New Delhi, Nov. 8 -- The expansion of digital technology has fundamentally altered the relationship between citizens, governments and information. Personal data has become an increasingly valuable resource, shaping everything from financial transactions and public service delivery to commercial decisions and administrative processes. Protecting this information against unauthorised access, exploitation and misuse is now an essential responsibility of the modern state.
India's Digital Personal Data Protection (DPDP) Act, 2023, seeks to address this challenge. It establishes a framework for the collection, processing and safeguarding of digital personal information while recognising certain rights of individuals over their data. Yet, a significant constitutional question has emerged: could a framework designed to protect individual privacy inadvertently restrict journalists' ability to investigate matters of public importance?
This question has assumed particular significance following the legal challenge initiated by the Digital News Publishers Association (DNPA), which represents 21 prominent media organisations. The association has approached the Supreme Court, arguing that certain provisions of the legislation and its accompanying rules could make investigative reporting more difficult, compromise confidential sources and limit access to information essential for public accountability.
The controversy touches on a fundamental principle of democratic governance: individuals' right to privacy must coexist with society's collective right to scrutinise the exercise of public power.
The case for privacy
There is little disagreement about the need for comprehensive data protection legislation in an increasingly connected society. Individuals routinely share sensitive information with banks, healthcare providers, government departments, online platforms and commercial enterprises. Such information may include financial details, identity documents, addresses, health records and personal communications.
The accumulation of these records creates substantial risks. Data breaches can expose individuals to financial fraud and identity theft. Unregulated commercial practices can enable profiling and intrusive targeting, while government and private databases, if inadequately protected, can become sources of surveillance and misuse.
The DPDP Act seeks to create greater accountability among organisations handling such information. It identifies these organisations as Data Fiduciaries and the individuals whose information is processed as Data Principals. The legislation sets out requirements for notice, consent, purpose of processing, data security and individual rights. It also provides mechanisms for individuals to seek correction or erasure of personal information and withdraw consent, subject to applicable legal provisions. The accompanying rules, notified in November 2025, provide for phased implementation.
These are important regulatory objectives. However, the requirements governing a commercial enterprise seeking consumer information may not always suit a journalist investigating corruption or abuse of authority. This distinction lies at the heart of the controversy.
When consent obstructs investigation
Investigative journalism rarely operates with the cooperation of those under examination. Its purpose is frequently to uncover information that powerful individuals or institutions would prefer to keep undisclosed.
An investigation into irregularities in government procurement, for instance, may require access to financial transactions, property records, corporate relationships and documents containing personal information. Reporting on possible conflicts of interest may similarly involve examining the private business associations of individuals holding public office.
In such circumstances, obtaining prior consent from the subjects of an investigation could defeat the purpose of the exercise. Advance disclosure may alert the individuals concerned, allow them to conceal evidence or compromise witness confidentiality.
This is why the absence of a clearly defined journalistic exemption in the DPDP Act has become a central concern for media organisations. Earlier drafts of India's proposed data protection legislation, including those prepared in 2018, 2019 and 2021, contained provisions recognising journalistic activities. The final legislation does not provide a comparable specific exemption for journalism conducted in the public interest.
The relevant consideration should be whether the information is necessary for a legitimate public-interest purpose and whether its collection and publication are proportionate to that purpose. Without such a distinction, the law could create uncertainty about the boundaries within which investigative reporting can operate.
The threat of self-censorship
Another concern involves individuals' rights over their personal data, particularly the right to withdraw consent and request erasure. These provisions are intended to prevent organisations from retaining or using personal information without an appropriate legal basis. However, their interaction with published journalism and digital news archives raises difficult questions.
Consider a newspaper publishing an investigation supported by documentary evidence concerning the business interests of a senior public functionary. The report may include details of property ownership or corporate associations relevant to the public's understanding of a possible conflict of interest. If the individual subsequently seeks deletion of the information, what protection would the publication have?
The law's applicability would depend on the circumstances and how its provisions are interpreted. Nevertheless, publishers worry that the absence of an explicit journalistic safeguard could expose them to demands for removal, legal complaints and prolonged disputes.
The prospect of expensive litigation can influence editorial decisions long before a dispute reaches the judicial system. Editors could consequently become more cautious about undertaking investigations involving influential individuals, sensitive financial matters or public institutions. The freedom to publish matters only when journalists can also gather and verify information without unreasonable legal impediments.
Protecting confidential journalistic sources
Many significant public-interest disclosures originate from people working within the institutions they expose. Government employees, corporate executives, financial professionals and other insiders may possess information about activities that would otherwise remain concealed. Their willingness to disclose such information often depends on the assurance that their identities will remain protected.
The DNPA has raised concerns about Section 36 of the DPDP Act, which empowers the Central Government to require information from Data Fiduciaries and intermediaries for specified purposes.
A whistleblower who provides evidence of corruption or corporate wrongdoing may face professional retaliation, harassment or other adverse consequences if identified. The resulting loss would extend beyond individual news organisations, potentially depriving the public of information necessary to understand administrative failures, financial irregularities and institutional misconduct.
Section 37 has also attracted scrutiny because it provides powers to restrict public access to specified information in certain circumstances. Petitioners have questioned whether sufficient safeguards exist to prevent these provisions from affecting the circulation of legitimate news and information.
There are circumstances in which the government must protect sensitive information for legitimate reasons, including national security. But such powers require clearly defined boundaries, appropriate oversight and avenues for challenging their exercise. The protection of confidential sources should not depend entirely on the discretion of the authorities seeking information.
The RTI transparency question
The implications of the DPDP legislation extend beyond newsroom operations. Its amendment to the Right to Information (RTI) Act, 2005, has generated a separate but closely connected debate.
The RTI Act was an important milestone in India's efforts to make public administration more transparent. It gave citizens a statutory means to obtain records from public authorities and examine how decisions were taken and public resources were utilised. Over the years, the mechanism has supported investigations into public expenditure, procurement, administrative appointments, government schemes and allegations of irregularities.
The earlier Section 8(1)(j) exempted certain personal information from disclosure but allowed consideration of the larger public interest. Information could be disclosed where the public interest in making it available outweighed the harm to the protected interest.
Section 44(3) of the DPDP Act amended this provision, removing the earlier express public-interest balancing mechanism for personal information. This has raised concerns that records containing personal information could become harder to obtain, even when they have a legitimate bearing on public administration.
The issue requires a careful distinction between information that is genuinely private and information relevant to the performance of public responsibilities. If the RTI mechanism becomes less effective in areas involving public accountability, researchers, civil society organisations and ordinary citizens could also face greater difficulty in examining public institutions.
Transparency is not an administrative inconvenience. It is an essential instrument of accountable governance.
Two fundamental constitutional rights
The debate ultimately involves two important constitutional protections.
Article 19(1)(a) of the Constitution guarantees freedom of speech and expression. Although press freedom is not separately enumerated, the Supreme Court has consistently recognised it as an essential component of this fundamental right.
Article 21, meanwhile, protects life and personal liberty. In its landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right.
Both rights are central to the constitutional order. Neither is unlimited, and protecting one does not automatically justify restricting the other. The constitutional challenge is to determine whether restrictions imposed to pursue legitimate data protection objectives are proportionate and whether less restrictive safeguards could achieve the same purpose.
Processing personal information for commercial profiling is fundamentally different from using it to establish whether a public official has misused authority or a corporation has engaged in wrongdoing. A framework that fails to recognise this difference risks treating substantially different activities as identical.
The state has a responsibility not only to protect citizens from the misuse of personal information but also to preserve the constitutional conditions under which citizens can question the exercise of power.
Lessons from other democracies
Other democracies have also confronted the challenge of reconciling privacy protection with freedom of expression.
The European Union's General Data Protection Regulation recognises this relationship through Article 85, which requires member states to provide appropriate exemptions or derogations for journalistic purposes where necessary to reconcile data protection with freedom of expression and information.
The United Kingdom's data protection framework also incorporates specific provisions relating to journalism and the public interest.
The United States follows a different approach. It lacks a comprehensive federal data protection statute equivalent to India's DPDP Act. Instead, its framework combines sector-specific privacy legislation with constitutional protection for freedom of speech and the press under the First Amendment.
These arrangements reflect different constitutional and regulatory traditions. India need not replicate any particular international model. Nevertheless, the underlying lesson remains relevant: data protection legislation must account for the distinctive role journalism plays in democratic societies.
A carefully designed exemption, accompanied by safeguards against irresponsible reporting, can protect both individual dignity and the public interest.
Finding a workable balance
The present dispute offers an opportunity to refine India's data protection framework without compromising its fundamental objectives.
A clearly articulated exemption for legitimate journalistic activity would be an important starting point. Such protection need not extend to every activity undertaken by an organisation describing itself as a media entity. It should apply where information is processed for genuine public-interest reporting and where its use satisfies reasonable standards of necessity and proportionality.
Government powers to seek information or restrict its circulation should operate under clearly specified conditions, with reasoned decisions and effective review mechanisms.
Media organisations, for their part, must recognise that freedom of the press carries responsibilities. Public interest cannot be invoked to justify unnecessary intrusion into private lives, inaccurate reporting or the disclosure of sensitive information unrelated to the subject under investigation.
The objective should be a system that protects responsible journalism while leaving genuine violations of privacy open to legal remedy.
The Supreme Court's opportunity
The legal challenge initiated by the DNPA has brought these questions before the Supreme Court. The Court has sought the Centre's response and emphasised the need to reconcile citizens' privacy rights with freedom of the press. It has also asked the publishers to suggest safeguards that could prevent misuse while protecting legitimate journalistic activity.
The next hearing is scheduled for November 17, 2026.
The government has maintained that the legislation does not intend to restrict investigative journalism. The Minister for Electronics and Information Technology has also expressed willingness to engage with media representatives and consider suggestions for addressing genuine concerns.
Such engagement could help resolve uncertainty through legislative clarification and institutional safeguards. The eventual outcome will have implications for the media, public administration and the wider architecture of democratic accountability.
India's transition to a data-driven society makes protecting personal information indispensable. Citizens must be assured that their identities, financial details and private communications will not be casually exploited by institutions entrusted with their data.
But a democratic society also depends on the ability to uncover information that reveals how authority is exercised and public resources are managed. Journalism performs an essential function in this process.
Privacy protection should not be interpreted as a general entitlement to shield legitimate scrutiny. Equally, freedom of the press cannot be treated as permission to disregard individual dignity.
The task before lawmakers and the judiciary is to preserve the distinction between the private sphere that deserves protection and the conduct that legitimately invites public examination.
The right to privacy protects individuals from unwarranted intrusion. The freedom of the press protects society from the consequences of unwarranted secrecy. A constitutional democracy must have room for both.
Published by HT Digital Content Services with permission from Millennium Post.