India's DPDP Act: What Photographers Should Know

This post is general information, not legal advice. India's Digital Personal Data Protection Act, usually called the DPDP Act, sets rules for how organisations handle personal data of individuals. For a photographer, that means thinking carefully about the names, phone numbers, event details and images you collect, why you collect them, who can see them and how long you keep them. Details and dates of effect can change, so confirm with a qualified adviser before you rely on anything here.

What the Act is

The DPDP Act is India's law on digital personal data. In plain terms it sets out:

• Who is a person whose data is handled (a "data principal") and who decides why and how it is used (a "data fiduciary").
• That data should be used for a stated purpose, with the person's consent in many cases.
• Rights people have over their data, such as asking for correction or erasure under conditions.
• Duties for organisations to keep data safe and to say what they do with it.
• Penalties where duties are not met.

Rules made under the Act, and the dates they apply, determine the practical detail. Treat this section as an outline and read current official text or ask an adviser for specifics.

You do not need to become a lawyer. You do need habits: collect less, say why, keep it safe and delete it when you no longer need it.

Personal data you collect

List what your studio holds. Most photographers hold more than they realise.

• Contact details: names, phone numbers, email addresses, home or venue addresses.
• Event details: dates, family relationships, schedules, guest lists.
• Payment records: invoices, receipts, amounts, bank or UPI references. Do not store card numbers yourself.
• Images and video: the work itself, including children and guests.
• Messages: inquiries, emails, notes from calls.
• Crew data: freelancer contact details and payment information.
• Marketing lists: emails for newsletters.

Where is each stored? Phones, laptops, memory cards, hard drives, email, gallery tools, a spreadsheet, a notebook. Writing it down is the first step. Example (illustrative): a one-page table with columns for the data, where it sits, who can see it and how long you keep it.

Collect only what you need. If you do not need a client's home address, do not ask.

Consent and notice

The Act puts weight on telling people what you do with their data and on consent where it is the basis for use. In practice:

1. Give a short privacy notice on your website and booking forms: what you collect, why, who sees it (for example your editor or gallery provider), how long you keep it and how to contact you.
2. Ask for agreement in the booking process rather than burying it. A clear line in the contract or form, with a record of when it was accepted, is easier to defend.
3. Be specific about uses beyond the job. If you want to post images or use them in marketing, ask for that separately and allow a no.
4. Handle children's data with extra care. The Act has special rules for children, so check what applies with an adviser.
5. Give people a way to ask questions or withdraw agreement for optional uses, and respond.

Example wording to adapt and have checked: "We use your details to deliver your booking, send contracts and invoices, and share files with you. We share images only with the team and tools needed to deliver your work. Tell us if you do not want your photos used for our portfolio."

This is sample wording only, not a template to rely on. Contract clauses are covered in photography contract clauses, and signing is covered in signing contracts online.

Retention

Keeping everything forever is a risk as well as a cost. Decide how long you keep each kind of data and why.

• Finance and tax records: keep for as long as tax and accounting rules require, which your accountant can tell you.
• Contracts: keep for the period in which a dispute might arise.
• Final images and galleries: you may keep archives for a set number of years and tell clients so.
• Raw files: many studios delete after a stated time.
• Inquiries that never booked: keep briefly, then delete.
• Marketing lists: keep while the person is subscribed.

Write the periods in your contract and notice, then do the deleting on a schedule, such as a yearly clean-up. Secure storage matters as much as deletion: lock devices, use strong passwords, restrict access to the people who need it, and remove access when freelancers leave. Reschedule requests also leave a trail of messages; see reschedule requests for keeping those records tidy.

Check with an adviser

Law, rules, timelines and enforcement can change, and your studio's situation is its own. Ask a lawyer or compliance adviser who knows Indian data law to:

• Confirm whether and how the Act applies to your studio.
• Review your privacy notice and consent wording.
• Advise on children's data and on images in marketing.
• Suggest a retention schedule and a plan for data requests or incidents.

Take your inventory of data with you; it makes the meeting short.

How ClickBook helps

Keeping client data in one place is easier to manage than keeping it in six. ClickBook holds leads, clients, contracts, invoices and project notes in one dashboard, with team roles that limit what freelancers see, so access can be narrow. It does not replace legal advice. See a demo for how records sit together.

Frequently asked questions

Does the DPDP Act apply to a small photography studio?

It may, since you collect and handle personal data such as names, phone numbers and images of people. Exactly which duties apply depends on the law and rules as they stand, so ask a qualified adviser.

Are photographs personal data?

Images that identify a person are generally treated as personal data. Treat client photos with the same care as contact details.

Do I need written consent from clients?

Be clear about what you collect and why, and keep a record of agreement, often through the contract or booking form. Ask an adviser about the form the law needs.

How long can I keep client data?

Keep it only as long as you need it for the job, your records and your legal duties. Decide a retention period and write it down.