Your central concern is important: a doctor or hospital should not use photographs or videos of newborns and children for publicity without properly addressing parental consent, patient confidentiality, and the child’s privacy. However, if you intend to publish this as a legal warning, article, or book chapter in India, some of the penalties and professional consequences in your draft need to be stated more precisely.

In particular, the DPDP Act’s maximum penalty is not automatically ₹200 crore for every photograph posted without consent, and permanent cancellation of a medical licence is not an automatic consequence of a social-media privacy violation.

Legally corrected version for publication

When a Child Becomes a Marketing Tool: The Legal and Ethical Risks of Posting Patients’ Photographs

A newborn enters the world with no ability to understand privacy, give consent, or object to being photographed. Yet, in the age of digital marketing, a baby’s photograph or video may appear on a doctor’s social-media account, a hospital’s promotional page, or a clinic’s advertisement.

The purpose may be to celebrate a successful delivery, promote medical services, attract patients, or enhance a doctor’s public image. But the ethical question is unavoidable: Does a doctor’s professional position give them the right to turn a patient’s image into a publicity tool?

In India, doctors and hospitals must take patient confidentiality, consent, and the privacy of children seriously.

1. The Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023 establishes a framework governing the processing of digital personal data. A doctor, clinic, or hospital may qualify as a Data Fiduciary when determining the purpose and means of processing such information.

A recognisable photograph or video of a child may constitute personal data when it identifies, or can be linked to, that child.

Section 9 provides additional protections for children’s personal data, including a requirement for verifiable parental consent, subject to applicable statutory exceptions.

The Act’s Schedule provides for a penalty of up to ₹200 crore for a breach of the additional obligations relating to children under Section 9. A breach of other provisions may attract a penalty of up to ₹50 crore, while certain security-safeguard failures can attract penalties of up to ₹250 crore.

These are statutory maximums, not automatic fines for every photograph published without consent. The applicable provision, circumstances, and statutory penalty-determination process matter.

2. Medical ethics: A patient’s image is not an advertisement

The professional obligations of doctors go beyond data-protection legislation.

The National Medical Commission’s 2023 Registered Medical Practitioner (Professional Conduct) Regulations included a specific social-media guideline stating that registered medical practitioners should not post patients’ photographs or scan images on social media. The NMC subsequently issued an amendment notification placing those regulations in abeyance.

The broader principles of medical confidentiality and professional ethics remain important. The earlier Code of Medical Ethics Regulations, 2002, also addressed the publication of identifiable patient photographs and case reports without permission.

Consequently, doctors should not assume that a parent’s willingness to share a photograph automatically resolves every professional, privacy, or promotional concern.

3. Is parental consent enough?

Parental consent is important, but the circumstances must be examined carefully.

A hospital should distinguish between photographs taken for clinical documentation, images used for teaching, and photographs published publicly for marketing. These purposes are not interchangeable.

A parent who agrees to a newborn’s photograph being taken for hospital records has not necessarily agreed to the same image being posted on Instagram, Facebook, YouTube, or a clinic’s advertising page.

Hospitals should use clear, purpose-specific consent procedures, explain where images will appear, restrict unnecessary disclosure, and maintain appropriate safeguards. They should also consider whether the publication serves a legitimate professional purpose or merely exploits a family’s vulnerable circumstances.

4. What could happen to a doctor or hospital?

Depending on the facts and the laws in force, consequences may include:

• Complaints concerning privacy, confidentiality, or professional conduct.
• Regulatory proceedings and disciplinary measures where misconduct is established.
• Statutory data-protection penalties where the relevant provisions apply.
• Civil or other legal proceedings where an independent legal basis exists.
• Reputational damage, loss of patient trust, and financial consequences.

Suspension or cancellation of a medical registration is not an automatic consequence of every privacy complaint. Any professional sanction depends on the applicable rules, jurisdiction, evidence, and disciplinary process.

5. The ethical principle

A child is a patient, not a promotional asset. A newborn’s vulnerability makes responsible handling of the child’s image especially important.

Before publishing a child’s photograph or video, a healthcare professional should ask: Is this necessary? Is the purpose clearly explained? Has the appropriate consent been obtained? Could the child or family suffer harm or embarrassment? Is the publication consistent with professional confidentiality and the rules currently in force?

The ability to publish an image does not establish that publishing it is ethically justified.

The guiding principle should be simple: protect the child first, respect the family’s privacy, and place professional responsibility above publicity.

Important legal sources

• DPDP Act — Section 9 and children’s personal data
• DPDP Act — Schedule of financial penalties
• NMC Registered Medical Practitioner (Professional Conduct) Regulations, 2023
• Code of Medical Ethics Regulations, 2002

One final caution: The DPDP Act and the DPDP Rules, 2025, have phased commencement provisions. Before asserting that a particular penalty is currently enforceable against a specific doctor or hospital, check which substantive provisions were in force on the date of the alleged conduct.