Data protection law faces scrutiny: The key concerns explained | India News

India’s new data protection framework was introduced with a clear objective: to give citizens greater control over their personal information and make organisations accountable for how they collect, store and use it. But as the government moves towards implementing the law, a growing debate has emerged over whether safeguards designed to protect individual privacy could also affect investigative journalism, access to public records and government accountability.The Digital Personal Data Protection (DPDP) Act, 2023, is facing a legal challenge from the Digital News Publishers Association (DNPA), which represents 21 news organisations. The association has approached the Supreme Court, arguing that several provisions of the law and its accompanying rules could restrict journalistic activities, compromise confidential sources and undermine the Right to Information (RTI) framework.The Supreme Court issued notice to the Centre on October 27 and listed the matter for further hearing on November 17. The government, meanwhile, has indicated that it is open to amending the rules or even the law itself if necessary to address concerns over press freedom.The challenge has brought an important question into focus: Where should the line be drawn between an individual’s right to privacy and the public’s right to know? While one view holds that constitutional protections and judicial scrutiny can address competing interests, another argues that journalism needs explicit statutory safeguards.

What is the DPDP Act and why was it introduced?

Parliament passed the Digital Personal Data Protection Act in August 2023, establishing a legal framework to regulate the processing of digital personal information.The legislation came against the backdrop of India’s rapidly expanding digital economy, where personal information has become central to everyday activities. Banking transactions, online shopping, digital payments, social media accounts, healthcare services and government welfare schemes all involve the collection and processing of personal data.While this has made services more accessible, it has also increased the risks of data breaches, identity theft, unauthorised sharing and misuse of personal information.The need for a comprehensive data protection framework gained importance after the Supreme Court, in its landmark 2017 Puttaswamy judgment, recognised privacy as a fundamental right under the Constitution.The DPDP Act seeks to establish obligations for organisations handling personal data and provide individuals with rights over how their information is processed.The ministry of electronics and information technology (MeitY) notified the Digital Personal Data Protection Rules, 2025, on November 14, 2025, following consultations with stakeholders.According to a Press Information Bureau (PIB) backgrounder published on November 17, 2025, the government received 6,915 inputs during the consultation process. These included suggestions from startups, micro, small and medium enterprises, industry bodies, civil society organisations, government departments and citizens.The government described the framework as citizen-centric, with an emphasis on consent, transparency, accountability and responsible use of digital personal information.

What does the law provide?

The Act revolves around two key categories: Data Fiduciaries and Data Principals.A Data Fiduciary is an organisation or individual that determines the purpose and means of processing personal data. This could include a bank collecting customer details, an e-commerce platform storing purchase histories or a company maintaining employee records.A Data Principal is the individual to whom the personal information belongs.The legislation requires Data Fiduciaries to obtain consent before processing personal data, except in specified circumstances where processing is permitted under the law. Such consent must be free, specific, informed, unconditional and unambiguous.Individuals must also be informed about the purpose for which their information is being collected and how it will be used.The Act provides Data Principals with several rights, including the right to access information about the processing of their personal data, seek correction and erasure, withdraw consent and raise grievances. They can also nominate another person to exercise their rights in certain circumstances.Organisations are required to implement reasonable security safeguards to protect personal information. In case of a data breach, they must notify the Data Protection Board of India and affected individuals in accordance with the prescribed framework.The legislation also provides additional safeguards for children’s data. Organisations are generally required to obtain verifiable parental consent before processing the personal data of children below 18 years. The law also restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions.The framework provides for the Data Protection Board of India, which is responsible for examining complaints, conducting inquiries and determining penalties for non-compliance.The financial consequences can be significant. Under the Act, failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to Rs 250 crore. Violations relating to breach notifications and obligations concerning children’s data can attract penalties of up to Rs 200 crore.

Why are news publishers challenging the law?

The most prominent concern raised by the DNPA is the absence of a specific exemption for journalistic activities.The association argues that the law does not adequately distinguish between the commercial processing of personal information and its use for reporting matters of public interest.Journalists frequently rely on personal information while investigating allegations involving public officials, companies, financial transactions and government decisions. Such investigations may require access to records and information without informing the person concerned in advance.For instance, a journalist investigating alleged irregularities in the assets of a public official may need to examine financial records, property details and business associations. Seeking consent from the individual before collecting or using such information could alert the subject to the investigation and potentially compromise the reporting process.Similarly, time-sensitive reporting and live television coverage often involve the use of information about individuals without obtaining prior permission.The DNPA has argued that the notice, consent and data-erasure requirements under the DPDP framework could make such activities difficult.In its petition, the association has challenged Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the Act, along with Rules 16, 17 and 23 of the DPDP Rules.It has argued that the provisions fail to recognise journalistic activity as a distinct category deserving protection under the Constitution and could affect journalists, ground reporters, whistleblowers, citizen journalists and RTI activists.The association has also raised concerns over the possibility of individuals withdrawing consent and seeking erasure of their personal information. It fears that this could be used to pressure news organisations into removing reports or altering digital archives, even when the information is relevant to public interest.The challenge is not about denying individuals the right to privacy. Rather, it concerns whether the law provides sufficient safeguards for reporting that requires the collection and publication of personal information in the public interest.

What do legal experts say about press freedom?

The debate has produced differing assessments of whether journalism needs a separate exemption under the legislation.Advocate Adhitya Srinivasan believes the constitutional protection enjoyed by the press and the nature of the legislation could allow competing interests to be resolved through judicial scrutiny.“Freedom of press is so well-entrenched in our Constitution, so I really don’t think that the DPDP Act is going to materially impair investigative journalism,” Srinivasan said.He argued that Parliament had deliberately chosen a framework that articulates core principles without becoming overly prescriptive, leaving courts to undertake a balancing exercise when competing rights come into conflict.“This is hardly unusual, and far from being problematic, it is just a deliberate choice that Parliament has made,” he said.Srinivasan also pointed out that the legislation was not necessarily intended to restrict reporting. In his assessment, its objective could instead be to discourage practices such as doxxing and voyeurism.On the question of whether journalism requires an explicit exemption, he said: “I don’t think journalism needs an explicit exemption under the DPDP Act, but I suppose it wouldn’t hurt.”Advocate Mayank Arora, however, takes a more cautionary view, arguing that the absence of an express exemption could create significant difficulties for public-interest reporting.“I think yes, there is a strong likelihood that The Digital Personal Data Protection Act, 2023, could affect investigative journalism because it does not expressly exempt public-interest reporting from its consent requirements,” Arora said.He argued that journalists investigating allegations involving public officials may need to examine financial records, ownership details and private communications, and seeking consent from the individuals concerned could defeat the purpose of an investigation.Arora also warned that the law could produce a chilling effect, with journalists avoiding investigations into powerful individuals because of potential complaints, litigation costs and regulatory uncertainty.“The real danger here is not necessarily direct censorship, but a chilling effect on journalists,” he said.He maintained that an explicit exemption would provide stronger protection for legitimate investigative reporting while preserving safeguards against misuse of personal information.

RTI amendment: Why is Section 44(3) under scrutiny?

Another major point of contention is Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information Act, 2005.The earlier provision allowed public authorities to withhold personal information if it had no relationship to public activity or interest, or if its disclosure would cause an unwarranted invasion of privacy. However, it also allowed disclosure where a larger public interest justified making the information available.The amendment changes the wording of the exemption to cover information relating to personal information.Critics argue that the revised provision removes the earlier balancing mechanism between privacy and public interest, potentially making it more difficult for citizens to access information held by public authorities.The implications could extend to information concerning public officials, government decisions and the functioning of public institutions.For example, a journalist or an RTI applicant seeking information about the assets or official dealings of a public servant may encounter questions over whether the information falls within the personal information exemption.The central concern is that information could be withheld even when its disclosure has a legitimate bearing on public accountability.The government, however, has defended the amendment.In a PIB release issued on August 20, 2025, MeitY said the DPDP Act sought to recognise both an individual’s right to protect personal information and the need to process such information for lawful purposes.The ministry maintained that the amendment to the RTI Act was intended to balance the right to privacy with the right to information.Srinivasan believes concerns over the amendment may be overstated.“This suggestion that the RTI amendment weakens the right to access public information is in my view a red herring,” he said.He argued that the amendment does not prevent public authorities from disclosing personal information when the public interest in disclosure outweighs the harm.“By way of the substitution, personal information cannot be given to citizens as a matter of right. This does not, however, stop a public authority from allowing access to information (even personal information) if the public interest in disclosure outweighs the harm,” he said.Arora, on the other hand, believes the amendment substantially weakens the express public-interest protection previously available under the RTI Act.He pointed to cases involving recruitment records or alleged favouritism in government departments, where information could reveal corruption involving public money but may now be denied under the broader personal-information exemption.He also questioned why the earlier public-interest qualification was removed if authorities could continue to disclose information after weighing competing interests.

Could government powers affect journalistic sources?

The DNPA has also questioned provisions that give the government powers to seek information and restrict access to certain information.Section 36 empowers the Centre to call for information from Data Fiduciaries or intermediaries for specified purposes. The association has argued that the provision could affect the confidentiality of information held by news organisations.Journalists often depend on confidential sources, including whistleblowers and individuals who share information about alleged corruption, corporate wrongdoing or administrative irregularities.The possibility of sensitive information being sought by the government, the association argues, could discourage people from sharing information with journalists.This could have implications for investigative reporting, particularly when sources fear that their identities or communications may be exposed.Another provision under challenge is Section 37, which empowers the government to direct the blocking of access to information in specified circumstances.The association has questioned the scope of these powers and the safeguards available against their possible misuse.The broader concern is whether provisions intended to protect personal information could also create restrictions on the circulation of news and information.

Is the Data Protection Board independent?

The composition and functioning of the Data Protection Board of India have also come under scrutiny.The Board is expected to serve as the principal adjudicatory institution under the law. It will examine complaints, conduct inquiries and determine penalties against organisations that fail to comply with the framework.However, questions have been raised about the government’s role in the appointment of its members and the extent of its institutional independence.Under the notified rules, the selection process for the chairperson and members involves a search-cum-selection committee comprising senior government officials and government-nominated experts.The DNPA has challenged provisions concerning the Board, including Sections 18 and 19 of the Act and Rule 17 of the Rules.The concern is that an institution responsible for adjudicating disputes involving both private organisations and government departments should have adequate independence from the executive.Government agencies themselves process large amounts of personal information while implementing welfare schemes and providing public services. This makes the independence of the regulatory institution an important aspect of the data protection framework.

What has the government said?

The Centre has defended the legislation, maintaining that its primary objective is to protect citizens’ privacy and regulate organisations that collect and process personal information.Union electronics and information technology Minister Ashwini Vaishnaw has rejected suggestions that the law is intended to restrict journalistic freedom.On October 29, Vaishnaw said that freedom of the press was constitutionally guaranteed and that the government had no intention of affecting it.He also indicated that editors and media professionals could engage with the government to discuss their concerns.The government’s position is that the obligations under the legislation are primarily directed at Data Fiduciaries, such as banks, telecom companies and insurance providers, rather than journalists as a category.In a report published on October 31, The Times of India quoted senior MeitY officials as saying that the Centre was open to changing the rules and, if necessary, the law itself to ensure that the framework did not become an impediment for journalists and media organisations.Officials maintained that journalists and media houses do not fall within the category of Data Fiduciaries merely because they undertake reporting activities.They also indicated that exemptions could be incorporated into the rules to address concerns over journalistic work.Arora, however, believes government assurances alone cannot provide adequate protection.“Assurances must be backed by statutory provisions and enforceable laws and rules,” he said.He argued that an express exemption would offer a stronger legal foundation for independent journalists and digital publishers, rather than leaving the matter dependent on administrative assurances.

When will the law come into effect fully?

Although the DPDP Rules were notified in November 2025, the government has provided a phased implementation timeline to allow organisations to prepare for compliance.According to the enforcement timeline published by MeitY, certain institutional provisions, including those relating to the establishment of the Data Protection Board, came into force in November 2025.The amendment to Section 8(1)(j) of the RTI Act also came into effect as part of the initial phase.Other provisions, including the main obligations governing the processing of personal data, are scheduled to come into force 18 months after the November 13, 2025 notification. This places the key implementation date at May 13, 2027.The transition period is intended to give organisations time to establish consent mechanisms, strengthen security systems and put procedures in place to comply with the law.For news publishers, however, the legal uncertainty is likely to remain until the Supreme Court examines the challenge and the government clarifies whether additional exemptions will be introduced.

What happens next?

The Supreme Court issued notice to the Centre on October 27 after hearing the DNPA’s challenge. A bench comprising Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V Mohana agreed to examine the petition and listed the matter for November 17.The court did not grant an interim stay on the challenged provisions without hearing the government’s response.The Centre will now have to respond to the questions raised by the association, including the absence of a specific journalistic exemption, the amendment to the RTI Act and the powers granted to the government under the legislation.The government has also indicated that it is willing to consider changes if required.The outcome could have implications beyond news organisations. It may help determine how privacy rights, access to public information and the freedom to investigate are balanced under India’s digital regulatory framework.

The larger question: Can privacy and public interest coexist?

The debate over the DPDP Act reflects a difficult balance between two important principles.On one hand, individuals should have control over their personal information. Financial details, health records, identity documents and private communications should not be freely collected, shared or used without appropriate safeguards.On the other, access to information and the ability to investigate matters of public interest are essential to accountability. Journalism and the RTI framework often require the examination of information that may be personal in nature but has wider public significance.