This law will shut down newsrooms. It is then a complete regime of pre-censorship. We have to ask your permission if we report on you. How can that ever be?
Madhavi Divan, Senior advocate representing media groups
New Delhi: A group of news publishers has moved the Supreme Court of India, challenging the Union government’s Digital Personal Data Protection (DPDP) Act, 2023, arguing that it could restrict press freedom and hinder investigative journalism.
The Digital News Publishers Association (DNPA), representing 21 digital publishers, has challenged the Act and its 2025 Rules, seeking safeguards for journalistic activities.
On October 27, the Supreme Court issued notice to the Union government of the plea and an interim stay application. The next hearing is scheduled for November 17.
The challenge raises concerns over consent requirements, access to information and source confidentiality. But first, what is the DPDP Act, what does it change, and how will it affect individuals and companies?
What is the DPDP Act?
The Digital Personal Data Protection (DPDP) Act, 2023, establishes a legal framework governing how organisations collect, store, use, share and delete individuals’ digital personal data.
Under this act, a person's name and digital username fall under protected personal data. This covers direct identifiers like names, emails, and phone numbers, as well as online profiles, handles, and user accounts.
The government notified the DPDP Rules in November 2025 to operationalise the law. Its implementation is being carried out in phases, with most substantive provisions scheduled to come into force from May 13, 2027.
The law seeks to make organisations more accountable for handling personal information. It sets out requirements for consent, transparency, data security and the handling of personal data breaches.
What changes for individuals?
The law gives individuals, referred to as ‘Data Principals’, greater control over how organisations use their digital personal information.
- Consent: Organisations must provide clear information about why personal data is being collected and obtain consent where required. Individuals can withdraw consent.
- Access and correction: Individuals can request access to, correction of or updates to their personal data in applicable circumstances.
- Erasure: They can request the deletion of personal data, subject to the law’s conditions and exceptions.
- Grievances: Individuals can raise complaints about how their data is handled and exercise their rights under the law.
- Children’s data: Verifiable parental or guardian consent is generally required to process children’s personal data, subject to specified exemptions.
- Data security: Organisations must implement reasonable security safeguards and notify relevant parties of personal data breaches as required.
What changes for companies?
The Act places new responsibilities on organisations that determine the purpose and means of processing personal data, known as ‘Data Fiduciaries’.
Companies must provide clear, standalone privacy notices, obtain consent where required, protect personal information and establish processes for handling requests from individuals. They must also notify affected individuals and the Data Protection Board of India about personal data breaches as required by the rules.
Organisations designated as Significant Data Fiduciaries face additional obligations, which may include independent audits and data-protection impact assessments.
The DPDP law also introduces substantial financial penalties. Failure to maintain reasonable security safeguards can attract a penalty of up to Rs 250 crore, while failure to notify a personal data breach can attract a penalty of up to Rs 200 crore. Violations involving children’s data can also attract penalties of up to Rs 200 crore.
For businesses, particularly startups and smaller companies, compliance could mean additional spending on cybersecurity, consent-management systems, privacy policies and staff.
Why are journalists concerned about the law?
Journalists and news publishers argue that the DPDP Act does not provide a clear exemption for journalistic activities. They fear that certain provisions could affect investigations involving public officials, government records, alleged corruption and the use of public funds.
Their concerns centre on the following provisions:
Could the DPDP Act weaken the RTI Act?
One of the biggest concerns relates to Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information (RTI) Act.
Earlier, authorities could withhold personal information if it had no connection to public activity or interest, or if its disclosure would cause an unwarranted invasion of privacy. However, the information could still be disclosed if a larger public interest justified it.
The DPDP amendment replaces this provision with a broader exemption covering 'information which relates to personal information'. Journalists and transparency advocates argue that this removes the explicit public-interest safeguard from Section 8(1)(j), giving public information officers greater discretion to deny requests by classifying records as personal information.
Although Section 8(2) of the RTI Act continues to allow disclosure when larger public interest outweighs the harm to a protected interest, journalists fear that accessing records on public spending, government appointments, welfare beneficiaries and official conduct could become more difficult.
Why does this matter for reporting?
This is not just about protecting the privacy of individuals. Journalists fear that the amendment could restrict access to information needed for accountability reporting.
For example, reporters investigating who received government pensions or ration benefits, how public money was spent, or whether an official misused their position may find it harder to obtain relevant records.
They argue that the earlier public-interest safeguard was important for exposing corruption, misuse of funds and official misconduct.
Could consent requirements affect investigative journalism?
Sections 4(1) and 7 of the DPDP Act set out the conditions under which personal data can be processed, including consent and specified legitimate uses.
Journalists argue that journalism has not been expressly recognised as a legitimate use under these provisions.
This could create difficulties when reporters investigate individuals or organisations. For instance, seeking consent from a person suspected of wrongdoing could alert them to an investigation before publication.
Publishers fear this could compromise investigations, expose sources or allow subjects to obstruct reporting.
Why are journalists concerned about the exemption provisions?
Section 17(2) provides exemptions from certain requirements of the Act for specified purposes, including research, archiving and statistical processing, subject to conditions.
However, journalists argue that news reporting and investigative journalism have not been expressly included.
They fear that this could leave news organisations exposed to data-protection obligations even when processing personal information for stories involving public interest.
Could individuals seek changes to or deletion of published reports?
Sections 18 and 19 deal with individuals’ rights concerning their personal data, including correction, completion, updating and erasure, subject to the applicable provisions.
The Act does not automatically give individuals the power to remove published news reports. However, publishers argue that the absence of a clear journalistic exemption could create legal uncertainty and put pressure on news organisations to alter or remove public-interest reporting.
For instance, a person named in an investigative report could seek correction or erasure of personal data held by a news organisation, raising concerns that such requests could be used to pressure publishers even where the report is accurate and in the public interest.
Could government powers affect confidential sources?
Another concern relates to Section 36 of the Act and Rule 23 of the DPDP Rules.
These provisions allow the government to require information from data fiduciaries and intermediaries in specified circumstances. The rules also provide for restrictions on disclosing such requests.
Journalists fear that these powers could expose confidential sources and whistleblowers, particularly when information is sought without adequate independent judicial oversight.
They argue that protecting source confidentiality is essential to investigative reporting, as people may otherwise hesitate to share information about wrongdoing.
The exact legal effect of these powers on journalists and sources remains contested, but the absence of an explicit source-protection safeguard is a central part of the publishers’ challenge.
Could government restrictions affect digital news platforms?
Section 37 empowers the Central government to direct the blocking of access to a data fiduciary’s computer resources in specified circumstances.
This is not a general power to block news platforms. It can be triggered when the Data Protection Board refers a data fiduciary that has been penalised in two or more instances and advises that blocking access is necessary in the public interest. The government must also give the data fiduciary an opportunity to be heard before issuing a written order.
News publishers still fear that the provision could have implications for digital news platforms if they fall within its scope. They have sought safeguards to ensure that enforcement powers under the Act do not interfere with independent journalism or restrict access to public-interest reporting.
What safeguards are journalists seeking?
The central demand from news publishers is a clear journalistic and public-interest exemption under the DPDP Act. They argue that reporting on matters of public accountability should not be treated like commercial data processing.
Publishers say they are not seeking unrestricted permission to publish private information. Instead, they want safeguards that allow news organisations to investigate wrongdoing and report verified information in the public interest while respecting legitimate privacy rights.
The government, however, has maintained that the law does not infringe on press freedom. Union IT Minister Ashwini Vaishnaw rejected claims that the Act curbs journalistic freedom, saying the Constitution already guarantees it and that the government has no intention of affecting it.
The Supreme Court has not yet ruled on the merits of the challenge. It has asked the publishers to suggest safeguards that could balance citizens’ privacy rights with press freedom. The next hearing is scheduled for November 17.
