Section 5 DPDPA: 6 Mandatory Disclosures for News Photographers

Applies to	News Media & Photojournalism Businesses operating in India
Primary law	DPDPA 2023 · Section 5
Penalty ceiling	up to ₹150 crore
Enforcement status	Data Protection Board accepting complaints — 2026-08
Source	DPDPAReady Compliance Team

Understanding Section 5: The Notice Requirement

Section 5 of the DPDPA requires every Data Fiduciary—including news organizations, photo studios, and freelance photographers—to provide an itemised notice before or at the time of seeking consent. This notice must disclose the purpose, data categories, rights, grievance officer contact, and language options. For photojournalism businesses, this is non-negotiable: you collect identifying information about subjects, process biometric data (photographs), and operate across multiple Indian states. Non-compliance attracts penalties up to ₹150 crore and renders all consent invalid.

How to Create a Compliant Section 5 Notice: 10 Steps

Step 1: Confirm Your Data Fiduciary Status

Before drafting a notice, verify you are a Data Fiduciary under Section 5. You fall into this category if you:

• Collect personal data directly from photoshoot subjects (names, contact details, location)
• Collect reader or subscriber data via website, app, or email signup
• Collect journalist, contributor, or photographer biographical information for publication or payroll
• License or syndicate photographs to third parties
• Maintain archives of personal images with identifiable subjects

If any of these apply, Section 5 applies to you immediately. Independent freelancers have the same obligations as large media houses.

Step 2: Document the Specific Purpose of Collection

Section 5 mandates disclosure of the purpose for which personal data is collected. This must be specific, not generic. For news photographers, purposes differ by context:

• Portrait photography for a news feature or editorial article
• Headshot photography for author/contributor bylines
• Subject name and biographical data for story attribution
• Reader email address for newsletter or subscription
• Location data (GPS, landmarks) for geotagged content
• Photographer contact details for byline or reprint licensing

Write each purpose clearly and narrowly. Avoid vague language such as “general editorial purposes” or “business operations.” Section 5 requires precision. If you collect data for multiple distinct purposes, disclose each one separately in the notice.

Example of compliant disclosure: “We collect your photograph and name to publish your profile in our investigative news feature titled ‘Water Crisis in Rural Maharashtra.’ This photograph and accompanying text will appear in our print edition (March 2026) and on our website for one year.”

Step 3: List All Data Categories Being Collected

Section 5 requires itemised disclosure of data categories—you cannot lump everything under “personal data.” For photojournalism, explicitly name each category:

• Biometric data (photograph, video recording, facial features)
• Identity data (name, age, date of birth)
• Location data (residential address, workplace, GPS coordinates if photo is geotagged)
• Contact data (mobile number, email address)
• Professional or employment data (job title, organization, byline if photographer)
• Sensitive data (if applicable—political affiliation, health status if newsworthy)

Each category must be listed separately in your Section 5 notice. Under DPDPA Section 5(1)(a), the notice must detail the categories of personal data being collected.

Step 4: Explicitly Disclose Rights of Data Principals

Section 5(1)(d) requires you to disclose the rights available to data principals. At minimum, your notice must state:

• Right to access: Data principals can request and receive a copy of their personal data within 30 days.
• Right to correction: Inaccurate, incomplete, or out-of-date data can be corrected upon request.
• Right to erasure: Under Section 8 exceptions (e.g., data no longer needed, withdrawal of consent), data can be deleted.
• Right to withdraw consent: At any time, without penalty.
• Right to grievance redressal: File complaints with your Data Grievance Officer and appeal to the Data Protection Authority.

Your notice must be written in plain language, avoiding legal jargon. Data principals should understand their rights clearly.

Example of compliant rights disclosure: “You have the right to:

• Access your photograph and personal data within 30 days of request.
• Correct or update your information if it is inaccurate.
• Request deletion of your data if it is no longer needed for publication.
• Withdraw your consent for future use of your photograph.
• File a complaint with our Data Grievance Officer if your rights are violated.”

Step 5: Provide Mandatory Grievance Officer Details

Section 5(1)(c) mandates disclosure of the name, designation, and contact information of your Data Grievance Officer. This is not optional. Your notice must include:

• Full name and job title of the designated grievance officer
• Email address (monitored daily)
• Phone number with office hours
• Mailing address
• Escalation procedure if the grievance officer does not respond within 30 days

Your Data Grievance Officer must be a real person with defined responsibilities, not a generic inbox. Under Section 12, failure to respond to grievances within 30 days is itself a violation.

Example of compliant disclosure: “Data Grievance Officer: Name: Ms. Priya Sharma Designation: Compliance and Privacy Manager Email: privacy@newshub.in Phone: 011-4567-8900 (9 AM–6 PM IST, Monday–Friday) Address: NewsHub Media Private Ltd, Plot 45, Nehru Place, New Delhi 110019 If you do not receive a response within 30 days, escalate to our Chief Compliance Officer at compliance@newshub.in.”

Step 6: Provide Notice in Eighth Schedule Languages

Section 5 explicitly requires notices to be provided in languages listed in the Eighth Schedule of the Indian Constitution. The Act does not mandate all 22 languages—you must provide notice in:

1. The language of the data principal (if they request)
2. The primary language of your news publication
3. Regional languages of the states where you operate

For a national English-language news organization, provide notice at minimum in:

• English (primary language)
• Hindi (national language)
• Regional languages where you have significant circulation (Tamil, Kannada, Telugu, Marathi, Gujarati, etc.)

For a regional media house (e.g., a Marathi-language newspaper), provide notice in:

• Marathi (primary language)
• English (for accessibility)

This is a legal requirement under Section 5, not a best practice. Many news organizations overlook this and face penalties.

Example of compliant disclosure: “This notice is available in English, Hindi, Tamil, Kannada, Telugu, and Marathi. If you require this notice in another Eighth Schedule language, contact our Data Grievance Officer at privacy@newshub.in. You will receive a translated copy within 7 business days.”

Step 7: Time the Notice Correctly: Before or At Collection

Section 5 states the notice must be provided “before or at the time of seeking consent.” Timing is not flexible. For photojournalism, correct timing by scenario:

Scenario	Correct Timing
Portrait/interview photoshoot	Provide notice before or at the start of the shoot. Do not photograph first, provide notice later.
Website signup or newsletter	Provide notice before the data entry form, not after submission.
Licensing archived photographs to third party	Provide notice to the original subject before relicensing; obtain fresh consent.
Employee/contributor headshot	Provide notice before the photo session or during onboarding.
Social media republication of archive photo	If the subject did not consent for social media use, provide new notice before posting.

Collecting data and sending notice retrospectively violates Section 5 and invalidates any subsequent consent.

Step 8: Document and Obtain Explicit Consent

After providing the Section 5 notice, obtain explicit, informed consent from the data principal. Consent and the notice are distinct:

• Section 5 = providing the notice (disclosure)
• Section 4 = seeking and obtaining consent (agreement to be processed under the terms in the notice)

Keep records of:

• Date and time the notice was provided
• Language in which it was provided
• Which data categories were disclosed
• How consent was obtained (signed form, digital checkbox, recorded verbal consent with witness)
• Name and signature (or digital ID) of the data principal
• Name and signature of any authorized representative (if applicable)

These records are your evidence of Section 5 compliance. Maintain them for the duration you hold the personal data plus one year.

Step 9: Update Notices When Purposes or Uses Change

Section 5 ties the notice to the specific purpose disclosed. If your use of data changes—especially if data is repurposed for a different use—you must provide a new notice and obtain fresh consent. Common scenarios in photojournalism:

• Archival repurposing: A photograph taken for a 2024 news story is licensed to an advertising agency in 2026. This is a new purpose (advertising vs. journalism). Provide new notice to the original subject; obtain fresh consent.
• Syndication or republication: Your news organization syndicates a story with photographs to partner outlets or republishes it in a different medium (print to digital, English edition to regional edition). If the original subject did not consent for syndication, provide notice and seek fresh consent.
• Staff or freelancer transition: When a photographer leaves your organization, you cannot transfer their contact details or work samples to a new hire without providing notice and seeking explicit consent.

Failure to obtain fresh consent for a new purpose is a Section 5 violation and may also violate Section 7 (misapplied legitimate-use grounds).

Step 10: Integrate Section 5 Compliance into Operational Workflows

Make Section 5 compliance routine, not ad-hoc:

For photography teams:

• Carry printed notices in your publication’s primary languages to every photoshoot.
• Ensure the photographer presents the notice, explains rights, and obtains signed consent before the shoot.
• Photograph consent forms with timestamps for audit trails.

For digital/web teams:

• Add the Section 5 notice above every data entry field (signup forms, subscription, comment sections).
• Use plain-language, readable fonts; do not hide the notice in “Terms & Conditions” or collapsed sections.
• Require explicit checkbox consent: “I have read and understood the Section 5 notice and consent to the collection and use of my data as described.”

For content and editorial teams:

• When republishing or licensing archived material, flag the content in your management system and trigger a notice-and-consent workflow.
• Document new purposes in metadata; do not assume old consent covers new uses.

For legal and compliance teams:

• Conduct quarterly audits of notices for accuracy, language quality, and Eighth Schedule compliance.
• Update notices when grievance officer contact details change, data retention policies change, or new data categories are collected.
• Maintain a master template and version-controlled copies for all notices used across your organization.

---

Section 5 Notice Template for News Organizations

NOTICE UNDER SECTION 5 OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

---

Date of Notice: [Insert date]
Notice Language: [English / Hindi / [Regional Language]]
Data Fiduciary: [Your Organization Name]
Contact: [Organization address and phone]

---

1. Purpose of Collection and Processing

We, [Your News Organization Name], are collecting your personal data for the following specific purpose(s):

• [Example: “Publication of your photograph and biographical information in the news feature ‘Local Heroes of Civic Action,’ scheduled for [date] in print and online editions.”]
• [Example: “Attribution of your photograph to your byline in our news publication and related syndication to partner news outlets.”]
• [Example: “Collection of your email address to send you our weekly news newsletter and editorial alerts.”]

Scope of use: Your data will be used solely for the purpose stated above. It will not be used for marketing, advertising, or any other purpose without separate notice and consent.

---

2. Categories of Personal Data

We will collect and process the following categories of your personal data:

• Biometric data: Photograph, video recording, facial image, voice recording (if applicable)
• Identity data: Full name, age, date of birth, gender
• Location data: Residential address, workplace address, GPS coordinates (if photo is geotagged)
• Contact data: Mobile telephone number, email address
• Professional data: Job title, organization, professional qualifications, byline
• Other data: [List any other categories relevant to your collection, e.g., political affiliation if newsworthy]

---

3. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: You can request a copy of your personal data held by us within 30 days of your written request.
• Right to correction: You can request correction, update, or completion of inaccurate or incomplete data.
• Right to erasure: You can request deletion of your data under conditions specified in Section 8 of the Act (e.g., data no longer needed, withdrawal of consent).
• Right to withdraw consent: You can withdraw your consent for future processing of your data at any time without penalty. However, erasure of already-published content is subject to journalistic and editorial judgment.
• Right to grievance redressal: You can file a complaint with our Data Grievance Officer if your rights are violated.
• Right to escalation: If your complaint is not resolved within 30 days, you can escalate to the Data Protection Authority of India.

---

4. Duration of Data Storage

Your personal data will be retained for:

• Published content: For the duration of publication plus 1 year (for archive and editorial reference).
• Archival data: Up to [X years] as per our editorial retention policy.
• After deletion: Backup copies may be retained for [Y days/months] for technical and legal compliance purposes.

Upon expiration of this period, your data will be securely deleted unless we have a legal obligation to retain it.

---

5. Data Grievance Officer

If you have any questions about this notice or wish to exercise your rights, contact:

Name: [Officer name]
Designation: [Data Grievance Officer / Compliance Officer]
Email: [Email address]
Phone: [Phone number with office hours]
Mailing Address: [Full office address, city, pin code]
Response time: We will acknowledge your request within 5 business days and provide a substantive response within 30 days.

Escalation: If you are unsatisfied with the response, you can escalate to our Chief Compliance Officer at [escalation email] or lodge a complaint with the Data Protection Authority.

---

6. Language Options

This notice is available in the following languages:

• English
• Hindi
• [Regional language(s)]

If you require this notice in another language listed in the Eighth Schedule of the Indian Constitution, please contact our Data Grievance Officer. We will provide a translated copy within 7 business days at no cost.

---

7. Consent

By signing below, you acknowledge that:

• You have read and understood this notice in full.
• You understand the purpose for which your data is being collected.
• You understand your rights as a data principal.
• You have been provided with the contact details of our Data Grievance Officer.
• You consent to the collection and processing of your personal data as described in this notice.

---

Data Principal’s Consent:

Signature: _________________________ Date: _________________

Printed Name: _________________________ Contact: _________________

OR

Digital Consent: ☐ I have read this notice and consent to the collection and processing of my data as described.

Data Principal Email: _________________________ Date/Time: _________________

---

For Organization Use Only:

Notice provided by (Name): _________________ Date/Time: _________________

Witness/Authorized Representative (if applicable): _________________

Evidence of consent (form, checkbox, timestamp): _________________

---

Frequently Asked Questions

Q1: Does Section 5 apply to freelance photojournalists or only to media houses?

A: Section 5 applies to any entity that acts as a Data Fiduciary—anyone who collects, stores, or processes personal data for a defined purpose. A freelance photographer who collects subject names, contact details, location information, or biometric data (photographs) is a Data Fiduciary under Section 5 and must provide an itemised notice. Both independent photographers and large news organizations have identical obligations and face identical penalties (up to ₹150 crore) for non-compliance. Section 5 does not exempt small or solo practitioners.

Q2: Can we provide a single generic notice to all photoshoot subjects, or must we customize it per purpose?

A: Section 5 requires disclosure of the specific purpose for each collection activity. A single generic notice is not compliant. If you’re shooting a portrait for a news feature, that purpose differs from licensing archive photos to an advertising agency or archiving images for internal reference. Each distinct purpose requires a separate notice or explicit itemisation in a master notice. Vague language like “editorial purposes” or “news media use” does not satisfy Section 5. Courts and the Data Protection Authority expect specificity: the publication title, date, medium (print/digital/both), and any syndication rights must be disclosed upfront.

Q3: What happens if we collect a photograph without providing a Section 5 notice?

A: This is a direct violation of Section 5(1) with serious consequences:

• Administrative penalty: Up to ₹150 crore under Section 36.
• Consent rendered invalid: Any consent obtained without prior notice is deemed invalid under Section 4, meaning your legal basis for processing evaporates.
• Grievance complaints: The subject can lodge a complaint with the Data Grievance Officer and escalate to the Data Protection Authority.
• Prohibition on publication: The Authority may order you to stop processing or publishing the photograph.
• Criminal prosecution: Intentional violations (photographing with intent to cause harm or breach of consent) may attract criminal penalties under Section 20.
• Civil liability: Subjects may seek damages for unauthorized use of their image.

Best practice: Always provide the Section 5 notice before the photoshoot—even if verbal, documented with a witness and timestamp.

Q4: We shoot for national news across India in multiple languages. Must we provide Section 5 notices in all 22 Eighth Schedule languages?

A: No. Section 5 requires notice in the language of the data principal, but you need not pre-translate into all 22 languages. Instead:

• Provide notice in the primary language of your publication (e.g., English for national English-language media).
• Provide notice in Hindi (national official language).
• Provide notice in regional languages where you have significant readership (Tamil, Kannada, Telugu, Marathi, Gujarati, Punjabi, etc., depending on your circulation).
• Commit in writing to translate and provide notice in any other Eighth Schedule language upon request within 7 business days.

A national English-language news organization should, at minimum, offer notice in English, Hindi, and the top 4–5 regional languages of its readership. A regional Marathi newspaper should provide notice in Marathi and English. The Act does not impose the burden of translating into all 22 languages upfront, but you must not refuse translation on demand.

Q5: How long must we retain Section 5 compliance records (notices, consent forms, grievance logs)?

A: The DPDPA does not specify a fixed retention period for Section 5 records. However, best practice is:

• Retain consent records for the entire period you hold the subject’s personal data, plus one additional year after deletion (for audit trails and complaint investigation).
• For published news: Retain Section 5 notices and signed consent forms for at least 3–5 years (aligned with your editorial archive retention policy).
• For licensed or syndicated photographs: Retain consent records for the duration of the license agreement plus 1 year.
• For legal disputes: If a subject files a complaint or lawsuit, retain all records indefinitely until the matter is resolved.

Store records digitally with timestamps, version numbers, and audit trails. Do not rely on paper records alone; digital storage demonstrates compliance during Authority audits and court proceedings. If your organization is audited or faces a grievance complaint, the inability to produce the original Section 5 notice and signed consent will be viewed as non-compliance.