On October 6, the Digital News Publishers Association (DNPA), representing 21 of India’s biggest digital news publishers, moved the Supreme Court against provisions of the Digital Personal Data Protection (DPDP) Act, 2023, and the rules notified under it on November 14, 2025.The coalition includes Network18, owned by Mukesh Ambani’s Reliance group, Gautam Adani’s NDTV, The Indian Express, Times Internet, The Hindu, Zee Media, ABP, Malayala Manorama, Mathrubhumi, Amar Ujala, Eenadu Television and the India Today Group. Their petition runs to 698 pages.The coming together of media groups with different editorial positions and corporate linkups, including those controlled by businessmen widely perceived as close to the government, is itself significant.
The industry is united by the prospect of a regulatory regime that could fundamentally alter how journalism is practised.On October 27, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana issued a notice to the Centre but declined to stay the contested provisions without hearing the government’s response.
The next hearing is scheduled for November 17. Most of the contested operational provisions take effect on May 13, 2027, 18 months after the rules were notified.
News publishers want the constitutional questions settled before that happens. The big houses also appear to have stopped believing that a ministry promise can do the work of a statute.
The dispute presents a constitutional dilemma. Can a law designed to protect the privacy of individuals end up protecting the powerful from legitimate public scrutiny?The law and its blind spotIndia’s DPDP Act emerged from a legitimate concern.
As citizens conduct more of their lives online, technology companies, financial institutions, commercial platforms and government agencies collect enormous quantities of personal information. The Supreme Court’s landmark K.S.
Puttaswamy judgment of 2017 recognised privacy as a Fundamental Right. The 2023 legislation was intended to give that right practical protection in the digital economy.Its central principle is straightforward.
Organisations collecting or processing identifiable personal information—from social media platforms to e-commerce apps—must generally obtain informed consent, disclose the purpose for which the data is used, secure it against breaches and allow individuals to exercise certain rights over it. The law calls such an entity a data fiduciary.
The rights include withdrawing consent at any time and seeking correction or erasure of personal data. The Act also permits processing without consent for specified legitimate uses.The obligations extend beyond technology giants such as Google and Meta.
They can apply to any entity processing digital personal data, including information originally collected on paper and subsequently digitised. That potentially brings news publishers within its ambit.The trouble lies in what the law leaves out.
Section 17 provides various exemptions, including for certain state agencies, legal proceedings, investigations of offences and qualifying research, archiving and statistical activities. The government can exempt its own agencies on grounds such as sovereignty, security and public order.
But there is no explicit exemption for public-interest journalism. In an August letter to the government, attached to the petition, the DNPA complained that the state had written itself broad exemptions while the press got none.Every earlier draft of India’s data protection law protected journalism.
The 2018 bill prepared by the Justice B.N. Srikrishna Committee exempted processing for journalistic purposes.
The Personal Data Protection Bills of 2019 and 2021 kept the exemption. The 2022 draft dropped it, and the 2023 Act, passed by the Lok Sabha in under an hour, never restored it.The DNPA points out that the European Union, Britain and Singapore all write a carve-out for journalism into their privacy laws.
India has none. Senior advocate Madhavi Divan, arguing for DNPA, told the court that nobody has explained why.The distinction matters because journalism is not ordinary data processing.
A bank collects information to serve a customer. A journalist may collect information precisely because someone does not want the public to know it.
Without a journalism exemption, a reporter who gathers information about a person is processing personal data like any app.Consent as a potential vetoConsider a journalist investigating allegations that a minister acquired properties through undisclosed financial arrangements. The investigation might require examining private records, tracing transactions and identifying individuals involved.Sections 4 to 6 establish consent as the principal basis for processing personal data, subject to specified exceptions.
A shopping platform can seek consent when a user signs up. An investigation cannot ask its subject’s permission.
The DNPA argues that, without a journalism-specific exemption, a reporter could be required to notify the very person under investigation and obtain consent to process relevant information. That would defeat the purpose of an investigation.
Advance notice could give its subject time to destroy evidence, influence witnesses or obstruct further inquiries.At the October 27 hearing, Divan put the publishers’ case in precisely 11 words. “We have to ask your permission if we report on you,” she told the bench. She described the implications as “a complete regime of pre-censorship”.
Journalism, she argued, cannot function if reporting depends on permission from the people being scrutinised.There are qualifications. Section 3 excludes certain information already made publicly available by the individual concerned or by someone legally obliged to disclose it.
Other statutory exceptions may apply. The law, therefore, does not automatically require consent for every fact appearing in a newspaper.
But that exclusion does not cover a politician’s undeclared property, a company’s hidden payments or a contractor’s links to an official, which is what investigative reporting is about.The law’s treatment of unpublished records, leaked documents and personal information acquired during investigations remains uncertain. And uncertainty, when combined with potentially ruinous penalties can itself become an instrument of censorship.The second concern involves the right to erasure.
Section 12 permits individuals to seek deletion of personal data processed on the basis of their consent, subject to legal and other statutory limitations. Section 8 also imposes obligations concerning the retention and deletion of data.
The subject of a story can withdraw consent at any time and demand that their data be erased, and the law offers no public-interest test against that demand.For ordinary commercial data, such protections are sensible. A company should not retain a former customer’s information indefinitely without lawful justification.
A newspaper archive is different. A report about corruption, criminal conduct or abuse of public office is part of the historical record.
It does not become less newsworthy because its subject subsequently wants it removed.Publishers fear that individuals could deploy deletion requests to pressure news organisations into unpublishing or heavily redacting legitimate reports, including those in their archives. The law does not create an unconditional right to have any published story erased.
But without an express public-interest journalism safeguard, the boundary between legitimate data protection and suppression of truthful reporting remains vulnerable to litigation and regulatory pressure.Sources under scrutinyPerhaps the most serious concern is the government’s power to demand information. Section 36 authorises the Centre to require the Data Protection Board, data fiduciaries or intermediaries to furnish such information as it may call for, for the purposes of the Act.
Rule 23 and the Seventh Schedule of the rules specify purposes that include national security, certain lawful government functions and regulatory assessments.The petition notes that the power comes with no judicial oversight, no test of necessity or proportionality and no notice to the person whose data is taken. Pointed at a newsroom, the publishers argue, it could reach a reporter’s notes, contacts and communications that identify confidential sources.Rule 23 also permits the government, on specified national-security grounds, to prohibit disclosure of such information requests.
Imagine an official passing documents to a reporter exposing irregularities in government contracts. If authorities obtain the relevant communications, the identity of the whistleblower could be exposed even without directly compelling the journalist to name the source.The law does not expressly authorise indiscriminate seizure of newsroom records.
Its information-demand power is tied to statutory purposes. Yet it does not require prior judicial approval for every demand nor does it expressly safeguard confidential journalistic communications.The Act establishes a Data Protection Board of India empowered to hear complaints, investigate violations and impose substantial monetary penalties.
The maximum penalty is Rs 250 crore for a single failure to maintain reasonable security safeguards. Other breaches attract different ceilings, including up to Rs 200 crore for certain violations and Rs 50 crore for other contraventions.These amounts may be manageable for technology multinationals.
For independent or regional news publishers, even the threat of substantial penalties could have a chilling effect.Section 37 adds another concern. Where the Board has imposed monetary penalties on an entity on at least two occasions and recommends blocking, the government can, after providing an opportunity to be heard and recording reasons, order specified online information blocked in the interests of the general public.The provision contains procedural conditions.
But the publishers question whether the broad expression “interests of the general public” provides adequate protection for the constitutional freedom of speech. They read it as a takedown power with a privacy label.There is also concern over the independence of the government-appointed Data Protection Board.
A regulator exercising potentially consequential powers over the press must be independent of the executive whose conduct the press is expected to scrutinise.What the government saysThe Centre insists that privacy and transparency are not incompatible. Its response to critics has come in two forms, denial and verbal assurance.
In August 2023, Union IT minister Ashwini Vaishnaw called the criticism unfair. He said the state’s exemptions were limited to national security, foreign relations and public order, against 16 exemptions in Europe’s General Data Protection Regulation (GDPR).
Section 37, he said, was meant for platforms that keep violating privacy after paying penalties.The government has also defended the larger data protection framework as the outcome of extensive consultations. It says the legislation and rules strengthen individual rights, impose accountability on organisations and provide a balanced regulatory structure.The verbal assurance came on July 28, 2025, when MeitY secretary S.
Krishnan met the Press Club of India, the Indian Women’s Press Corps, DIGIPUB and the Editors Guild of India. Officials told them journalists were not data fiduciaries under the Act, and that Section 8(2) of the RTI Act still allows disclosure in the larger public interest.
The ministry promised a set of FAQs.Journalist bodies sent in 35 questions on August 23, 2025. Within weeks, government sources made clear the Act itself would not be changed.
When the rules were notified in November 2025, the Editors Guild said the verbal assurance had never become anything legally binding.The DNPA got the same treatment this year. Its representatives met government officials on August 25, following a written representation earlier that month.
According to the publishers’ court filing, officials assured them that press freedom would remain protected. But those assurances have not translated into a statutory exemption or binding clarification.
As of the October 27 hearing, the Centre had not presented its substantive defence of the DNPA petition before the Supreme Court.The way forwardThe concerns of publishers deserve scrutiny, but they should not be mistaken for an argument that journalists deserve unrestricted access to private information. Victims of sexual violence, children, private citizens and people subjected to sensational or inaccurate coverage need strong protections.
Indian television has convicted people on air before courts heard them, and has exposed the private lives of people with no public role. Privacy is a fundamental right, not a privilege that disappears whenever a newsroom claims public interest.Chief Justice Surya Kant recognised precisely this dilemma during the hearing.
He reminded the petitioners that innocent citizens have rights too and that the court must strike a balance. He asked the publishers, as domain experts, to suggest safeguards against misuse.
It is a fair demand.That points towards a workable solution. India needs an express, carefully defined public-interest journalism exemption, subject to protections against gratuitous intrusion and abuse.
Confidential sources need safeguards against disclosure without independent judicial scrutiny. Regulatory penalties must be proportionate.The central distinction is between protecting an individual’s private life and shielding conduct that has legitimate public consequences.
A citizen should be able to stop a company from exploiting personal information. A minister should not be able to stop a journalist from uncovering corruption.
The law must recognise that difference.Subscribe to India Today Magazine- Ends