Section 4 Compliance for News Media: 8-Step Purpose Declaration Template

Applies to	News media outlets, photojournalism firms, and editorial agencies processing personal data of sources, subjects, and photographers in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	up to ₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-06
Source	DPDPAReady Compliance Team

Section 4: Understanding Purpose Limitation in News Media

A photojournalist captures images at a political rally with permission from subjects. Six months later, she wants to reuse those images in a book about Indian elections. Under Section 4 of the DPDPA, what seemed like permission for “news coverage” does not automatically extend to a book—a different purpose requires new consent.

“Personal data shall be processed only for the purposes for which such data was collected and as intimated to the data subject at the time of collection.” (DPDPA Section 4, core principle)

This concept, called purpose limitation, forms the backbone of Section 4 compliance. News media organizations that collect data—interviews, photographs, source information—must clearly disclose how that data will be used and cannot later repurpose it without fresh consent. A violation of Section 4 can result in penalties up to ₹150 crore and civil liability claims from affected data subjects.

Why Section 4 Matters for Journalism

News organizations collect personal data from three categories of people:

1. Interview subjects — people you quote, feature, or profile
2. Sources — confidential informants, anonymous contributors, whistleblowers
3. Photo subjects — people whose images appear in your stories

For each group, Section 4 creates a specific obligation: you must disclose the exact purpose of data collection at the time you collect it. You cannot later use that person’s data for a purpose they did not consent to—even if that new purpose seems related to the original story.

The risk is high. A journalist who repurposes a source’s quote in a book, podcast, or syndicated article without fresh consent has violated Section 4. A photographer who licenses subject images to a third party without notifying the subject has violated Section 4. These breaches expose your organization to penalties that can exceed ₹150 crore.

8-Step Section 4 Compliance Checklist for News Media

Use this checklist every time your organization collects personal data:

1. Identify the data subject type — Is this an interview subject, source, photo subject, or photographer/contributor?
2. Define the primary purpose — What is the specific story, edition, or platform for which you’re collecting this data? (e.g., “Feature on education policy, The Daily Post June 2026 print edition”)
3. Document the notification — Did you tell this person exactly how their data would be used, in writing?
4. Verify consent scope — Did the person agree only to that specific purpose, or to broader uses?
5. Set a retention limit — When will this data be archived or deleted after publication? (Section 4 requires you to specify duration)
6. Plan for secondary use — If you want to republish (book, documentary, archive, podcast, syndication), note that you will need fresh consent or must anonymize the data
7. Log the purpose — Record this decision and the disclosure in your data register (required under Section 17 of DPDPA)
8. Train your team — Ensure all journalists, photographers, and editors follow this process before collection

Section 4 Purpose Declaration Template

Copy this template and complete it for every data subject. Print, sign, and archive with your story file.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PERSONAL DATA COLLECTION FORM — Section 4 DPDPA Compliance
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Collection Date: [DD/MM/YYYY]
Journalist/Photographer: [FULL NAME & BYLINE]
Publication/Platform: [e.g., "The Metro Times, June 28, 2026 print edition"]
Story Title: [ARTICLE HEADLINE]

DATA SUBJECT DETAILS
Name: [FULL NAME]
Contact: [PHONE / EMAIL]
Role/Context: [e.g., "Political analyst interviewed for 2026 elections feature"]

PRIMARY PURPOSE OF DATA COLLECTION (Be specific. Do not write "news coverage.")
[e.g., "To include in a feature article titled 'State Elections 2026: Expert Analysis' 
in The Metro Times print edition, June 28, 2026, and archived on our website for 
5 years thereafter (until June 2031)."]

CATEGORIES OF PERSONAL DATA COLLECTED
☐ Name and contact details (phone/email/address)
☐ Interview transcript or direct quotes
☐ Photograph, video, or audio recording
☐ Opinion, statement, or statement of fact
☐ Other (specify): [_________________]

CONSENT DECLARATION
[Read aloud and obtain signature:]

"Your personal data will be processed ONLY for the purpose stated above. 
It will not be used for any other purpose, marketing, or republication without 
your fresh written permission. You can withdraw your consent by emailing us 
within 7 days of this collection. This organization maintains a data register 
under the Digital Personal Data Protection Act, 2023."

Data Subject Name (print): ________________
Data Subject Signature: __________________ Date: ___/___/______

Journalist Signature: __________________ Date: ___/___/______

SECONDARY USE PLAN (complete only if applicable)
Are you planning to republish, compile, or reuse this data in another format?

☐ No secondary use planned
☐ Yes, planned for: [e.g., "Compilation book 'Elections 2026: Voices' – Dec 2026"]
  
  If yes, your action is:
  ☐ Obtain fresh written consent from this data subject before republication
  ☐ Anonymize the data completely (name, identifying details removed)
  ☐ Delete the data entirely

DATA RETENTION & ARCHIVAL
Retain until: [DATE]
Archive location: [Google Drive / Internal Server / Cloud Backup]
Delete/Destroy by: [DATE]
Destruction method: [e.g., "Secure deletion, AES-256 wipe, or physical destruction"]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Common Section 4 Compliance Mistakes in News Media

Mistake 1: Vague consent language
Wrong: “I consent to my data being used for news purposes.”
Right: “I consent to my data being used in the feature ‘Election 2026 Voices’ in The Daily Post print edition, June 2026.”
Why: “News purposes” is too broad. Section 4 requires you to specify the purpose at collection. If you later use the data for a different story, medium, or publication, you cannot claim consent was already given.

Mistake 2: Assuming published = allowed to republish anywhere
Many news organizations assume that once a story is published online or in print, the data can be republished, syndicated, or compiled without fresh consent. Section 4 does not allow this. Each new publication format or outlet is a new purpose and requires fresh consent or anonymization.

Mistake 3: No written documentation of purpose
Section 17 of DPDPA requires you to maintain a data register documenting the purpose for which you collected personal data. If you cannot produce written evidence of the purpose disclosed at collection, you lose your defense against a Section 4 breach claim. A verbal promise to a source is not sufficient.

Mistake 4: Collecting data you don’t need for the stated purpose
You ask a source for their phone number, address, and employer details “just in case.” But your stated purpose is “interview for 2026 elections story.” Section 4 requires data minimization: collect only the data necessary for the stated purpose. Extra data is a violation.

Mistake 5: Merging datasets or linking with third-party sources without re-disclosure
You interview a politician and later link their interview data with voter poll data or background checks from another database. This creates a new purpose (“profiling” or “voter analysis”) and violates Section 4 unless you notified the subject of this risk at collection.

Mistake 6: No written consent for photographs
A photographer captures images at a public event. Section 4 applies even to public photography: the moment you collect the image into your database and assign it to a story, it becomes personal data. You must obtain written consent stating the specific publication purpose. “General news” is not specific enough.

Section 4 Breaches: Penalties, Liability & Injunctions

Under Section 33 of the DPDPA, a violation of Section 4 (purpose limitation) can result in:

• Financial penalty: Up to ₹150 crore per breach
• Injunction: Court orders to stop the breach, remove data, or retract publication
• Damages: Civil liability to the affected data subject, potentially in addition to the statutory penalty
• Reputation damage: Loss of source trust, editorial credibility, and future journalistic access

Journalists and photographers face unique liability because sources depend on transparent, limited-purpose data handling. A breach signals that your organization cannot be trusted with sensitive information. This makes future investigations harder.

Frequently Asked Questions

Q1: Does Section 4 apply to anonymous sources and anonymized data?

A: Partial anonymity complicates Section 4. If you can identify the source by context (even without a name), you hold personal data and must disclose the purpose. If the source is cryptographically anonymous and you truly cannot re-identify them, Section 4 may not apply; however, DPDPA’s premise is lawful processing, so even anonymous handling needs a stated purpose at collection. Best practice: treat all sources as personal data subjects and obtain written consent with disclosed purpose.

Q2: Can I use quotes from a social media post without fresh consent?

A: No. Even if a quote is publicly posted on social media, the moment you collect it (copy it into your database, assign it to a story), it becomes personal data under Section 4. The original purpose (social media sharing) differs from your purpose (journalistic publication). Section 4 requires you to disclose this new use. Public does not mean “consent to any purpose.” You should contact the source and notify them of your intended publication or obtain their written consent.

Q3: If a photographer signs a general release, can I use their images in any story or platform?

A: Only if the release explicitly lists all intended purposes. A release that says “use in The Metro Times” does not authorize use in a book, podcast, license to third-party agencies, or syndication. Each new purpose requires fresh consent or a clause in the original release that names the secondary use. Blanket releases (“any use”) are not recommended under Section 4 because they lack specificity.

Q4: What if a source objects to republication after the story airs?

A: Under Section 6 of DPDPA (consent withdrawal), a data subject can withdraw consent at any time. Once withdrawn, you must stop processing that data for new purposes. If you have already published the story, you may not need to retract the article; however, you must stop using that person’s data in new contexts (e.g., do not include their quote in a book or podcast). Clarify withdrawal rights upfront in your template and honor withdrawals promptly.

Q5: Does Section 4 provide a “journalistic exemption” for sensitive investigations?

A: DPDPA Section 25 provides a narrow exemption for journalism and free speech, but Section 4 (purpose limitation) is not fully exempted. You must still disclose the purpose of data collection—even if that purpose is a confidential investigation. You can use protective language such as “Investigation into procurement irregularities” rather than naming the specific agency. You do not need to disclose your sources; however, you must document the purpose internally. Consult a media lawyer for high-risk stories involving national security or internal whistleblowers.