DPDPA Section 4 for News Media: Consent & Collection Notices for Photojournalism

Applies to	News media outlets, photojournalism studios, and independent photojournalists operating in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-07
Source	DPDPAReady Compliance Team

When a Photojournalist Captures Without Consent—What Section 4 Requires

A Delhi news bureau sends a photographer to cover a street protest. Candid shots capture protesters’ faces alongside their names collected from police records. The outlet publishes the images online without explicit consent from those pictured. Under DPDPA Section 4, this workflow—collecting, processing, and publishing personal data without notice—now attracts regulatory scrutiny and penalties up to ₹150 crore. Section 4 mandates that any personal data collection must be preceded by clear notice to the data subject, explicit consent, and transparent handling practices.

Section 4: Notice & Consent as the Legal Ground for Data Collection

Section 4 of the DPDPA establishes the foundational requirement for any lawful personal data processing:

“Where a data fiduciary collects personal data, it shall provide notice to the data subject containing such information as may be prescribed, and after providing such notice and obtaining the consent of the data subject, collect personal data relating to that data subject.”

This requirement is absolute. Notice and consent are the gateway for any data collection in news media—whether your outlet collects contact details, publishes photographs with identifiable features, retains interview recordings, or maintains archives of named sources.

What “Notice” Means in the Newsroom

For photojournalism, notice means:

• Timing: Before collecting data (before the photo shoot, interview, or initial contact)
• Form: Written, verbal, or digital—but documented and retrievable
• Content: Purpose (news reporting), categories of data collected, retention period, erasure rights, and who has access
• Language: In a language the subject understands (Hindi, regional language, or English if literate)
• Context: In breaking-news scenarios, notice can be abbreviated but must still inform the subject their image/data will be used and published

What “Consent” Means Under Section 4

Consent is specific, informed, and freely given:

• Specific: The subject must agree to data use for news publishing, not blanket consent for all purposes
• Informed: They must understand what personal data is collected and how it will be used
• Freely given: No coercion, no pressure from authorities or editorial teams; consent cannot be bundled with unrelated terms
• Documented: Retain records of when, how, and by whom consent was given (verbal consent with a timestamped memo is acceptable but riskier than written)

Newsroom Reality: If a subject says “you can take my photo but don’t publish my name,” their consent is conditional. Publishing the name without re-consent violates Section 4.

Five-Step Implementation Checklist for News Media Compliance

Step 1: Pre-Assignment Consent Preparation

• Create and distribute a Consent Form Template (provided below) for routine assignments
• Train photographers to verbally obtain consent if written forms are impractical (breaking news, crowded events); document the time, subject name, and consent terms in assignment notes
• For named sources or identifiable subjects, require signed consent or a memo from the photographer confirming verbal consent

Step 2: On-Assignment Notice & Consent

• Photographer introduces their outlet and purpose: “I’m from [News Organization] covering [event/topic]”
• For identifiable photos: “We will publish this photo in our news report and online. Do you consent?”
• For minors or vulnerable subjects: Obtain written consent from a parent/guardian; archive it
• For secondary sources (social media photos, archives): Obtain fresh consent from the original photographer or the person pictured; if impossible, note the consent status and document any limitations

Step 3: Post-Collection Compliance & Archiving

• Store consent memos, forms, or timestamped assignment notes for at least 3 years (aligned with Section 8 erasure compliance)
• Document your data retention policy for photo files, metadata, and interview notes
• Maintain an access log showing who in the newsroom accesses archived photos and subject data

Step 4: Subject Rights Notification

• Publish a Privacy Notice alongside news content: “We collected your personal data for news reporting. You have the right to access, correct, or request deletion under DPDPA Sections 8 & 17. Contact [email].”
• Provide a working email or contact form so subjects can exercise their rights

Step 5: Deletion & Erasure Workflow

• Establish a process to honor Section 8 erasure requests within 30 days
• Document the deletion action in your records (for regulatory proof)
• Note: You must delete from your archives; search engine caches and third-party repositories are not your responsibility, but inform the subject of this limitation

Consent Form Template for Photojournalism Assignments

---

CONSENT FORM FOR PHOTOJOURNALISM & DATA COLLECTION

News Outlet: [Organization Name]
Assignment: [Topic/Event]
Date: [Date]
Photographer Name: [Name]

Purpose: We are collecting your photograph and personal data for news reporting and publication on our platform(s): [list—print, website, social media, etc.].

Personal Data Categories:

• Photograph (face, identifying features)
• Name
• Contact details (phone, email)
• Interview transcript or quotes
• Other: [specify]

Data Retention Period: [3 months / 1 year / 3 years]. After this period, we will delete your personal data unless you extend consent.

Your Rights Under DPDPA:

• You may withdraw consent at any time by emailing [contact]
• You can request access to or correction of your personal data
• You can request deletion (erasure) under Section 8 of the DPDPA within 30 days
• You can lodge a complaint with the Data Protection Board if you believe your rights have been violated

Consent: I have read and understood the above. I freely consent to the collection and processing of my personal data as described.

Subject Signature: _________________________ Date: _________

Consent Obtained By (Photographer): _________________________ Signature: _________

---

Section 4 Violations in Practice: Real Newsroom Scenarios

Scenario 1: Archive Reuse Without Fresh Consent A news outlet republishes a 2-year-old photograph of a minor at a school event without re-contacting the subject or guardian. The original consent was for the 2021 school story only. Republishing in a 2026 feature without renewed consent is a breach of Section 4. Liability: Up to ₹150 crore if the regulator determines the breach was intentional or due to gross negligence.

Scenario 2: Incomplete Notice During Collection A photographer tells a subject, “We’re taking photos for news,” but doesn’t specify the outlet, platforms, retention duration, or subject rights. When the subject later requests deletion, the outlet argues they had oral consent. DPDPA Violation: Section 4—notice was incomplete; consent was not informed. Regulatory Action: Notice-and-cure order, potential financial penalty, and mandatory policy overhaul.

Scenario 3: Bundled Consent Without Specificity A news outlet’s website shows a pre-checked consent checkbox that reads: “I agree to be interviewed AND to allow publication AND to allow use in advertising AND receive promotional emails.” The subject unchecks advertising but the outlet continues sending marketing emails. Violation: Section 4—consent was bundled and not specific; withdrawal was ignored. Penalty: ₹150 crore liability plus a directed order to cease.

Public Figures, Public Interest, and Section 4

The DPDPA’s Schedule 1 includes a narrow exemption for journalistic processing in the public interest. However, this exemption is poorly defined as of July 2026 and regulators are divided on its scope. Best practice: Do not rely on this exemption for high-risk content. Obtain consent and notice even for public-figure coverage. It provides stronger legal footing and reduces regulatory friction. Public figures (politicians, celebrities) still have consent rights under Section 4; their public status merely lowers (but does not eliminate) their privacy expectations.

Compliance Checklist for News Media Under Section 4

• Subject identification complete: Confirm whether each data subject is a public figure (reduced notice risk) or a private individual (full notice required)
• Consent documented: Written forms, signed memos, or timestamped assignment notes for every shoot involving named or identifiable subjects
• Notice contains all required elements: Purpose, data categories, retention period, subject rights, and escalation contact
• Consent is specific: Not bundled with advertising, promotion, or other unrelated uses; separate checkboxes for different data processing purposes
• Photographer training: Staff can explain Section 4 requirements verbally and document consent in real-time
• Archive labeling: Older consent forms and assignment records are tagged with consent dates and subject status
• Erasure process documented: You have a workflow to honor Section 8 deletion requests within 30 days
• Legal review scheduled: Sensitive stories (minors, defamation risk, vulnerable groups) receive legal sign-off before publication
• Privacy notice linked: Your published stories or website include a link to your privacy policy and erasure contact

Frequently Asked Questions

Q: Do I need consent to photograph someone in a public place or public event? A: Yes. Section 4 applies regardless of the location (public or private). The processing of personal data triggers consent requirements, not the location of the photo. If you capture an identifiable face and then collect or publish a name, address, or other personal data, Section 4 applies. Candid photos without identifiers or names have lower regulatory risk, but once you tag or name the subject, you’ve processed personal data and should have consent.

Q: Can verbal consent satisfy Section 4, or do I need a signed form? A: Verbal consent is valid under Section 4, provided you document it in writing immediately—timestamp, subject name, consent terms, and photographer name in your assignment notes or memo. Written forms are stronger evidence if the subject later disputes consent or files an erasure request. For breaking news or crowd scenes, a documented memo is acceptable; for named sources or minors, aim for written consent whenever feasible.

Q: What happens if a subject withdraws consent after I publish a story with their photo? A: You must delete their published photo from your website, social media, and archives within 30 days under Section 8. However, the story may already be indexed in search engine caches or third-party archives—DPDPA does not require you to delete from those sources. Document your deletion action in your records. Inform the subject that you cannot control third-party indexing but have deleted from your own systems.

Q: Do public figures like politicians, celebrities, and activists need to consent under Section 4? A: Yes, Section 4 applies to all data subjects, including public figures. Public figures have lower privacy expectations, and some regulators may eventually carve out a narrower exemption for journalistic coverage, but as of July 2026, consent is still the safest legal ground. Obtain verbal or written consent and document it. Relying on a “public figure exception” is risky unless your legal team has reviewed the specific regulation.

Q: Is publishing a privacy policy on our website enough to comply with Section 4? A: No. A privacy policy informs the public of your data practices but is not the same as obtaining consent from a specific data subject at the time of collection. Section 4 requires notice and consent before or during the photo shoot or interview, not buried in a website footer. Your privacy policy supports compliance by documenting your practices, but must be paired with on-assignment consent collection and documentation.