SRI VIJAYA PURAM | OCTOBER 29, 2026 | DWEEP TULIKA | NATIONAL NEWS

India’s Digital Personal Data Protection (DPDP) Act, 2023, is facing a legal challenge over its potential implications for investigative journalism, press freedom and public access to information, as news publishers question whether the law adequately protects public-interest reporting.

The Supreme Court on October 27, 2026, sought the Union government’s response to a petition filed by the Digital News Publishers Association (DNPA), which represents 21 digital news publishers. The association has argued that the absence of a specific journalistic exemption could impede investigations, create difficulties for newsrooms and compromise the confidentiality of sources.

The next hearing has been scheduled for November 17. The legal challenge remains pending, and the court’s notice does not amount to a finding that the law is unconstitutional.

Why Are News Publishers Challenging the Law?

The DPDP Act establishes a framework for processing digital personal data and protecting individuals’ privacy. However, the DNPA argues that the law and its accompanying rules do not provide a sufficiently clear exemption for journalistic activities.

Investigative journalism often requires reporters to collect, verify and publish information about individuals without obtaining their prior consent. Such reporting can involve public contracts, financial transactions, conflicts of interest, alleged corruption and the conduct of public officials.

The DNPA has argued that applying data-protection obligations to journalistic work without adequate safeguards could expose publishers to legal uncertainty and make time-sensitive investigations more difficult.

The potential impact will depend on the provisions in force, the nature of the data and the circumstances of each case. The law should not be interpreted as automatically requiring consent for every fact published by a journalist.

Concerns About Government Powers and Confidential Sources

The legal challenge also raises concerns about government information-gathering powers and the potential protection of confidential journalistic sources.

Section 36 of the Act provides the Central Government with powers to call for information from specified data fiduciaries or intermediaries in circumstances provided by law. Critics have questioned whether sufficient safeguards exist to prevent such powers from affecting confidential sources or sensitive journalistic material.

The DNPA has also challenged aspects of the law’s institutional and enforcement framework. The Act provides for substantial financial penalties for specified violations, raising concerns among critics about the compliance burden and potential legal exposure faced by smaller and independent news organisations.

These are arguments raised in the legal challenge, not findings that the law has already led to censorship or the exposure of confidential sources.

How Could the Law Affect the Right to Information?

A separate point of concern is Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005, concerning exemptions for personal information.

Critics argue that the change could affect journalists and citizens seeking information relevant to public accountability, including records relating to government appointments, public expenditure, conflicts of interest and alleged misconduct.

The practical effect will depend on the applicable legal provisions and the circumstances of each request. The amendment does not mean that every request involving personal information must automatically be rejected.

Importantly, the RTI amendment has a different commencement timeline from most of the DPDP Act’s substantive data-processing provisions. Section 44(3) came into force in November 2025, while most substantive provisions are scheduled to commence in May 2027.

Government Says Press Freedom Will Be Protected

On October 28, Information Technology Minister Ashwini Vaishnaw said the government was willing to hear concerns raised by media organisations and maintained that constitutionally protected journalistic freedom would not be undermined.

According to Reuters reporting, the minister invited media representatives to submit their suggestions. His position was that data protection and press freedom should be capable of operating alongside one another.

The DNPA, however, argues that clear legal safeguards are needed to ensure that legitimate public-interest reporting is not unnecessarily restricted.

The disagreement highlights a central question: how can the law protect individuals against misuse of their personal information while preserving the ability of journalists to investigate matters of public concern?

What Is the Implementation Timeline?

The DPDP Act received presidential assent in August 2023. The Digital Personal Data Protection Rules, 2025, were notified in November 2025, with a phased implementation schedule.

Under the notified timeline, most substantive provisions of the Act and the principal compliance requirements under the Rules are scheduled to come into force 18 months after notification, on May 13, 2027. Some provisions took effect earlier, so it would be inaccurate to describe the entire framework as inactive until that date.

The Supreme Court proceedings could be significant in determining how the challenged provisions are interpreted and whether additional safeguards are required. The outcome remains unresolved.

For news organisations, the period before the main implementation date offers an opportunity to review data-handling practices, assess compliance requirements and seek legal clarity on public-interest reporting.

The Balance Between Privacy and the Public’s Right to Know

Personal data can be misused, and individuals need effective protection against unlawful collection and disclosure. At the same time, investigative journalism often depends on examining information that powerful individuals or institutions may prefer to keep undisclosed.

The absence of a specific journalistic exemption, the amendment to the RTI Act and concerns about government information-gathering powers have placed these competing interests at the centre of the debate.

Whether the framework will create a chilling effect on investigative reporting will depend on its implementation, judicial interpretation and the safeguards ultimately available to journalists and publishers.

As India approaches the scheduled implementation of most substantive provisions in 2027, the Supreme Court’s consideration of the DNPA challenge will be closely watched by media organisations, civil society groups and those concerned with transparency in public administration.

The central question is whether India can strengthen personal-data protection without unnecessarily obstructing journalism that scrutinises public power and serves the public interest.

Sources: Digital Personal Data Protection Act, 2023; Digital Personal Data Protection Rules, 2025; India Code commencement notification dated November 13, 2025; reporting by Business Standard, The Indian Express and Reuters on the DNPA legal challenge and the government’s response.

— Dweep Tulika News Desk