Privacy Or Press Freedom? Inside The Legal Fight Over India’s Data Protection Law

A group of 21 Indian news publishers on Monday, challenged the Centre’s Digital Personal Data Protection (DPDP) Act, 2023, in the Supreme Court, arguing that the law could restrict investigative journalism and expose confidential sources. The case is scheduled to come up for hearing on Tuesday.

The publishers include Network18, owned by Mukesh Ambani, NDTV, part of Gautam Adani’s media interests, The Indian Express and Times Internet, which is part of the Times of India group. The October 6 petition, filed through the Digital News Publishers Association (DNPA), seeks to strike down contentious provisions that the group says could interfere with the collection and publication of information in the public interest.

The challenge centres on the conflict between protecting individuals’ personal data and preserving the ability of journalists to investigate alleged wrongdoing without alerting those under scrutiny.

Consent And Notice

Sections 5 and 6 of the Act deal with notice and consent when personal data is processed. Section 5 requires data fiduciaries to inform individuals about the processing of their data, while Section 6 establishes requirements for valid consent and its withdrawal.

The DNPA argues that applying these obligations to journalistic investigations could require reporters to notify individuals whose personal data they seek to collect and obtain their consent. Such a requirement, the association contends, could alert the subject of an investigation, potentially allowing evidence to be destroyed or witnesses to be intimidated.

The Act does not expressly state that every journalistic investigation must obtain prior consent from its subject. The publishers’ concern is that, without an explicit journalism-specific exemption, the obligations could nevertheless create legal uncertainty and compliance risks for newsrooms.

The Right To Erasure

Section 12 provides individuals with rights concerning the correction, completion, updating and erasure of their personal data, subject to the Act’s conditions.

Publishers fear that individuals could invoke these rights to demand changes to or removal of information carried in news reports, including investigative stories. They argue that the legislation does not clearly establish how such requests should be balanced against the public interest in retaining accurate reporting.

The right to erasure is not an unconditional entitlement to have any news report deleted. Its application would depend on the relevant legal provisions and circumstances. The publishers’ objection is that the law does not provide a sufficiently explicit safeguard for journalism.

Concerns Over Sources

The petition also challenges government powers to demand information from organisations handling personal data. The DNPA argues that these provisions could compel news organisations to disclose material that identifies confidential sources, potentially discouraging whistleblowers from sharing information about corruption, corporate wrongdoing or electoral malpractice.

The association has also objected to exemptions available to the state in specified circumstances, arguing that journalism has not received equivalent explicit protection.

The publishers said they received assurances during an August meeting with the government that the law would protect press freedom. However, they remain concerned that no written exemption for journalists has been provided. The Information Technology Ministry did not respond to Reuters’ request for comment on the lawsuit.

What Happens Next?

The Centre notified the phased implementation of the DPDP Act in November 2025. Under the notification, most substantive provisions, including Sections 5, 6 and 12, are scheduled to take effect 18 months after publication, on May 13, 2027. The government therefore has time to clarify the law’s application before those provisions come into force.

The Supreme Court hearing will bring the dispute over privacy protections and press freedom before the judiciary. The central question raised by the publishers is whether the law adequately safeguards investigative reporting while establishing obligations for the processing of personal data.