Twenty-one publishers have challenged the Digital Personal Data Protection Act, warning its provisions undermine journalistic work and expose confidential sources.
Media experts and analysts say:
There is absence of Journalistic Exemption:
The law fails to provide a distinct carve-out or exemption for journalistic reporting (unlike earlier draft versions from 2018–2021). The Law could force reporters to seek consent from individuals under investigation, threatening investigative reporting, time-sensitive stories, and public-interest exposés.
^^^^
On October 6, the Digital News Publishers Association (DNPA), representing 21 of India’s biggest digital news publishers, moved the Supreme Court with their nearly 700-page petition. They are challenging the Digital Personal Data Protection (DPDP) Act, 2023, and the rules notified under it on November 14, 2025.
The official version says the Digital Personal Data Protection Act, 2023 (DPDP Act) governs the processing of digital personal data within India and has extra-territorial application to foreign entities offering goods or services to individuals in India.
Enacted on August 11, 2023, and operationalized with the Digital Personal Data Protection Rules, 2025, the law balances individual privacy rights with lawful data processing needs.
Those opposing it include Network18, owned by Mukesh Ambani’s Reliance group, Gautam Adani’s NDTV, 'The Indian Express', 'Times Internet', The Hindu, Zee Media, ABP, Malayala Manorama, Mathrubhumi, Amar Ujala, Eenadu Television and also the 'India Today' Group.
The industry is united by the prospect of a regulatory regime that could fundamentally alter how journalism is practised.
On Oct 27, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana issued a notice to the Centre but declined to stay the contested provisions without hearing the government’s response. The next hearing is scheduled in November.
Key Entities
• Data Principal: The individual to whom the personal data relates (the citizen or user).
• Data Fiduciary: Any person or entity (public or private) that determines the purpose and means of processing personal data.
• Significant Data Fiduciary (SDF): Fiduciaries designated by the government based on data volume, sensitivity, and risk, who must appoint a local Data Protection Officer and conduct periodic impact assessments.
• Data Processor: An entity that processes personal data on behalf of a Data Fiduciary.
• Lawful Consent: Data can be processed only with free, specific, informed, and unambiguous consent, or for specified "legitimate uses" (such as medical emergencies or legal compliance).
• Data Principal Rights: Individuals have the right to access a summary of their data, request corrections or erasure, seek grievance redressal, and nominate a representative.
Union IT Minister Ashwini Vaishnaw stated that press freedom remains constitutionally guaranteed and that the DPDP Act does not target journalism. He noted that the government is open to engaging with editors and potentially hardcoding an amendment if required.
Section 17 lists out instances where personal data protection does not apply and they include legal claims where personal data is processed to enforce a legal right or claim.
It also includes judicial and regulatory functions where courts, tribunals or legally authorised bodies process personal data as necessary to perform their judicial, quasi-judicial, regulatory or supervisory functions.
Earlier versions of the law, in 2018, 2019 and 2021, had carried such an exemption. According to the publishers, this means a reporter writing about a person may first need that person's consent.
The Rules lay down how consent, notices and breach reporting are to work in practice.
Among the most contested is Rule 23, framed under Section 36 of the Act, which allows the Centre, acting through an authorised person, to require any Data Fiduciary or intermediary to furnish information and also bar them from disclosing that such a request was made.
What is the RTI angle?
The petition also targets Section 44(3) of the DPDP Act, which rewrote Section 8(1)(j) of the Right to Information Act. Earlier, personal information could be withheld only if it bore no relation to public activity or would cause an unwarranted invasion of privacy, and could still be released where a larger public interest justified it.
The amended clause now simply exempts "information which relates to personal information".
ends
No comments:
Post a Comment