Data protection law faces scrutiny: Key concerns explained

The Digital News Publishers Association has challenged the Digital Personal Data Protection Act, 2023, and its accompanying rules. It represents 21 news organisations. The association argues that some provisions could restrict journalistic work, expose confidential sources and weaken the Right to Information framework. The case tests how privacy protections should coexist with the public’s right to know.

The Supreme Court issued notice to the Centre on October 27. This means the government has been asked to respond to the legal challenge. The Court listed the matter for further hearing on November 17. The dispute centres on whether general data-protection rules can apply to journalism without clear safeguards.

The government has indicated that it is open to changing the rules or even the law if necessary. The broader question remains unresolved. Constitutional protections and judicial scrutiny may address competing interests, but the DNPA argues that journalism needs explicit statutory protection.

The Digital Personal Data Protection Act, 2023, creates rules for processing digital personal information in India. Parliament passed it in August 2023. It was introduced as digital services expanded across banking, shopping, payments, social media, healthcare and welfare schemes. These services rely heavily on personal data, creating risks such as breaches, identity theft, unauthorised sharing and misuse.

The law requires organisations handling personal data to follow duties around consent, transparency, security and accountability. People must be told why their information is collected and how it will be used. They can access information about processing, seek correction or erasure, withdraw consent and raise grievances.

The framework is being implemented through rules. MeitY notified the Digital Personal Data Protection Rules, 2025, on November 14, 2025, after receiving 6,915 consultation inputs. The government describes the system as citizen-centric and focused on responsible data use.

Investigative journalism often examines people, organisations and official decisions using personal information. Publishers are concerned that the DPDP framework may impose duties designed for ordinary data processing on journalistic activity. Without an explicit statutory safeguard, reporting practices could face uncertainty or legal pressure. The issue matters because investigations can reveal wrongdoing, misuse of power or failures in public administration.

For example, a reporter may need to verify records, contact people connected to a story or retain information while checking allegations. The Act generally requires consent before processing personal data, unless another legal basis applies. It also gives individuals rights to access, correct or erase information, withdraw consent and raise grievances. Those mechanisms may conflict with source protection or the need to preserve reporting material.

The DNPA has taken the issue to the Supreme Court. The government says it may amend the rules or law if needed. The Court’s response could clarify whether constitutional protections are enough or whether journalism needs specific legislative protection.

Journalists depend on information to investigate public institutions and hold governments accountable. The DNPA argues that the DPDP Act and rules could interfere with this work. Its concerns include protecting confidential sources and preserving access to records obtained through the Right to Information framework. If privacy claims override legitimate public-interest reporting, important scrutiny could become more difficult.

A source may share information privately, while a reporter may need to retain or verify personal details during an investigation. The Act gives individuals rights to know how their data is processed, seek correction or erasure, withdraw consent and raise grievances. Organisations must also use reasonable security safeguards. These protections could create tension with source confidentiality and journalistic records, according to the challenge.

The legal outcome is still pending. The Supreme Court issued notice to the Centre and listed the case for November 17. The government has said it may amend the rules or legislation, while the debate continues over privacy, RTI access and government accountability.

The Act divides key roles between organisations that handle data and the people it describes. A Data Fiduciary determines why and how personal data is processed. A Data Principal is the individual to whom that data belongs. This structure assigns responsibility to data handlers while recognising personal control over information.

A bank collecting customer details, an e-commerce platform storing purchase histories or a company keeping employee records may be Data Fiduciaries. They generally must obtain consent, explain the purpose of collection, use reasonable security safeguards and report breaches under the prescribed framework. Consent must be free, specific, informed, unconditional and unambiguous, except where processing is otherwise permitted by law.

Data Principals can access information about processing, request correction or erasure, withdraw consent and raise grievances. They may also nominate another person to exercise their rights in certain circumstances. Additional safeguards generally apply when organisations process children’s data.

The DPDP framework covers a wide range of digital activity. Personal information is used in banking, online shopping, digital payments, social media, healthcare and government welfare schemes. The law therefore affects many organisations that determine how personal data is collected and used. It also affects individuals whose information is processed.

The challenge itself has significant organisational reach: the Digital News Publishers Association represents 21 news organisations. The framework also followed a large consultation process. The government’s Press Information Bureau backgrounder said it received 6,915 inputs from startups, small businesses, industry bodies, civil society groups, government departments and citizens.

The article describes duties, rights and breach-notification requirements, but it does not state the maximum financial penalties for violations. It also does not provide a total number of regulated organisations or an overall financial estimate. The government remains open to changing the rules or law as implementation proceeds.

Personal data is information connected to an individual and handled through digital systems. The article links it to customer details, purchase histories, employee records and information used in payments, healthcare and welfare services. Protecting it matters because expanding digital services also increases risks of breaches, identity theft, unauthorised sharing and misuse.

Privacy gives people control over how information about them is collected and used. Under the DPDP Act, organisations generally need consent and must explain their purpose. Individuals can access processing information, seek correction or erasure, withdraw consent and raise grievances. Organisations must also use reasonable security safeguards and follow breach-notification requirements.

The Supreme Court recognised privacy as a fundamental constitutional right in its landmark 2017 Puttaswamy judgment. That recognition helped establish the importance of data protection in India’s digital society. The current debate asks how privacy can be protected without weakening journalism, RTI access or government accountability.