Why India's new privacy law has newsrooms worried

Twenty-one major digital news publishers have asked India’s Supreme Court to strike down or limit provisions of the Digital Personal Data Protection Act, 2023, and its rules. Their concern is not privacy protection itself. It is that the law treats journalism like ordinary data processing and gives no explicit exemption for public-interest reporting.

A reporter may need to collect private records, trace transactions or identify people while investigating alleged corruption. The law gives people rights to consent, withdraw consent, correct data or seek erasure. Publishers fear those rights could interrupt reporting, reveal confidential sources or help powerful people block scrutiny before publication.

The DNPA filed a 698-page petition on October 6. The Supreme Court issued notice to the Centre but did not suspend the provisions. Most contested rules begin on May 13, 2027, so publishers want the constitutional questions decided before then.

India’s Digital Personal Data Protection Act, 2023, is meant to protect people’s privacy as more personal information moves online. It applies to organisations that collect or process identifiable personal data. These organisations are called data fiduciaries. The law gives individuals practical control over information held about them.

In general, a data fiduciary must obtain informed consent and disclose why it is using the data. It must protect the information against breaches. People can withdraw consent and seek correction or erasure of their personal data. The Act also permits processing without consent for specified legitimate uses.

The law can reach beyond technology companies such as Google and Meta. It may cover any entity processing digital personal data, including data first collected on paper and later digitised. That broad scope could therefore include news publishers, creating the dispute over journalism.

The group is large and unusually broad. The Digital News Publishers Association represents 21 of India’s biggest digital news publishers, and its petition runs to 698 pages. The coalition includes Network18, NDTV, The Indian Express, Times Internet, The Hindu, Zee Media, ABP, Malayala Manorama, Mathrubhumi, Amar Ujala, Eenadu Television and the India Today Group.

Its political significance comes from the publishers’ different editorial positions and corporate connections. The group includes Network18, owned by Mukesh Ambani’s Reliance group, and NDTV, owned by Gautam Adani. The article notes that some participating businesses are controlled by people widely perceived as close to the government.

That breadth makes the challenge notable. The publishers are united by a shared institutional concern: the law could fundamentally change how journalism works. The Supreme Court issued notice to the Centre on October 27, while refusing to stay the provisions before hearing the government’s response.

Journalism often needs information precisely because a person does not want the public to know it. Requiring consent or advance notice could therefore reverse the normal logic of an investigation. A reporter could be forced to alert the subject before checking allegations, weakening the public’s ability to learn about wrongdoing.

For example, an investigation into a minister’s alleged undisclosed property arrangements might require private records, transaction trails and identification of people involved. If those people could withdraw consent, request corrections or seek erasure, they might interrupt the reporting process. The law’s consent-centred structure could also make journalists process information like ordinary apps.

The article presents this as a potential conflict, not a settled court ruling. The DPDP Act permits some processing without consent for specified legitimate uses, but it does not expressly exempt public-interest journalism. Publishers want the constitutional questions resolved before the contested rules begin operating.

Section 17 provides exemptions from parts of the DPDP Act. They cover certain state agencies, legal proceedings, investigations of offences, and qualifying research, archiving and statistical activities. The government may also exempt its own agencies on grounds including sovereignty, security and public order.

Publishers are concerned because journalism is absent from that list. A newsroom may process digital personal data while investigating corruption, tracing transactions or identifying people connected to a public-interest story. Without an explicit carve-out, it may face duties designed for commercial data processors, even when reporting serves public scrutiny rather than a commercial transaction.

The DNPA said in an August letter, attached to its petition, that the state had written itself broad exemptions while the press got none. The dispute asks whether privacy protection can operate without shielding powerful people from legitimate scrutiny. The Supreme Court has not yet stayed the provisions, and the government’s response is pending.

India’s earlier data-protection proposals treated journalism differently from the final Act. The 2018 bill prepared by the Justice B.N. Srikrishna Committee exempted processing for journalistic purposes. The 2019 and 2021 Personal Data Protection Bills kept that exemption, recognising that reporting can require handling information without a subject’s permission.

The protection disappeared in the 2022 draft. The 2023 Act, which passed the Lok Sabha in under an hour, did not restore it. This left news publishers subject to a framework that contains no explicit public-interest journalism exemption, even though journalism may involve sensitive information gathered for public scrutiny.

The DNPA says the contrast is also international. The European Union, Britain and Singapore write a journalism carve-out into their privacy laws. Senior advocate Madhavi Divan told the court that nobody had explained why India omitted one. The publishers are seeking clarity before most operational provisions take effect in May 2027.

The constitutional tension begins with two important interests. Privacy protects individuals as companies and governments collect more personal information. Press freedom and the public’s right to know support journalism that investigates conduct affecting society. The article notes that the Supreme Court recognised privacy as a Fundamental Right in K.S. Puttaswamy in 2017.

The interests can collide when reporting requires personal data. A journalist investigating a minister’s alleged undisclosed property arrangements may need private records, transaction details and identities. The subject may not consent, and could potentially seek correction or erasure. Protecting privacy in that situation might also protect wrongdoing from exposure.

The DPDP Act includes some legitimate uses and other exemptions, but no explicit public-interest journalism exemption. That omission creates the constitutional dilemma raised by the publishers. The Supreme Court has issued notice to the Centre and must consider whether the law protects privacy without undermining journalism and legitimate public scrutiny.