Twenty-one major Indian news publishers are asking the Supreme Court to strike down parts of the country’s Digital Personal Data Protection framework, warning that a law designed to protect citizens’ privacy could unintentionally make investigative journalism far more difficult — and potentially expose confidential sources.
India’s privacy law has collided with the press
A law intended to give citizens greater control over their personal information has become the center of a major constitutional battle over the future of journalism in India.
Twenty-one news publishers, represented by the Digital News Publishers Association (DNPA), have approached India’s Supreme Court challenging provisions of the Digital Personal Data Protection Act, 2023, and the accompanying DPDP Rules, 2025.
The publishers include major media organizations such as The Hindu, Indian Express, India Today, Times Group, Zee, NDTV and Network18, among others. (Reuters)
Their central complaint is remarkably simple:
The law protects personal data — but it does not expressly protect journalism.
That distinction matters enormously.
A retailer asking for a customer’s telephone number is fundamentally different from an investigative reporter collecting documents about corruption, interviewing whistleblowers and assembling evidence about a powerful individual.
Yet the publishers argue that the DPDP framework does not adequately recognize that difference.
And that is where the potential red flags begin.
1. The biggest red flag: There is no explicit journalism exemption
The most significant issue raised by the publishers is the absence of a specific exemption for journalistic activity.
Earlier versions of India’s proposed data-protection legislation contained protections for journalism. The 2018, 2019 and 2021 versions included journalistic exemptions, but those protections disappeared from the framework that eventually became the 2023 Act. (Live Law)
The current law contains exemptions for areas such as legal claims, judicial functions, criminal investigations and certain research and statistical activities.
But journalism does not receive an equivalent blanket carve-out.
That creates a potentially dangerous gap.
Investigative journalism routinely involves collecting personal information without asking the subject for permission.
A reporter investigating alleged corruption cannot realistically send the target an email saying:
“We are investigating allegations concerning you. Please consent to our processing of your personal data.”
That would defeat the purpose of the investigation.
The DNPA argues that requiring consent from the subject of an investigation could allow that person to destroy evidence, intimidate witnesses or otherwise interfere with the investigation before publication. (Reuters)
In other words, privacy protection could become a form of pre-publication interference.
2. Consent could become a form of pre-censorship
The second red flag is the role of consent.
The DPDP framework generally establishes consent as a major legal basis for processing personal data, alongside specified “legitimate uses.”
The problem for journalism is that investigative reporting frequently begins precisely where consent ends.
A journalist investigating a politician’s business dealings, a corporation’s financial records, a police operation or alleged abuse of public authority may need to process personal information without the subject knowing that an investigation is underway.
The DNPA therefore argues that applying ordinary consent rules to journalism could create what its lawyers described in court as a form of pre-censorship. (The Financial Express)
The issue isn’t simply whether a newspaper can publish.
It is whether the reporter can investigate in the first place.
That distinction is critical.
3. The “right to erase” could collide with the public record
Another contentious feature is the individual’s ability to seek deletion of personal data.
The principle behind data deletion is understandable.
People should not necessarily have embarrassing, irrelevant or outdated personal information permanently circulating online.
But journalism has a different mission.
A newspaper’s archive is not merely a database of personal information. It is part of the historical record.
Consider an investigative story published five years ago about corruption involving a public official.
If the person later argues that personal information contained in the report should be deleted, what happens?
Does the newspaper remove the story?
Redact it?
Rewrite history?
Or defend the public interest in retaining the material?
The DNPA says the absence of a clear journalistic and public-interest safeguard could create pressure on publishers to unpublish or substantially alter legitimate reporting. (Reuters)
For journalism, that is not an abstract concern.
Archives are evidence.
They allow citizens to trace how institutions, governments and powerful individuals behaved over time.
4. Confidential sources could be placed at risk
Perhaps the most serious concern involves confidential sources.
Investigative journalism depends on people willing to provide information that powerful institutions would rather keep hidden.
Whistleblowers may provide documents concerning corruption, corporate wrongdoing, abuse of authority or electoral misconduct.
Their willingness to speak often depends on one fundamental promise:
The journalist will protect their identity.
The publishers argue that government powers under the data-protection framework could potentially create circumstances in which news organizations are required to provide information to authorities.
One disputed provision allows the government to require a data fiduciary to furnish information, while the accompanying rules permit restrictions on revealing that such a request was made. (Communications Today)
For a newspaper, the question becomes:
What happens when the government asks for information held by the newsroom?
Could that information reveal a source?
Could it expose communications between a reporter and an informant?
Could the possibility of such demands discourage whistleblowers from contacting journalists in the first place?
The DNPA says the law needs stronger safeguards against precisely that scenario.
5. The government has its own exemptions
This has become one of the politically sensitive aspects of the dispute.
The publishers argue that the state receives significant exemptions under the framework while journalism does not receive an equivalent protection.
The law allows exemptions in areas involving matters such as sovereignty, security, public order and certain state functions. (MeitY)
The media industry’s argument is therefore essentially one of symmetry:
If the government can receive carefully defined exemptions because certain public functions require access to information, why shouldn’t journalism receive a narrowly tailored exemption when processing information is necessary to expose wrongdoing and inform the public?
That is one of the constitutional questions now confronting the Supreme Court.
6. The penalties could be enormous
There is also a financial dimension.
The DPDP framework provides for substantial penalties for violations, with maximum penalties reaching ₹250 crore — roughly 2.5 billion Indian rupees. (Communications Today)
For India’s largest media companies, such penalties would obviously be serious.
For smaller independent publications, investigative outlets and digital-native newsrooms, the consequences could potentially be existential.
This is where regulation can have an effect even without directly censoring an article.
A government does not necessarily have to ban a story.
If the cost of publishing a controversial investigation becomes potentially catastrophic, editors may simply decide not to publish.
That is the concept of a chilling effect.
7. Government blocking powers are another point of concern
The publishers have also challenged provisions relating to government powers over organizations that fail to comply with the framework.
Reuters reported that publishers are concerned that repeated penalties could ultimately create circumstances in which access to an organization’s content could be restricted in the “interests of the general public.” (Reuters)
The phrase itself is important.
Broad standards can create uncertainty.
A narrowly defined legal test tells an organization what conduct is prohibited.
A broad public-interest standard gives regulators considerably more discretion.
For media organizations, that distinction matters because journalism frequently deals with subjects that are politically controversial precisely because they concern powerful people or institutions.
8. The Right to Information is also caught in the dispute
The controversy goes beyond journalism.
The publishers are also challenging changes involving India’s Right to Information Act.
The data-protection legislation amended the RTI framework’s treatment of personal information, raising concerns among publishers that public officials could become harder to scrutinize through information requests.
The DNPA argues that this could weaken an important tool used by journalists and citizens to investigate government activity. (The Financial Express)
The government, however, has maintained that public-interest disclosure remains possible.
That creates another unresolved question:
How should privacy be balanced against the public’s right to know what its government is doing?
What is the Indian government saying?
The government’s response has so far been notably different from the alarm expressed by publishers.
Electronics and Information Technology Minister Ashwini Vaishnaw has rejected the suggestion that the law is intended to restrict journalism.
His position is that India’s Constitution already guarantees journalistic freedom and that the privacy law does not remove that constitutional protection. (Reuters)
Vaishnaw has also invited editors and media professionals to discuss their concerns with the government.
The minister said the government is willing to consider suggestions and act if changes are necessary. Government sources have indicated that an explicit statutory safeguard for journalism could potentially be considered. (The Economic Times)
The government’s argument therefore rests on two principles:
Privacy is a fundamental right.
And:
Press freedom is also constitutionally protected.
The challenge is determining where those two rights intersect.
The government’s strongest argument: privacy is a real right
The media industry’s criticism should not obscure the reason India enacted the law.
Digital platforms, technology companies, financial institutions, advertisers and other organizations now process enormous quantities of personal information.
India’s Supreme Court recognized privacy as a fundamental right in its landmark 2017 Puttaswamy judgment.
The DPDP Act is partly an attempt to create a modern statutory framework around that principle.
The government’s argument is therefore not simply:
“We want more regulatory power.”
It is also:
Citizens deserve protection against the uncontrolled collection and exploitation of their personal information.
That principle is legitimate.
The question is whether journalism can be treated like ordinary commercial data processing.
The publishers say it cannot.
The real question: Can privacy and press freedom coexist?
The Supreme Court now faces a difficult balancing exercise.
There are legitimate reasons to protect personal data.
There are equally legitimate reasons to protect investigative journalism.
A journalist should not have unlimited authority to publish private information merely because the information was obtained digitally.
But a journalist investigating corruption cannot reasonably be required to obtain consent from the person allegedly involved before beginning the investigation.
The solution may therefore lie in a carefully constructed journalism exemption.
Such an exemption could protect processing of personal data when it is:
- undertaken for legitimate journalistic purposes;
- connected to matters of public interest;
- subject to professional or ethical standards;
- necessary for investigative reporting;
- protected by source-confidentiality rules; and
- balanced against legitimate privacy interests.
That would not give journalists unlimited immunity.
It would recognize that journalism has a different constitutional and democratic function from advertising, retail or social-media profiling.
Why this matters beyond India
This debate should not be viewed as an exclusively Indian controversy.
Across Africa, governments are introducing or strengthening data-protection regimes.
That is a positive development.
African citizens deserve protection from companies and institutions that collect, sell or exploit personal information without meaningful safeguards.
But African policymakers should also watch India’s dispute carefully.
A data-protection law that protects citizens’ privacy while unintentionally weakening investigative journalism could create a dangerous precedent.
The continent has a long history of journalists investigating corruption, resource extraction, political patronage, corporate misconduct and abuses of public authority.
In many African countries, investigative reporters depend on confidential sources precisely because those sources fear retaliation.
A future African data-protection regime should therefore answer a question before it becomes a crisis:
Can a journalist investigate a powerful person without first asking that person for permission to investigate them?
The answer should be carefully defined in law.
The Supreme Court becomes the next battleground
India’s Supreme Court has issued notice to the government and is expected to hear the matter again on November 17, 2026.
The court has not yet ruled that the challenged provisions are unconstitutional, nor has it granted the publishers the stay they sought. (The Financial Express)
Chief Justice of India Surya Kant has emphasized the need to balance privacy rights with press freedom and has invited the publishers to suggest safeguards against potential misuse. (The Financial Express)
That may ultimately be the heart of the case.
India does not necessarily have to choose between privacy and journalism.
It has to construct a legal framework capable of protecting both.
The bigger red flag
The most important lesson from the controversy may not be that data protection is inherently hostile to journalism.
It is that laws written for the digital economy can have consequences far beyond the technology sector.
A provision designed to stop corporations from misusing personal data can affect a reporter.
A deletion right designed to protect an individual can collide with a newspaper archive.
An information request designed to regulate companies can threaten source confidentiality.
A financial penalty designed to enforce compliance can become devastating for an independent newsroom.
And a broadly worded public-interest power can become a source of uncertainty for organizations whose job is to scrutinize power.
That is why the absence of a clear journalism exemption has become such a central issue.
The question before India is not simply:
“Who owns your data?”
It is also:
“Who has the right to investigate power?”
For democracy, the answer cannot be an afterthought.
PANAFRICAN.EMAIL ANALYSIS
India’s dispute offers a warning for every country building digital privacy legislation.
Protect the citizen. Protect the journalist. Protect the public record.
Those objectives do not have to contradict one another.
But if legislators fail to write the boundaries clearly, privacy law can become something it was never intended to be: a legal obstacle between the public and information about the people who exercise power.
The next chapter will be written in India’s Supreme Court.
And journalists across the Global South will be watching.
Sources: Reuters; Digital News Publishers Association court filings as reported by Indian media; Government of India/MeitY; Supreme Court proceedings. (Reuters)
Leave a Reply