The Digital Personal Data Protection (DPDP) Act, 2023, which was introduced to protect people's personal data in the digital space, is back in the news, this time over concerns about its impact on press freedom.
Enacted by Parliament in August 2023, the law was seen as a major step towards protecting citizens' digital privacy. It established a legal framework for collecting, storing and processing personal data. However, the legislation is now facing criticism from the digital media industry, which says some of its provisions could make news gathering difficult and affect the ability of journalists to report on matters of public interest.
The Digital News Publishers Association (DNPA), which represents 21 prominent news organisations, including The New Indian Express, The Hindu, Dainik Bhaskar, Times Internet, India Today, NDTV, Network18, Zee Media, ABP and Bennett Coleman, has challenged the DPDP Act and the Digital Personal Data Protection Rules, 2025, in the Supreme Court.
In its petition, the association has argued that the law does not provide any specific exemption for the media and could restrict journalists' ability to collect and use personal information while reporting. It has also raised concerns that the law could weaken citizens' right to information.
The Supreme Court has sought the Centre's response to the petition. Union Electronics and Information Technology Minister Ashwini Vaishnaw, however, has said that press freedom is guaranteed by the Constitution and that the government has no intention of restricting it.
What is the DPDP Act and why was it introduced?
The DPDP Act was enacted in August 2023 to regulate the processing of digital personal data. The government notified the accompanying rules in November 2025.
The law lays down how organisations collecting or using personal information must handle that data. It also gives individuals certain rights over their personal information and requires organisations to take steps to protect it. Under the law, an organisation that decides why and how personal data is processed is called a Data Fiduciary. The individual whose data is being processed is called a Data Principal.
The law requires organisations to give individuals clear information about the data being collected and the purpose for which it will be used. In most cases, they must obtain consent before processing personal data. Individuals can also withdraw their consent and seek correction or erasure of their personal information, subject to the provisions of the law.
The rules provide for a phased implementation of the law. The main obligations relating to the processing of personal data are scheduled to come into effect after 18 months from the notification of the rules.
Why are news publishers opposing the law?
The central concern raised by the DNPA is that the law does not provide a separate exemption for journalism carried out in public interest. The petitioners argue that journalists often have to collect and use personal information without informing the person concerned in advance. This is particularly important in investigative reporting involving public officials, companies or individuals suspected of wrongdoing.
For example, a journalist investigating the financial dealings or assets of a public official may need to examine documents and information relating to that person. Seeking consent before collecting or using such information could alert the person to the investigation and allow evidence to be destroyed or witnesses to be influenced, the petition argues.
The petitioners say the notice and consent requirements could, therefore, affect the way journalists gather information and publish reports. They also argue that time-sensitive and live reporting could become difficult if prior consent is required.
The petition further raises concerns over the right of individuals to withdraw consent and seek deletion of their personal data. According to the petitioners, these provisions could be used to pressure news organisations into removing factual reports or information from their digital archives, even when it is relevant to the public interest. The petition argues that the law should distinguish between the commercial use of personal data and its use for journalism, particularly when reporting on matters of public importance.
What is the concern over the Right to Information Act?
The DNPA has also challenged an amendment to Section 8(1)(j) of the Right to Information (RTI) Act, 2005, introduced through Section 44(3) of the DPDP Act. The RTI Act allows citizens to seek information from public authorities. However, certain categories of information are exempt from disclosure, including personal information.
Before the amendment, the provision allowed disclosure of personal information in certain cases where the public interest in disclosure outweighed the harm to the individual’s privacy. The petitioners argue that the amended provision removes this balancing mechanism and makes it harder to obtain personal information through the RTI route.
They say this could affect journalists seeking information about public officials, government decisions and matters involving public accountability. The petition argues that information relating to an individual may also be relevant to understanding the functioning of public institutions.
Why are Sections 36 and 37 being challenged?
The petitioners have raised concerns over the powers given to the government under Sections 36 and 37 of the Act. Section 36 allows the Centre to call for information from a Data Fiduciary or an intermediary for specified purposes. The petitioners argue that such powers could affect the confidentiality of journalistic sources if information held by news organisations is sought without adequate safeguards.
Journalists often rely on whistleblowers and confidential sources to report on corruption, corporate wrongdoing and other sensitive matters. The petition argues that the possibility of such information being disclosed could discourage people from sharing information with the media.
Section 37 empowers the government to restrict public access to certain information in specified circumstances. The petitioners argue that the provision gives the government wide powers and could affect the circulation of news and information. They have questioned whether adequate safeguards are in place to prevent the misuse of these powers.
What has the Supreme Court said?
The Supreme Court has issued notice to the Centre on the DNPA petition as well as its plea seeking an interim stay on the challenged provisions. During the hearing, the bench headed by Chief Justice Surya Kant stressed the need to balance the privacy rights of ordinary citizens with the media’s freedom to investigate and report.
The court asked the publishers to suggest safeguards that could prevent misuse while protecting journalistic activities. It has listed the matter for further hearing on November 17. The court has not yet ruled on the constitutional validity of the challenged provisions or granted the requested interim relief.
What does the petition seek?
The petitioners have sought to strike down several provisions of the DPDP Act, including Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3), along with Rules 16, 17 and 23 of the DPDP Rules. They have also challenged the amended Section 8(1)(j) of the RTI Act, arguing that it restricts access to information in the public interest. The petition contends that the provisions violate constitutional rights, including freedom of speech and expression, the right to practise a profession and the right to equality.
The legal challenge brings into focus a larger question: how can the government protect the personal data of citizens without making it difficult for journalists to investigate and report on issues of public interest? The Supreme Court’s examination of the petition will be important in determining how these competing rights are balanced.