Press freedom at risk under DPDP Act

India’s Digital Personal Data Protection Act (DPDP Act), 2023, establishes a consent-centric framework for processing digital personal data, with penalties for non-compliance, while granting the government significant powers to define exemptions. The Act lists limited carve-outs (such as ‘certain legitimate uses’, court functions, and mergers). But unlike many global privacy regimes, it does not create a tailored exemption – or even a balancing test – specifically for journalistic purposes. This omission is the core issue for the press.

While Section 17 of the DPDP Act contains broad exemptions, these are oriented towards State functions -- for instance, processing in the interests of sovereignty, security, or public order, or exempting ‘instruments of the State’ -- but not newsgathering. This asymmetry—expansive State carve-outs without a corresponding press/public-interest carve-out—raises concerns about uneven burdens: officials gain latitude, while independent media receive none. 

Further, Section 44 of the DPDP Act amends the Right to Information (RTI) framework by removing the long-standing ‘larger public interest’ override for personal information, making it easier for authorities to reject RTI disclosures that underpin investigative reporting. This is concerning given the leeway already provided under Section 8(1)(j) of the RTI Act, which is commonly used to deny disclosure. Such changes materially weaken transparency and, by extension, public-interest journalism.

Chilling effect

Another significant concern arising from this framework relates to the operational side of investigative journalism. Investigative reporting frequently relies on data obtained without prior consent (for instance, contacting sources, verifying allegations, handling leaked documents, or datasets on wrongdoing) and often demands withholding notice to avoid tipping off subjects. Because the Act’s baseline model is consent/notice, a journalist processing personal data in the course of reporting risks non-compliance where consent is unavailable or inappropriate. The GDPR’s journalism derogations explicitly relax consent, notice, and access rights when necessary to reconcile privacy with free-press obligations. By contrast, Indian newsrooms can point only to the DPDP’s general framework; there is no explicit mechanism to prioritise the public interest in exposing corruption, consumer harms, or powerful private conduct affecting citizens. 

The Act’s blocking power aggravates the chilling-effect risk. Section 37 empowers the central government, after repeated penalties against a data fiduciary, to order public blocking of information that enables that fiduciary to offer services in India. While framed as a compliance backstop, it could, if applied to a media website deemed a “data fiduciary”, become a heavy hammer against publishers -- especially absent a press-specific balancing test and with only general “public interest” language to guide decisions (which is distinct from the IT Act’s Section 69A regime). The mere possibility may incentivise self-censorship or legal conservatism in hard-hitting investigations. 

The lack of a journalism-specific exemption is noteworthy, given that data-privacy regimes elsewhere show workable alternatives. The UK Data Protection Act 2018 grants a journalism exemption when processing is for ‘special purposes’ (journalism, academic, artistic, or literary), the controller reasonably believes publication is in the public interest, and compliance would be incompatible with journalism. Ireland and others implement similar GDPR-mandated balances to ensure press freedom. Canada’s Personal Information Protection and Electronic Documents Act outright excludes personal-data processing ‘for journalistic, artistic or literary purposes.’ South Africa’s Protection of Personal Information Act and New Zealand’s Privacy Act 2020 also carve out news media activities, each with conditions. These models acknowledge that journalistic activities sometimes require limited deviations from consent-first rules, while still preserving accountability through public-interest thresholds and post-publication remedies. 

The DPDP Act is a landmark in India’s privacy regulation, but its silence on journalistic exemptions creates a serious tension with the constitutional guarantee of freedom of speech and expression. Even the DPDPA rules do not contain any safeguards for investigative reporting. The absence of a specific carve-out for journalism, combined with sweeping State exemptions, restricted access to personal data caused by the narrowing of RTI disclosures, and questions over the independence of enforcement bodies, means that the press will operate under a cloud of legal ambiguity. More pertinently, it creates a framework where privacy norms can be invoked to impede or chill public-interest reporting, without a countervailing statutory safeguard for freedom of expression and the press. Unless these concerns are addressed – either through targeted amendments or a robust class exemption in the rules – the law risks being used, intentionally or otherwise, to limit the space for public-interest reporting. 

(The writer is an advocate practising in New Delhi)