Introduction
The expansion of digital technology has fundamentally altered the relationship between citizens, governments and information. Personal data has become an increasingly valuable resource, shaping everything from financial transactions and public service delivery to commercial decisions and administrative processes. Protecting this information against unauthorised access, exploitation and misuse is now an essential responsibility of the modern state.
India’s Digital Personal Data Protection (DPDP) Act, 2023, seeks to address this challenge precisely. It establishes a framework for the collection, processing and safeguarding of digital personal information, while recognising certain rights of individuals over their data.
Yet a significant constitutional question has emerged around the legislation: could a framework designed to protect individual privacy inadvertently restrict journalists’ ability to investigate matters of public importance?
This question has assumed particular significance following the legal challenge initiated by the Digital News Publishers Association (DNPA), which represents 21 prominent media organisations. The association has approached the Supreme Court, arguing that certain provisions of the legislation and its accompanying rules could make investigative reporting more difficult, compromise confidential sources and limit access to information essential for public accountability.
The controversy deserves attention beyond the media industry’s immediate interests. It touches on a fundamental principle of democratic governance: individuals’ right to privacy must coexist with society’s collective right to scrutinise the exercise of public power.
The challenge is to establish a legal framework in which neither objective obstructs the other.
The legitimate case for protecting personal information
There is little disagreement about the need for comprehensive data protection legislation in an increasingly connected society.
Individuals routinely share sensitive information with banks, healthcare providers, government departments, online platforms and commercial enterprises. Such information may include financial details, identity documents, addresses, health records and personal communications.
The accumulation of these records creates substantial risks. Data breaches can expose individuals to financial fraud and identity theft. Unregulated commercial practices can enable profiling and intrusive targeting. Government and private databases, if inadequately protected, can become sources of surveillance and misuse.
The DPDP Act seeks to create greater accountability among organisations handling such information. It identifies these organisations as Data Fiduciaries and the individuals whose information is processed as Data Principals.
The legislation sets out requirements for notice, consent, purpose of processing, data security, and individual rights. It also provides mechanisms for individuals to seek correction or erasure of personal information and withdraw consent, subject to applicable legal provisions.
The accompanying rules, notified in November 2025, provide for phased implementation of the framework.
These are important regulatory objectives. An individual’s personal information should not become freely available simply because it has entered a digital system.
However, data protection principles cannot be considered independently of the purpose for which information is collected and processed. The requirements governing a commercial enterprise seeking consumer information may not always suit a journalist investigating corruption or abuse of authority.
This distinction lies at the heart of the present controversy.
When the pursuit of truth encounters the requirement of consent
Investigative journalism rarely operates with the cooperation of those under examination. Its purpose is frequently to uncover information that powerful individuals or institutions would prefer to keep undisclosed.
An investigation into irregularities in government procurement, for instance, may require access to financial transactions, property records, corporate relationships and documents containing personal information. Reporting on possible conflicts of interest may similarly involve examining the private business associations of individuals holding public office.
In such circumstances, obtaining prior consent from the subjects of an investigation could defeat the purpose of the exercise. Advance disclosure may alert the individuals concerned, allow them to conceal evidence, or compromise witness confidentiality.
This is why the absence of a clearly defined journalistic exemption in the DPDP Act has become a central concern for media organisations.
Earlier drafts of India’s proposed data protection legislation, including those prepared in 2018, 2019 and 2021, contained provisions recognising journalistic activities. The final legislation does not provide a comparable specific exemption for journalism conducted in the public interest.
The distinction is not merely technical. It concerns journalists’ ability to gather information without following procedures that could compromise legitimate investigations.
The relevant consideration should be whether the information is necessary for a legitimate public-interest purpose and whether its collection and publication are proportionate to that purpose. Without such a distinction, the law could create uncertainty about the boundaries within which investigative reporting can operate.
The possibility of legal pressure and editorial self-restraint
Another concern is individuals’ rights over their personal data, particularly the right to withdraw consent and request erasure.
These provisions are intended to prevent organisations from retaining or using personal information without an appropriate legal basis. However, their interaction with published journalism and digital news archives raises difficult questions.
Imagine a newspaper publishing an investigation supported by documentary evidence concerning the business interests of a senior public functionary. The report may include details of property ownership or corporate associations that are relevant to the public’s understanding of a possible conflict of interest.
If the individual subsequently seeks deletion of the information, what protection would the publication have?
The law’s applicability would depend on the circumstances and how its provisions are interpreted. Nevertheless, publishers worry that the absence of an explicit journalistic safeguard could expose them to demands for removal, legal complaints, and prolonged disputes.
The prospect of expensive litigation can influence editorial decisions long before a dispute reaches the judicial system. Editors could consequently become more cautious about undertaking investigations involving influential individuals, sensitive financial matters or public institutions.
For a democracy, this matters. The freedom to publish matters only when journalists can also gather and verify information without unreasonable legal impediments.
Confidential sources: The invisible foundation of investigative reporting
Many significant public-interest disclosures originate from people working within the institutions they expose. Government employees, corporate executives, financial professionals and other insiders may possess information about activities that would otherwise remain concealed. Their willingness to disclose such information often depends on the assurance that their identities will remain protected.
The relationship between journalists and confidential sources is therefore central to investigative reporting. The DNPA has raised concerns about Section 36 of the DPDP Act, which empowers the Central Government to require information from Data Fiduciaries and intermediaries for specified purposes.
This concern deserves careful consideration.
A whistleblower who provides evidence of corruption or corporate wrongdoing may face professional retaliation, harassment or other adverse consequences if identified.
The resulting loss would extend beyond individual news organisations. It could deprive the public of information necessary to understand administrative failures, financial irregularities and institutional misconduct.
Section 37 has also attracted scrutiny because it provides powers to restrict public access to specified information in certain circumstances. Petitioners have questioned whether sufficient safeguards exist to prevent these provisions from affecting the circulation of legitimate news and information.
There are, of course, circumstances in which the government must be able to protect sensitive information for legitimate reasons, including national security. But such powers require clearly defined boundaries, appropriate oversight and avenues for challenging their exercise.
The protection of confidential sources should not depend entirely on the discretion of the authorities seeking information.
The RTI dimension: A question of transparency in public administration
The implications of the DPDP legislation extend beyond newsroom operations. Its amendment to the Right to Information Act, 2005, has generated a separate but closely connected debate.
The RTI Act was an important milestone in India’s efforts to make public administration more transparent. It gave citizens a statutory means to obtain records from public authorities and examine how decisions were taken, and public resources were utilised.
Over the years, the mechanism has supported investigations into public expenditure, procurement, administrative appointments, government schemes and allegations of irregularities.
The earlier Section 8(1)(j) exempted certain personal information from disclosure but allowed consideration of the larger public interest. Information could be disclosed where the public interest in making it available outweighed the harm to the protected interest.
Section 44(3) of the DPDP Act amended this provision, removing the earlier express public-interest balancing mechanism for personal information.
This has raised concerns that records containing personal information could become harder to obtain, even when they have a legitimate bearing on public administration.
The issue requires a careful distinction between information that is genuinely private and information that is relevant to the performance of public responsibilities.
If the RTI mechanism becomes less effective in areas involving public accountability, the consequences could extend well beyond journalism. Researchers, civil society organisations and ordinary citizens would also face greater difficulty in examining the functioning of public institutions.
Transparency is not an administrative inconvenience. It is an essential instrument of accountable governance.
Constitutional freedoms and the responsibility of the state
The debate ultimately involves two important constitutional protections.
Article 19(1)(a) of the Constitution guarantees freedom of speech and expression. Although press freedom is not separately enumerated, the Supreme Court has consistently recognised it as an essential component of this fundamental right.
Article 21, meanwhile, protects life and personal liberty. In its landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right.
Both rights are central to the constitutional order. Neither is unlimited, and protecting one does not automatically justify restricting the other.
The constitutional challenge is therefore to determine whether restrictions imposed to pursue legitimate data protection objectives are proportionate and whether less restrictive safeguards could achieve the same purpose.
This distinction matters particularly in public-interest journalism.
Processing personal information for commercial profiling is fundamentally different from using it to establish whether a public official has misused authority or whether a corporation has engaged in wrongdoing.
What the international experience suggests
Other democracies have also confronted the challenge of reconciling privacy protection with freedom of expression.
The European Union’s General Data Protection Regulation recognises this relationship through Article 85, which requires member states to provide appropriate exemptions or derogations for journalistic purposes where necessary to reconcile data protection with freedom of expression and information.
The United Kingdom’s data protection framework also incorporates specific provisions relating to journalism and the public interest.
The United States follows a different approach. It lacks a comprehensive federal data protection statute equivalent to India’s DPDP Act. Instead, its framework combines sector-specific privacy legislation with constitutional protection for freedom of speech and the press under the First Amendment.
These arrangements reflect different constitutional and regulatory traditions. India need not replicate any particular international model.
Nevertheless, the underlying lesson remains relevant: data protection legislation must account for the distinctive role journalism plays in democratic societies.
A carefully designed exemption, accompanied by safeguards against irresponsible reporting, can protect both individual dignity and the public interest.
Finding a workable balance
The present dispute offers an opportunity to refine India’s data protection framework without compromising its fundamental objectives.
A clearly articulated exemption for legitimate journalistic activity would be an important starting point. Such protection need not extend to every activity undertaken by an organisation describing itself as a media entity. It should apply where information is processed for genuine public-interest reporting and where its use satisfies reasonable standards of necessity and proportionality.
Government powers to seek information or restrict its circulation should operate under clearly specified conditions, with reasoned decisions and effective review mechanisms.
Media organisations, for their part, must recognise that freedom of the press carries responsibilities. Public interest cannot be invoked to justify unnecessary intrusion into private lives, inaccurate reporting or the disclosure of sensitive information unrelated to the subject under investigation.
The objective should be a system that protects responsible journalism while leaving genuine violations of privacy open to legal remedy.
The Supreme Court’s opportunity to define the boundaries
The legal challenge initiated by the DNPA has brought these questions before the Supreme Court.
The Court has sought the Centre’s response and emphasised the need to reconcile citizens’ privacy rights with freedom of the press. It has also asked the publishers to suggest safeguards that could prevent misuse while protecting legitimate journalistic activity.
The next hearing is scheduled for 17 November 2026.
“The journalistic freedom is guaranteed by the Constitution of India. That freedom is absolutely available. There is not even an intention to affect the journalistic freedom…Data privacy does not mean you can’t break something into news.“
-Ashwini Vaishnaw
The government has maintained that the legislation does not intend to restrict investigative journalism. The Minister for Electronics and Information Technology has also expressed willingness to engage with media representatives and consider suggestions for addressing genuine concerns. Such engagement could help resolve uncertainty through legislative clarification and institutional safeguards.
The eventual outcome will have implications for the media, public administration and the wider architecture of democratic accountability.
Conclusion: Protecting privacy without obscuring public accountability
India’s transition to a data-driven society makes protecting personal information indispensable. Citizens must be assured that their identities, financial details and private communications will not be casually exploited by institutions entrusted with their data.
But a democratic society also depends on the ability to uncover information that reveals how authority is exercised, and public resources are managed. Journalism performs an essential function in this process.
Privacy protection should not be interpreted as a general entitlement to shield legitimate scrutiny. Equally, freedom of the press cannot be treated as permission to disregard individual dignity.
The task before lawmakers and the judiciary is to preserve the distinction between the private sphere that deserves protection and the conduct that legitimately invites public examination.
The right to privacy protects individuals from unwarranted intrusion. The freedom of the press protects society from the consequences of unwarranted secrecy. A constitutional democracy must have room for both.
