Why India's new privacy law has newsrooms worried

Synopsis

On October 6, 2026, the Digital News Publishers Association (DNPA), representing 21 of India’s biggest digital news publishers, moved the Supreme Court against the provisions of the Digital Personal Data Protection (DPDP) Act, 2023, and the rules notified under it on November 14, 2025.

The coalition includes Network18, owned by Mukesh Ambani’s Reliance group; Gautam Adani’s NDTV; The Indian Express; Times Internet; The Hindu; Zee Media; ABP; Malayala Manorama; Mathrubhumi; Amar Ujala; Eenadu Television; and the India Today Group. Their petition runs to 698 pages.

On October 27, 2026, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana issued a notice to the Centre. Still, it declined to stay the contested provisions without hearing the government’s response. The next hearing is scheduled for November 17, 2026.

The Law and its Blind Spot

India’s DPDP Act emerged from a legitimate concern. As citizens conduct more of their lives online, technology companies, financial institutions, commercial platforms and government agencies collect enormous quantities of personal information. The Supreme Court’s landmark K.S. Puttaswamy judgment of 2017 recognised privacy as a Fundamental Right. The 2023 legislation was intended to give that right practical protection in the digital economy.

Its central principle is straightforward. Organisations collecting or processing identifiable personal information, from social media platforms to e-commerce apps, must generally obtain informed consent, disclose the purpose for which the data is used, secure it against breaches, and allow individuals to exercise certain rights over it. The law calls such an entity a data fiduciary. The rights include withdrawing consent at any time and seeking correction or erasure of personal data. The Act also permits processing without consent for specified legitimate uses.

The obligations extend beyond technology giants such as Google and Meta. They can apply to any entity processing digital personal data, including information originally collected on paper and subsequently digitised. That potentially brings news publishers within its ambit.

The Law and its Blind Spot

India’s DPDP Act emerged from a legitimate concern. As citizens conduct more of their lives online, technology companies, financial institutions, commercial platforms and government agencies collect enormous quantities of personal information. The Supreme Court’s landmark K.S. Puttaswamy judgment of 2017 recognised privacy as a Fundamental Right. The 2023 legislation was intended to give that right practical protection in the digital economy.

Its central principle is straightforward. Organisations collecting or processing identifiable personal information, from social media platforms to e-commerce apps, must generally obtain informed consent, disclose the purpose for which the data is used, secure it against breaches, and allow individuals to exercise certain rights over it. The law calls such an entity a data fiduciary. The rights include withdrawing consent at any time and seeking correction or erasure of personal data. The Act also permits processing without consent for specified legitimate uses.

The obligations extend beyond technology giants such as Google and Meta. They can apply to any entity processing digital personal data, including information originally collected on paper and subsequently digitised. That potentially brings news publishers within its ambit.

Consent as a Potential Veto

Sections 4 to 6 establish consent as the principal basis for processing personal data, subject to specified exceptions. A shopping platform can seek consent when a user signs up. An investigation cannot ask its subject’s permission. The DNPA argues that, without a journalism-specific exemption, a reporter could be required to notify the very person under investigation and obtain consent to process relevant information. That would defeat the purpose of an investigation. Advance notice could give its subject time to destroy evidence, influence witnesses or obstruct further inquiries.

At the October 27 hearing, Divan put the publishers’ case in precisely 11 words. “We have to ask your permission if we report on you,” she told the bench. She described the implications as “a complete regime of pre-censorship”. Journalism, she argued, cannot function if reporting depends on permission from the people being scrutinised.

The second concern involves the right to erasure. Section 12 permits individuals to seek deletion of personal data processed based on their consent, subject to legal and other statutory limitations. Section 8 also imposes obligations concerning the retention and deletion of data. The subject of a story can withdraw consent at any time and demand that their data be erased, and the law offers no public-interest test against that demand.

Sources Under Scrutiny

Perhaps the most serious concern is the government’s power to demand information. Section 36 authorises the Centre to require the Data Protection Board, data fiduciaries or intermediaries to furnish such information as it may call for, for the Act. Rule 23 and the Seventh Schedule of the rules specify purposes that include national security, certain lawful government functions and regulatory assessments.

The petition notes that the power comes with no judicial oversight, no test of necessity or proportionality, and no notice to the person whose data is taken. Pointed at a newsroom, the publishers argue, it could reach a reporter’s notes, contacts and communications that identify confidential sources.

Rule 23 also permits the government, on specified national-security grounds, to prohibit disclosure of such information requests. Imagine an official passing documents to a reporter exposing irregularities in government contracts. If authorities obtain the relevant communications, the identity of the whistleblower could be exposed even without directly compelling the journalist to name the source.

The Way Forward

The concerns of publishers deserve scrutiny, but they should not be mistaken for an argument that journalists deserve unrestricted access to private information. Victims of sexual violence, children, private citizens and people subjected to sensational or inaccurate coverage need strong protections. Indian television has convicted people on air before courts heard them, and has exposed the private lives of people with no public role. Privacy is a fundamental right, not a privilege that disappears whenever a newsroom claims public interest.

Chief Justice Surya Kant recognised this dilemma precisely during the hearing. He reminded the petitioners that innocent citizens have rights too and that the court must strike a balance. He asked the publishers, as domain experts, to suggest safeguards against misuse. It is a fair demand.