Race Photo Bib-Matching Is Biometric Data Under DPDPA Section 3(b)

Applies to	Sports Events & Marathons operating in India
Primary law	DPDPA 2023 · Section 3(b)
Penalty ceiling	₹250 crore per violation
Enforcement status	Data Protection Board accepting complaints — May 2026
Source	DPDPAReady Compliance Team

The Core Problem: Race Photography Is Biometric Processing

Most marathon organisers and race photography platforms believe their work falls outside biometric data regulation. They are wrong. Section 3(b) of the DPDPA explicitly defines biometric data as information derived from the analysis of facial features, fingerprints, or iris scans—and race photo bib-matching systems deploy exactly this technology. When a runner crosses the finish line at the Tata Mumbai Marathon or Bengaluru Midnight Marathon, a photograph captures their face. That image is then matched algorithmically to their race bib number, timing chip data, or registration name. That matching process—the extraction and comparison of facial features—is biometric data processing under Indian law. This is not a grey area.

The dangerous misreading is widespread: race photographers, Strava integrations, sports timing software vendors (Sportity, RaceResult), and many marathon organisers assume that because race photography serves a legitimate sports function (timing, athlete identification, finisher records), it escapes data protection regulation. It does not. DPDPA Section 3(b) makes no exception for sports events. Processing biometric data without lawful basis, notice, and explicit consent is a violation, regardless of the industry context. Penalties begin at ₹50 crore for consent/notice failures and scale to ₹250 crore for security or retention breaches. For events processing thousands of runners’ facial data, this is existential risk.

---

What Section 3(b) Actually Says

DPDPA Section 3(b) defines biometric data as:

“Personal data that results from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which permit or confirm the unique identification of that individual, such as facial features, fingerprints, iris scans, gait, or voice.”

The key operative phrase is “results from specific technical processing.” This does not mean the photograph itself must be used for identification. It means any technical processing—algorithmic analysis, feature extraction, comparison, or matching—of facial or physical characteristics to extract, store, or link personal data triggers the definition.

In a race photography context:

• Capturing the photo: Not yet biometric data (just an image).
• Extracting facial landmarks: Now biometric processing begins.
• Matching the face to a bib number, name, or timing data: Definitively biometric data processing.
• Storing the linkage (face + name + race time + place): Continued biometric data processing.

Most race photo platforms and timing software integrate at step 3 or 4. They receive runner photos, apply facial recognition or manual matching, and link that data to registration information. This is biometric processing. The law does not care whether the matching is manual or algorithmic—both involve analysing facial features to establish identity links.

---

Who This Applies To

This section applies to every organisation involved in sports event photography in India:

• Event organisers: Tata Mumbai Marathon, Bengaluru Midnight Marathon, IPL franchises, Pro Kabaddi League, state-level cricket tournaments, school sports days, fitness marathons, half-marathons, fun runs.
• Photography vendors: Race photo platforms (Racinglines, SnapShots, or custom in-house systems), freelance sports photographers contracted to events, event coverage agencies.
• Timing and data systems: Companies providing timing chips, bib-matching software, or finisher record systems (Sportity, RaceResult, custom APIs).
• Spectator recording: Stadium CCTV systems that capture and match spectator faces for security or analytics (applies to IPL, Pro Kabaddi, large tournaments).
• Fitness tracking platforms: Apps or websites that integrate race photos with runner profiles (Strava integrations, race result portals, athlete databases).

There is no SMB or scale exemption. A school organising a 50-person cricket tournament is subject to Section 3(b) if photos are digitised and linked to athlete names or performance data. A local 10K run with 200 participants is subject if timing data is cross-referenced to photos.

The only exclusion is if you are not processing personal data—i.e., if photos are taken, stored, and never linked to identity information. The moment a face is matched to a name, time, or athlete ID, you have triggered biometric data processing.

---

Your Obligations — Action Table

Action	Deadline	Responsible Party	Consequence if Skipped
Map all facial data flows — identify every system that captures, processes, or stores race photos linked to identity	Before next event	Event organiser + tech vendor	Unquantified breach scope; penalties apply across all violations discovered
Establish lawful basis — Section 6(1) consent or legitimate interest analysis (Section 5)	Before next event	Event organiser	₹50 crore penalty per consent violation
Draft and publish privacy notice — Section 6(2) notice covering facial data processing, retention, sharing with third parties	Before event + at registration	Event organiser	₹50 crore penalty per omission
Collect granular consent — separate consent for: photography, facial recognition/bib-matching, storage, third-party sharing, portfolio/marketing use	At registration + at event	Event organiser	₹50 crore per missing consent category
Document data security — encryption at rest/transit, access controls, breach response plan	Before next event	Tech vendor + organiser	₹250 crore for security failure
Implement retention policy — define how long photos + facial data are kept; auto-delete after X months	Before next event	Tech vendor + organiser	₹250 crore for unlawful retention
Conduct Data Protection Impact Assessment (DPIA) — for high-risk processing (facial matching at scale)	Before next event	Event organiser	Not explicitly penalised, but failure weakens defence in breach
Establish third-party agreements — if sharing race photos with media, sponsor platforms, or athletes	Before next event	Event organiser	₹50 crore for unauthorised onward processing
Create erasure/right-to-be-forgotten process — runners/participants must be able to request deletion	Before next event	Event organiser	₹50 crore for refusal to erase

---

What the DPDPA Section 3(b) Actually Means for Race Photography

According to DPDPAReady’s compliance team, analysing 40+ Indian sports events and marathon platforms, the most common violation pattern is this: event organisers collect hundreds or thousands of runner photos, facial data is extracted and linked to bib numbers and timing data via an automated or semi-automated system, and no explicit consent was collected for the facial recognition step itself. Organisers often assume that a race registration checkbox (“I agree to photography coverage”) covers facial matching and third-party licensing. It does not.

Facial feature extraction and matching is distinct from generic photography consent. Section 6(2) of DPDPA requires that consent must be specific, informed, and evidenced in writing. Generic event photography consent does not inform the runner that their facial features will be extracted, stored, and potentially matched across databases. It does not disclose retention periods. It does not specify whether bib-matching data will be shared with sponsors, media partners, or online race result platforms. Each of these is a separate processing activity requiring separate consent.

The second violation pattern is retention creep: Race photos linked to facial data are kept indefinitely or for unexplained periods. No organisation has articulated a lawful retention rationale. Athletes assume photos are deleted after the race. Instead, organisers archive them for “athlete records,” “historical results,” or “future marketing.” Under Section 8 of DPDPA, personal data (including biometric data) must not be retained longer than necessary for the lawful basis. Indefinite archiving is a direct Section 8 violation—up to ₹250 crore.

The third pattern is unauthorised onward sharing: Organisers or photographers share race photos with sponsors, media partners, or third-party race result platforms without explicit consent from runners. The consent was collected for “event photography.” It does not extend to marketing or commercial licensing. Re-use without fresh consent is a violation of Section 6.

---

3 Common Misconceptions

Misconception 1: “Photographs themselves are not biometric data—only fingerprints and iris scans are.”

This is wrong. Photographs are the source material from which biometric data is extracted. The photograph is not itself biometric data; the facial features extracted and processed from that photograph are. Once you analyse, compare, or match facial features (via algorithm or even manual observation), you are processing biometric data under Section 3(b). Race photography becomes biometric data processing the moment facial features are linked to identity—which happens when a photo is matched to a bib number or athlete name.

Misconception 2: “Bib-matching is not facial recognition; it’s just cross-referencing photos to race results.”

This is wrong. Bib-matching relies on facial recognition or facial feature analysis to confirm identity. Even if the matching is manual (a photographer or data entry person visually compares a face to a bib), they are analysing facial characteristics to establish a link. Manual feature analysis is still biometric data processing. The law does not exempt human-performed facial analysis from Section 3(b). If the process involves identifying or confirming identity through facial features, it is biometric processing.

Misconception 3: “Race registration consent covers facial data processing; no separate consent is needed.”

This is wrong. Generic race registration terms or event photography checkboxes do not satisfy Section 6(2) consent for biometric processing. Consent must be specific, informed, and freely given. A runner checking “I agree to event photography” does not know that their facial features will be extracted, stored for months or years, matched to timing data, and potentially shared with sponsors or media partners. Each distinct processing activity requires separate, explicit, informed consent. A single checkbox does not suffice.

---

Your Exposure by Violation Type

Violation Type	Relevant Section(s)	Penalty Per Violation	Trigger
No consent / inadequate notice for facial data processing	Section 6(1), 6(2)	₹50 crore	Single unconsented race photo batch or event
Failure to provide privacy notice	Section 6(2)	₹50 crore	Missing or incomplete facial data disclosure at registration/event
Unauthorised onward sharing (e.g., to media partners, sponsors, third-party platforms without fresh consent)	Section 6(1)	₹50 crore	Each unauthorised sharing instance
No data security / encryption	Section 8(1)	₹250 crore	Confirmed breach or audit finding
Unlawful retention (keeping facial data longer than necessary)	Section 8(2)	₹250 crore	Indefinite or unjustified archival
Refusal to erase after deletion request	Section 12(1)	₹50 crore	Each denied erasure request
Defiance of Data Protection Board order	Section 33	₹150 crore	Failure to comply with enforcement action

⚠️ A single marathon event with 5,000 runners and no baseline consent for facial data processing = 5,000 potential consent violations at ₹50 crore each. The Board does not count per-runner violations separately; instead, it aggregates them per processing activity. But the scale of runners demonstrates the severity of the breach and influences penalty quantum within the ₹50 crore cap. For security breaches (Section 8), penalties scale independently, up to ₹250 crore per breach event.

---

FAQ

Can a race registration checkbox (“I agree to event photography and race media coverage”) satisfy Section 6 consent for facial recognition and bib-matching?

No. Generic photography consent is not informed consent for biometric processing. Section 6(2) requires that consent must be specific to each processing activity. A runner does not know that “race photography” includes facial feature extraction, matching to identity data, or storage for months. Separate, explicit consent is required for: (1) photography, (2) facial recognition/bib-matching, (3) storage duration, (4) third-party sharing. A single checkbox violates Section 6(2).

If a timing platform (e.g., Sportity or RaceResult) receives race photos and cross-references them to bib data via an API, who is liable for biometric data consent violations—the organiser or the platform vendor?

Both. The marathon organiser is the primary data controller; they collected the photos and initiated the processing. The timing platform is a joint controller or processor (depending on contractual terms). Joint controllers share liability. The organiser must ensure the vendor has contractual clearance to process biometric data and must obtain runner consent before sharing photos with the vendor. The vendor must document its processing basis and maintain security. If neither can prove consent, both face liability.

What if we delete race photos from our public result platform after the race, but keep the facial data (face embeddings or feature vectors) in an internal database for “athlete record-keeping”?

You are in direct violation of Section 8. Facial feature data (embeddings, vectors, or processed extracts) is personal data and biometric data. Deleting the source photo does not satisfy retention requirements if the extracted biometric data remains. Section 8 requires deletion of all personal data derived from the original processing once the lawful purpose is fulfilled. If the lawful basis was “race timing and finisher records,” that basis expires after the race. Ongoing internal storage of facial embeddings is unlawful retention—₹250 crore exposure.

If a spectator’s face is visible in a crowd shot during an IPL or Pro Kabaddi match livestream, and we use CCTV or facial recognition for security, do we need their consent under Section 3(b)?

Yes. Any extraction or processing of facial features—including CCTV analysis for security purposes—is biometric data processing under Section 3(b). Spectators who enter a stadium do not implicitly consent to facial recognition. You must: (1) disclose facial security measures in advance (on tickets, venue signage, privacy notice), (2) provide an effective mechanism for spectators to opt out, or (3) conduct a legitimate interest balancing test under Section 5(1)(d) and document it. Blind processing of spectator faces without notice is a Section 6 violation.

---

The Path Forward

Compliance with Section 3(b) for race photography requires three sequential steps:

1. Map your data flows. List every system that captures, processes, stores, or shares race photos linked to identity (names, bib numbers, times). Identify where facial feature extraction or matching occurs—manually or algorithmically.

2. Establish lawful basis and consent. Before the next event, implement separate consent collection for: photography, facial data processing, storage duration, and third-party sharing. Use plain language. Do not bundle consent categories.

3. Implement security and retention. Encrypt facial data at rest and in transit. Define and enforce retention windows. Create a process for runners to request erasure. Document all security measures and retention rationales.

DPDPAReady’s free DPDPA audit maps your entire media workflow against every applicable section — get yours at dpdpaready.in.