This page is general information for photographers and studios, written in plain language. It is not legal advice. The Act and Rules are the authority, and a lawyer can tell you how they apply to your business.
The checklist
If you run face search at weddings, corporate events or school functions, these are the habits the DPDP Act points towards:
- Show a clear notice before the selfie. Say what you collect (the selfie and the face data made from it), why (to find this guest's photos in this event), and how to withdraw consent, ask for deletion or complain.
- Get consent by a deliberate action. A button or checkbox the guest taps themselves, never pre-ticked, never hidden in terms.
- Use face data only for that purpose. Finding the guest's photos in that event, nothing else.
- Ask separately for marketing. If a check-in form collects names and numbers that you will use to promote your studio, say so and ask for that consent on its own.
- Treat under-18s differently. The Act needs verifiable consent from a parent or guardian before a child's data is processed.
- Make withdrawal and deletion easy. Give guests an email or button and act on requests.
- Delete when the purpose is over. Do not keep face data from old events forever.
- Keep it secure. Private galleries, PINs, limited full-access sharing, and a platform with access controls and encrypted connections.
The rest of this guide explains where each point comes from.
What the DPDP Act covers
The Digital Personal Data Protection Act, 2023 governs digital personal data: any data about an individual who can be identified from it. A photo of a recognisable guest is personal data. So is a selfie, and so is the face vector a recognition system makes from that selfie to search the gallery.
The Act gives people (it calls them data principals) rights over their data, and places duties on the business that decides why and how the data is processed (the data fiduciary). A business that processes data on someone else's behalf is a data processor.
At a typical wedding with face search, the studio decides to offer face search to guests and for what purpose, so in most setups the studio acts as the data fiduciary for guests' data, and the platform that runs the search for the studio acts as a data processor. Contracts and facts can change this, which is one reason to take legal advice for your own setup.
The Act does not apply to data that an individual processes for a purely personal or domestic purpose, such as a family's own private album. A studio offering face search to hundreds of guests as part of a paid service is processing data as a business, so plan on the Act applying.
When the rules apply
| Date | What happens |
|---|---|
| August 2023 | The DPDP Act is passed by Parliament. |
| November 2025 | The DPDP Rules, 2025 are notified. Provisions setting up the Data Protection Board start immediately. |
| November 2026 | Rules for registered consent managers apply. |
| May 2027 | The main duties apply: notices, consent, security safeguards, breach reporting, children's data and data principals' rights. |
The phased timeline comes from the government's summary of the Rules published by the Press Information Bureau. Studios that build the habits now will not need to change how they work in 2027.
Consent: what counts
Under section 6 of the Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. For face search that means:
- The guest takes an action that clearly means yes, such as tapping "Scan my face" after reading the notice.
- The consent covers one purpose: finding their photos in this event. It is not a blanket permission for anything else.
- Saying no to face search should not stop a guest from seeing photos in other ways, for example through the family's full-access link.
Section 6 also says withdrawing consent must be as easy as giving it.
The notice before the selfie
Section 5 of the Act and Rule 3 of the Rules describe the notice. It should be understandable on its own, in clear and plain language, and should include:
- an itemised description of the personal data collected (for example: the selfie image and the face data generated from it);
- the specific purpose (finding the guest's photos in this event's gallery);
- how to withdraw consent and exercise their rights, such as deletion;
- how to complain to the Data Protection Board.
A short notice on the selfie screen with a link to a full policy is a practical way to do this. On VowPix, every guest agrees before their first selfie: by ticking the consent box in the check-in form or, when the form is off, by tapping "I agree" on a short privacy notice. Both link to the biometric consent policy, which is also linked from every gallery.
Children and school events
The Act defines a child as anyone under 18. Under section 9, a data fiduciary must get verifiable consent from a parent or lawful guardian before processing a child's personal data, must not process it in a way likely to harm the child's well-being, and must not track, behaviourally monitor or target advertising at children.
For school annual days, sports days and college events with students under 18, the practical approach is:
- let parents take the selfie to find their family's photos, rather than asking students to scan;
- or have the school share specific folders or full access with parents;
- switch off browsing so families see only photos that match, and switch on live-selfie-only so no one can search with another child's picture.
See photo sharing for school and college events for the settings.
Keep it to the purpose, then delete
Section 8 requires a data fiduciary to erase personal data once the purpose has been served or consent is withdrawn, unless the law requires keeping it. For events, decide in advance how long a gallery and its face data stay online, tell the couple or organiser, and delete or archive when that time ends. Act on individual deletion requests promptly.
Security and breaches
Section 8 also requires reasonable security safeguards to prevent personal data breaches, and requires that breaches be reported to the Data Protection Board and to each affected person. Rule 7 sets out how and when. The highest penalty in the Act, up to ₹250 crore, is for failing to take reasonable security safeguards; failures on breach reporting or on children's data can each attract up to ₹200 crore.
Day to day, security for a studio looks like:
- private galleries with PINs, not public links;
- sending full-access PINs only to the family, privately;
- regenerating a PIN if a link spreads too widely;
- using a platform with encrypted connections, access controls and logged access;
- limiting who in your studio can log in to the dashboard.
Guests' rights
Guests can ask what data you hold about them and how it is used, ask for corrections or erasure, and raise a grievance that you must respond to (sections 11 to 13). Publish a contact for these requests, such as a support email, and keep a simple record of what you did.
What to look for in a face recognition platform
| Question | Why it matters |
|---|---|
| Is there a notice and consent step before the selfie? | Section 5 and 6: notice and affirmative consent |
| Is face data scoped to one event? | Purpose limitation |
| Is the selfie image discarded after the search data is made? | Data minimisation |
| Is face data ever used to train AI models? | It should not be, without separate consent |
| Can guests and studios get data deleted on request? | Section 8 and 12: erasure |
| Can galleries stay private (PINs, blur until match, live selfie only)? | Security and children's safety |
| Does the platform act on the studio's instructions? | Clear fiduciary and processor roles |
How VowPix handles this today
- Every guest agrees before their first selfie: a consent box in the check-in form, or a one-tap privacy notice when the form is off. Both link to the biometric consent policy.
- The selfie image is discarded once the face vector is generated, and the vector stays scoped to that event.
- Face data is never used to train AI models.
- The face scan is for guests aged 18 or over; the privacy notice asks anyone younger to have a parent or guardian agree for them.
- In the check-in form, the box for studio offers starts unticked, so guests opt in to marketing themselves.
- Guests or studios can ask for deletion at support@vowpix.in.
- Every plan includes guest and full-access PINs, blur-until-match and live-selfie-only.
- VowPix processes guest data on behalf of the studio that invited them.
Frequently asked questions
Is face recognition at weddings legal in India?
No Indian law bans using face recognition to help guests find their photos. The DPDP Act sets the conditions: a clear notice, real consent, use only for the stated purpose, security, deletion, and parental consent for children.
Who is responsible under the DPDP Act, the photographer or the platform?
Usually the business that decides why and how the data is used is the data fiduciary, and in most event setups that is the studio. The platform that runs the search for the studio is usually a data processor. Your contracts and facts decide the final answer.
When do the DPDP Rules take effect?
They are phased. The Rules were notified in November 2025; consent manager rules apply from November 2026; the main duties on notices, consent, security and children's data apply from May 2027.
Do children need parental consent to use face search?
Yes. The Act defines a child as anyone under 18 and requires verifiable consent from a parent or lawful guardian before processing a child's data. At school events, let parents run the search.
Does this replace legal advice?
No. This guide summarises the Act and Rules for photographers in plain language as of 2 November 2026. For decisions about your own business, speak to a lawyer.