India’s Entertainment Sector: The Blind Spot in India’s Privacy Law

Over the last few years, data protection has become boardroom vocabulary. Banks have rewritten consent architecture. Fintech platforms have restructured onboarding flows.

Every conversation on privacy in India, since the Digital Personal Data Protection Act, 2023 came into force alongside its 2025 Rules, has revolved around financial services, e-commerce, and health-tech.

This is understandable: these are the sectors where data breaches make headlines. But somewhere in this fixation on finance, an entire industry has been quietly collecting some of the most intimate data imaginable, with almost no bespoke legal framework governing it: the media and entertainment sector.

Body Scans: the data nobody is talking about

Consider what actually happens on a film or OTT production set, actors undergo full body scans for VFX and stunt double mapping. Voice Artists sit through hours of biometric voice sampling for dubbing, for AI-based voice synthesis.

Motion capture technology records the precise movement of a performer’s body. Facial geometry is mapped, down to micro- expressions, to build “digital twin” that can be reused indefinitely. This is not incidental data collection.

It is undertaken with consent forms often loosely drafted one- pager documents that arose from a different era, where the biggest risk was an unauthorized photograph, not a synthetic reproduction of a person’s voice or face that can perform in projects they never agreed to.

Under the DPDP Act, biometric data and voice data would ordinarily attract heightened obligations, but the Act’s general purpose consent and notice framework was not built with the specific realities of a film set in mind.

There is no specific guidance on retention periods for the body scan of an actor, no clarity on what happens to that scan once a production wraps, and no default rule preventing a studio from reusing a performer’s digitized likeness in a sequel, an advertisement, or a wholly unrelated project years later.

Whilst retaining the body scan data there is no guideline/ framework which protects the artists vis-à-vis the usage of such scans by the said production house/ an exploitation platform who engages with the production house on such project and further been used/ exploited by a foreign production house/ a company specializing in treatment of such data by application of AI.

The Silence Prevails

Production houses routinely outsource VFX, dubbing, and post-production work to third-party studios, some domestic, many overseas. The moment biometric data crosses from the production company to a VFX vendor, a dubbing studio, or a cloud-based rendering platform, questions of sub-processing, and cross-border data arises.

This questions the DPDP framework and addresses the principle for “data fiduciaries” and “data processors,” which are almost never operationalized in entertainment contracts with any precision.

The emergence of generative AI tools that can synthesize a performer’s voice or face from relatively small data samples, and the exposure multiplies. With usage and exploitation a voice artist’s few hours of dubbing samples or body scan of an artist of various emotions captured, if not contractually ring-fenced, could become training data for a model that then competes with the artist who provided it.

This is not a hypothetical risk. It precisely raises an anxiety over AI- generated performances and “digital twins,” and one that Indian entertainment law is yet to address with precision.

The uncomfortable truth is that entertainment has been treated as a “soft” sector by data protection discourse, but somehow assumed to be less data-intensive than banking or healthcare.

In reality, few sectors extract as much granular, identity-linked biological data from individuals, often under working conditions where the Artist has limited bargaining power to refuse.

The Contract is the only shield right now

Until regulation catches up (and sector-specific rules under the DPDP framework, or amendments addressing biometric and synthetic media specifically, are still awaited), the artist agreement is doing the work that legislation has not yet done.

This makes contract negotiation in entertainment far more critical than it has traditionally been treated. An Artist agreement needs to move beyond boilerplate confidentiality and IP assignment clauses.

It needs to specifically address: what biometric data is being collected and for what defined purpose; whether that purpose is limited to the specific production or extends to sequels, spin-offs, or unrelated future use; what retention period/duration applies once the production is complete, and whether the artist has a right to demand deletion; whether the data can be shared with third-party vendors (domestic or international), and if so, under what security and confidentiality obligations those vendors are bound; and critically, whether any of the collected data (body scans, voice samples, motion capture) can be used to train, fine-tune, or generate AI models, including models that could recreate the artist’s likeness or voice without further consent and compensation.

Digital twin and AI-clause drafting, which even a few years ago would have seemed like a futuristic add-on, is now a necessity in any artist services agreement.

Option clauses, once used primarily to govern an artist’s availability for sequels, demands to be renegotiated to also govern the lifespan and reuse rights of an artist’s biometric data.

These are no longer aggressive asks by artist’s legal counsel but still sparingly exercised. It acts as a risk mitigation in an industry that has, until recently, treated data governance as an afterthought to be handled by the production’s IT vendor rather than its legal team/artists themselves.

Steps Ahead

The gap is not just contractual. It is regulatory. Sector-specific guidance on biometric data collected in creative production, clearer rules on cross-border transfer of performance data to VFX and post-production vendors abroad, and a defined framework for consent around AI- based reuse of an artist’s likeness are all overdue.

Until that arrives, the burden falls entirely on negotiation, on artists, their managers, and their counsel to ensure that consent given for a single production does not silently become a perpetual license to a digital version of themselves and such biometric data loosely lying around with an entity without approved/ validated data storage systems in place.

Data protection law found its footing by looking at wallets and ledgers. It is time it looked at bodies, voices, and faces with the same seriousness, because in entertainment, the data being collected is not incidental to the business. It is the business.

The audience that binges, the regulator that watches, and the industry that profits all owe the same duty back: let us give it back to the “Creator” and the “Originator”.

The world copied Hollywood’s contracts for decades. On biometric consent, India’s entertainment sector has a rare shot to be followed instead, if it moves first.

India does not have to follow the world’s privacy playbook here, it has the chance to write it first.

The views expressed are personal