DPDPA-Ready Photo Sharing Checklist

Ten practical items every photographer, studio, and school needs to cover before sharing photos of identifiable people in India. Tick them off, print it, pin it above the desk.

1. 1 Capture explicit consent before you shoot Section 6 Written or digital consent record for every identifiable subject, timestamped, before the camera comes out.
2. 2 State the purpose — don't leave it open-ended Section 5 Notice names the exact use (wedding album, yearbook, marketing). No blanket "we may use your photos for any purpose."
3. 3 Set and honour a retention period Section 8(7) Define how long raw files, edited files, and backups are kept — then actually delete them on schedule.
4. 4 Publish a DPO / grievance officer contact Section 13 One named contact, one email, on your site and in every consent form, for rights requests and complaints.
5. 5 Have a breach-notification runbook ready Section 8(6) Written steps: detect, contain, notify the Data Protection Board and affected subjects within the prescribed window.
6. 6 Sign DPAs with every vendor who touches the photos Section 8(2) Editors, cloud storage, album printers, AI culling tools — each needs a data processing agreement, not a verbal understanding.
7. 7 Get verifiable parental consent for minors Section 9 School events, kids' parties, family shoots — guardian ID plus signature, not just a tick-box.
8. 8 Watermark previews, gate full-res behind access control Section 8(5) Password-protected galleries; public previews carry a watermark so raw files aren't freely downloadable.
9. 9 Have a working deletion-request process Section 12 A subject can ask you to erase their photos — know who processes that request and how fast.
10. 10 Keep an access / download audit log Section 8(5) Record who viewed or downloaded what, when — needed to prove compliance and investigate a breach.