DPDP Act Journalism Exemption: Why Publishers Moved the Supreme Court

Overview

The omission of an express statutory exemption for newsgathering under the Digital Personal Data Protection Act, 2023 creates an acute constitutional conflict. It pits media freedom under Article 19(1)(a) directly against the fundamental right to privacy under Article 21.

By categorising newsrooms as standard Data Fiduciaries, the statute subjects routine reporting to mandatory notice rules, data erasure rights, and executive scrutiny. This framework leaves investigative journalism vulnerable to stringent consent mandates and severe statutory penalties.

The regulatory shift creates distinct constitutional concerns:

• Chilling effect: Media organisations argue that standard data compliance rules paralyse investigative journalism and expose confidential sources.
• Statutory integrity: The Union government maintains that the legislative architecture must avoid expansive loopholes to protect citizen privacy.
• Harmonious construction: The Supreme Court of India must now reconcile individual informational privacy with the structural independence of the fourth estate.

The Supreme Court of India has agreed to examine whether privacy legislation unduly restricts press freedom. On 27 October 2026, the Supreme Court of India issued notice to the Union government on a writ petition filed by the Digital News Publishers Association, according to Supreme Court of India Proceedings, Digital News Publishers Association & Anr v. Union of India & Anr. The petition challenges the constitutional validity of the Digital Personal Data Protection Act, 2023 and its delegated rules for infringing the freedom of the press.

News publishers argue that subjecting journalistic activities to statutory data fiduciary obligations severely restricts independent reporting. The apex court's intervention highlights the delicate balance between safeguarding personal data and protecting the investigative press as an essential pillar of Indian democracy.

The Digital Personal Data Protection Act, 2023 contains no express statutory exemption for processing personal data for journalistic purposes, according to The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Gazette of India. As a consequence, media houses, digital news portals, and independent reporters are treated as standard Data Fiduciaries when collecting, storing, or analysing personal data.

Statutory duties imposed on Data Fiduciaries introduce structural barriers to conventional news reporting:

• Mandatory prior notice: Newsrooms must issue itemised notices explaining what personal data is gathered and why.
• Informed consent: Reporters must obtain explicit, verifiable consent from subjects before processing their personal information.
• Right to erasure: Individuals can demand that publishers delete published or archived personal data upon withdrawing consent.
• Heavy financial liabilities: Violating statutory compliance obligations exposes publishers to severe monetary penalties.

Data protection enforcement carries unprecedented financial risk for news organisations. Under The Digital Personal Data Protection Act, 2023, The Schedule (Penalties), failure to comply with data protection obligations or inquiries by the Data Protection Board can attract monetary penalties of up to ₹250 crore on Data Fiduciaries.

The statutory evolution of India's privacy framework reveals a steady departure from explicit journalistic safeguards. Earlier legislative drafts acknowledged the democratic necessity of public-interest journalism by providing statutory carve-outs tied to established ethical standards.

The draft Personal Data Protection Bill, 2018, authored by the Justice B.N. Srikrishna Committee, included Section 36 to exempt journalistic processing, according to the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, 'A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians'. This exemption applied provided reporters complied with ethical codes, such as those established by the Press Council of India.

The Personal Data Protection Bill, 2019 retained this approach under Clause 36(e). It provided a statutory exemption for data processing necessary for journalistic purposes, subject to the code of ethics of the Press Council of India or self-regulatory media entities, per The Personal Data Protection Bill, 2019 (Bill No. 373 of 2019), Lok Sabha.

During consultative rounds, Union government officials highlighted that an open-ended statutory exemption was unviable due to the lack of a legal boundary separating institutional media from unverified digital content creators, per MeitY Stakeholder Consultations on Data Protection Rules and FAQs (as reported, August 2025). The Union government defended the statutory structure in Parliament, stating that privacy is a fundamental right of every citizen under Article 21 and arguing that statutory architecture should avoid expansive statutory loopholes.

The operational requirements of the DPDP Act, 2023 directly collide with established investigative reporting practices. Under Sections 5 and 6 of the Act, Data Fiduciaries must furnish prior itemised notice and obtain verifiable, informed consent from a Data Principal before processing their personal data, according to The Digital Personal Data Protection Act, 2023, Sections 5 and 6.

In investigative journalism, requesting consent from corrupt public figures or corporate entities before publishing expose pieces would destroy the investigative process.

Statutory rights granted to individuals present additional operational dilemmas for media archives. Under Section 12 of the DPDP Act, 2023, Data Principals possess the statutory right to seek correction, completion, updating, and erasure of their personal data upon withdrawal of consent, as established in The Digital Personal Data Protection Act, 2023, Section 12. If interpreted strictly, this provision enables influential individuals to demand the removal of investigative reports, transforming data privacy rights into an indirect right to be forgotten without judicial balancing.

Confidential journalistic sources and whistleblower protection face statutory vulnerabilities:

• Executive summons: Section 36 of the DPDP Act, 2023 empowers the Central Government to call for any information from the Data Protection Board, any Data Fiduciary, or any intermediary.
• Compromising source confidentiality: Newsrooms ordered to hand over server records, communication metadata, or informant identities risk exposing whistleblowers.
• RTI Act amendment: Section 44(3) of the DPDP Act, 2023 amends Section 8(1)(j) of the Right to Information Act, 2005 to exempt all personal information from disclosure, eliminating the prior public interest override and the legislative proviso.

The legal debate over the DPDP Act represents a fundamental clash between two justiciable Fundamental Rights under Part III of the Constitution of India. Freedom of speech and expression under Article 19(1)(a) encompasses freedom of the press as an essential pillar of democratic governance, as established by the Supreme Court in Constitution of India, Article 19(1)(a); Romesh Thappar v. State of Madras (1950 SCR 594).

An independent press operates as a public watchdog. It requires investigative latitude to scrutinise state power and expose maladministration.

Constitutional protections for individual privacy stand on equal footing. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge Constitution Bench held that the right to privacy is a fundamental right under Article 21, as recorded in Supreme Court of India, Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. The Puttaswamy ruling established that any state encroachment on privacy must satisfy a four-pronged proportionality standard: legality, legitimate state aim, suitability, and strict necessity.

Reconciling these two fundamental rights requires harmonious construction rather than structural subordination:

• Neither right is absolute: Article 19(1)(a) is constrained by reasonable restrictions under Article 19(2), while Article 21 is qualified by procedure established by law.
• Proportionality assessment: Obligating newsrooms to disclose sources or obtain subject consent fails the necessity test by crippling public interest reporting.
• Chilling effect: Imposing severe financial penalties on reporters infringes Article 19(1)(a) without serving a proportionate privacy objective.

International data protection regimes offer clear models for balancing informational privacy with media freedom. Article 85 of the European Union's General Data Protection Regulation (GDPR) mandates Member States to reconcile data protection rules with freedom of expression and information by enacting specific exemptions for journalistic, academic, artistic, and literary purposes, according to Regulation (EU) 2016/679 (GDPR), Article 85, Official Journal of the European Union.

Comparative international practice illustrates the difference between statutory reconciliation and total omission:

Blanket, unconditional journalistic exemptions can be misused to shield unauthorised doxxing, paparazzi harassment, and commercial data exploitation disguised as media reporting, as observed in Verfassungsblog Analysis on Article 85 GDPR & Public Interest Journalism. However, the GDPR avoids this danger by requiring exemptions to be proportionate and linked to professional journalistic ethics, rather than eliminating press safeguards entirely.

The Union government argues that statutory flexibility under the DPDP Act resolves operational challenges for the press. Government representatives pointed to Section 17(1)(c) of the DPDP Act, which permits data processing without consent for the prevention, detection, investigation, or prosecution of any offence, according to The Digital Personal Data Protection Act, 2023, Section 17(1)(c); MeitY Delegated Consultations.

Furthermore, Section 17(2)(a) of the DPDP Act, 2023 empowers the Central Government to exempt by notification any Data Fiduciary or class of Data Fiduciaries from specified provisions based on the volume and nature of personal data processed.

Executive discretion over press exemptions raises serious constitutional concerns regarding media independence. In representations submitted to MeitY, the Editors Guild of India and DIGIPUB argued that categorising newsrooms as Data Fiduciaries without journalistic exemptions creates an unconstitutional chilling effect on investigative reporting and democratic accountability, as cited in Editors Guild of India Representation to Ministry of Electronics and Information Technology. If the executive retains the sole power to decide which newsroom qualifies for an exemption, independent outlets investigating government conduct face the threat of arbitrary exclusion.

Regulatory blocking powers compound these structural vulnerabilities:

• Content blocking mechanisms: Section 37 of the DPDP Act, 2023 empowers the Central Government to direct any agency or intermediary to block public access to any information or computer resource of a Data Fiduciary if penalised twice or more by the Data Protection Board.
• Threat of censorship: Repeated procedural penalties could result in the arbitrary digital suspension of independent news platforms.
• Administrative subordination: Leaving media rights to delegated executive discretion undermines the separation of powers.

The ethical responsibilities of modern newsrooms require balancing individual dignity against the public's right to know. Journalism often handles sensitive personal information during investigations into political corruption, environmental crimes, and corporate malpractice.

Unchecked data collection by commercial entities poses grave privacy risks. However, treating public-interest news reporting as standard commercial data processing subverts the fourth estate's constitutional role.

Newsroom bodies have voiced specific institutional concerns regarding these operational risks:

• Protecting whistleblowers: Without legal protections, reporters face ethical and legal jeopardy when safeguarding informants who expose official wrongdoing at great personal risk.
• Investigating malpractice: Probing financial impropriety or corruption requires handling unverified personal records without tipping off subjects through advance notice.
• Statutory clarification demands: The Press Club of India and the Indian Women's Press Corps jointly submitted 35 questions to MeitY in August 2025 demanding written clarification and statutory shielding for newsgathering under the DPDP framework, as detailed in Press Club of India & Indian Women's Press Corps Joint Submission to MeitY.

Harmonising data privacy and press freedom requires structural amendments to the statutory framework. The Parliament should reinstate an express statutory exemption for journalistic activities, drawing inspiration from the Srikrishna Committee's 2018 draft and Article 85 of the EU GDPR. This statutory carve-out must exempt bona fide newsgathering from prior notice, consent mandates, and unilateral erasure demands.

To prevent bad-faith actors from exploiting journalistic carve-outs, protections should be tied to established ethical codes:

• Ethical standard compliance: Link statutory exemptions to established self-regulatory codes, such as those formulated by the Press Council of India or certified digital news associations.
• Judicial oversight for disclosures: Amend Section 36 to mandate that government requests for newsroom data or source identities require prior judicial authorisation rather than executive direction.
• Restoring the RTI public interest test: Re-examine the amendment to Section 8(1)(j) of the RTI Act to ensure that public interest overrides remain available when disclosing personal information of public officials.
• Independent Data Protection Board: Ensure the Data Protection Board of India functions with structural autonomy, insulating regulatory enforcement from executive influence.

• The DPDP Act, 2023 omits an express statutory exemption for journalistic data processing, treating media outlets as standard Data Fiduciaries under the law.
• On 27 October 2026, the Supreme Court of India issued notice on a petition by the Digital News Publishers Association challenging the constitutional validity of the Act and its rules.
• The Srikrishna Committee (2018) and the PDP Bill (2019) previously included explicit journalistic exemptions subject to Press Council of India ethics, which were omitted from the final 2023 enactment.
• The dispute reflects a direct constitutional tension between press freedom under Article 19(1)(a) and the fundamental right to privacy under Article 21 established in the 2017 Puttaswamy judgment.
• Mandatory notice under Section 5, consent rules under Section 6, erasure under Section 12, and penalties reaching ₹250 crore on Data Fiduciaries threaten the practice of investigative journalism.
• International standards under Article 85 of the EU GDPR demonstrate that data protection frameworks can reconcile privacy with freedom of expression through targeted, ethically grounded exemptions.