India's DPDP Act and children's photos: what schools and play schools need to know

What the Act says about children

• Processing a child's personal data generally requires verifiable consent of the parent or lawful guardian.
• Tracking, behavioural monitoring and targeted advertising directed at children are restricted.
• Data fiduciaries owe security safeguards, breach notification and purpose limitation; processors act under contract.
• Rules and timelines are being phased in — track the current notified position.

What it means in practice

1. 1Get written, specific parental consent for photographing and sharing — tiered by family-only, group and public.
2. 2Stop sharing children's photos in WhatsApp groups: no consent enforcement, no approval, permanent copies on every phone. See WhatsApp vs a school app.
3. 3Use a system that records consent per child and enforces it automatically for group and public content.
4. 4Have a written agreement with the vendor covering security, retention and deletion.
5. 5Keep photos out of teachers' personal galleries.

Vendor questions for Indian schools