scope, platforms, and retention. Ensure the contract also assigns liability if the wire service violates DPDPA (indemnification clause). You’re liable if you sell images without ground; the wire service is liable if they use them beyond the contract scope.

Q: Do I need DPDPA consent for archival footage of historical events? A: No, if the archival purpose itself is the ground. Ground (c)—Legal Compliance—covers retention for statutory archive obligations. Ground (f)—Legitimate Interests—covers editorial judgment to preserve historical record. Document which applies. But if you’re republishing a 10-year-old protest photo today as new news, treat it as a new processing event—you need a current ground (consent, legitimate interest, etc.), not the old one.