Data protection and privacy
From Stop Press… to Stop DPDP: the press vs. India's data protection law
Written by K. Vaitheeswaran, Founder. 2026-11-03. 6 min read.
Stop Press! is a well-known exclamation in journalism to indicate breaking news where the traditional physical press is stopped in order to insert the latest news.
21 prominent news organizations under the banner Digital News Publishers' Association (DNPA) have challenged the Digital Personal Data Protection Act and Rules in the Supreme Court.
The Petitioners have sought to strike down various provisions of the DPDP Act including Section 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) along with Rules 16, 17 and 23 of the DPDP Rules.
What does the DPDP do?
The Act provides for processing of Digital Personal Data in a manner that recognizes both the right of the individuals to protect their personal data and the need to process such personal data for lawful purposes.
India's DPDP extensively focuses on the consent mechanism. The consent to be obtained has to be free, specific, informed, unconditional and unambiguous with a clear affirmative action. It shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose. The consent has to be accompanied or preceded by a notice.
The notice will have to specify the data principal (individual to whom the personal data relates) as to
- The personal data that is being collected and the purpose for which the same is proposed to be processed;
- The manner in which she can exercise rights under the Act;
- The manner in which the data principal may make a complaint to the Board.
Why is the Press Unhappy?
The objection of the journalist is that they will have to collect and use personal information without informing the person concerned in advance especially in matters involving investigative reporting. The collection of information from concerned individuals for that kind of reporting or bringing out a scoop would collapse if the individual is informed as to why the data is being collected and consent is mandated. The broad concerns are as under:
- (i) Under the Act, if it is 'legitimate use' in terms of Section 7, then processing of personal data can be done without consent. Journalistic work is not listed as one of the 'legitimate use' under Section 7.
- (ii) The very nature of journalistic work does not facilitate a consent-based operation.
- (iii) Consent withdrawal and erasure requests pose a direct threat to journalism as nothing can be published with certainty due to the possibility of erasure or withdrawal requests post publication.
- (iv) The massive penalties going upto Rs. 250 crores have a chilling effect on press freedom.
- (v) The potential for misuse of the Act and Rules in order to prevent publication of News cannot be ruled out.
- (vi) The unbridled powers under Section 36 and Rule 23 to call for information from data fiduciaries could result in witch hunt and can also deter whistleblowers.
- (vii) Erasure of data can result in removal of critical information from public domain.
Are the concerns valid?
The answer is YES. The media plays a significant role in society and is instrumental in bringing out information which would otherwise not be available to the public.
Media is known as the fourth pillar of the Democracy in addition to the legislature, executive and the judiciary.
Each of the concerns given above are fair. It is not always the scams or the scoops that are in the news. There is a lot of positive information about the society, Government, public, individual, environment, world developments, and so many other aspects which involve collection of information from organizations or bodies through individuals representing such persons. When a person is interviewed or photographed or video graphed, the person gets identified and in the current format of the law, the consent architecture walks in.
What are these Provisions under Challenge
| Section 7 | Deals with 'legitimate use' whereby a data fiduciary may process personal data of a data principal for any of the following listed uses. |
| Section 17(2) | The Act does not apply in respect of processing of personal data by instrumentality of the State as notified by the Central Government. This is subject to certain caveats. The Act also does not apply to processing of personal data necessary for research, archiving, or statistical purposes under certain circumstances. |
| Section 18 | Establishment of the Data Protection Board. |
| Section 19 | Composition and qualifications of appointment of Chairperson and members. |
| Section 27 | Powers and functions of the Board. |
| Section 29 | Appeal to Appellate Tribunal. |
| Section 36 | Power of the Central Government to call for information from the Board, data fiduciary or intermediary. |
| Section 37 | Power of the Central Government to issue directions. |
| Section 44(3) | Amendment to the Right to Information Act, 2005. |
| Rule 16 | Exemption from the Act for research, archiving or statistical purposes. |
| Rule 17 | Appointment of chairperson and other members. |
| Rule 23 | Calling for information from data fiduciary or intermediary. |
Is this the First Challenge?
PIL has already been filed by Geeta Seshu and the Software Freedom Law Center (SFLC); Reporters' Collective and Nitin Sethi represented by Internet Freedom Foundation; National Campaign for People's Right to Information (NCPRI); have already challenged some of the provisions of the Act and the matters are pending and the writs filed by the DNPA have been tagged along with the other matters.
What is the Position in GDPR?
DPDPA is not something new. It has been built on the lines of GDPR though there are additional unique features in the Indian legislation. Article 85 of GDPR deals with processing and freedom of expression and information. It specifically provides that Member States shall, by law, reconcile the right to protection of personal data pursuant to this regulation with the right to freedom of expression and information including the processing for journalistic purposes.
Article 85 also provides that Member States shall provide for exemptions or derogations from certain chapters (principles, right of data subject, controller and processor, transfer of personal data to third countries or international organizations, independent supervisory authorities, cooperation and consistency, specific data processing situations) in the context of processing carried out for journalistic purposes or for the purposes of academic, artistic or literary expression.
United Kingdom
Section 16 of the Data Protection Act, 2018 confers power to make provisions altering the application of the UK GDPR through regulations made by the secretary of State.
Schedule 2 deals with exemptions from UK GDPR and Para 26(1) covers special purposes to mean one or more of the following:
- (a) The purposes of journalism
- (b) Academic purposes
- (c) Artistic purposes
- (d) Literary purposes
However, there is no blanket exemption since Para 26(3) provides that the listed GDPR provisions do not apply to the extent that the Controller reasonably believes that the application of these provisions would be incompatible with the special purposes.
| Controller under GDPR | Data Fiduciary under DPDP |
|---|---|
| Article 4(7) defines 'controller' to mean the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data..... | Section 2(i) defines 'Data Fiduciary' to mean any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data; |
As can be seen from the above, the definitions in both the laws provide for the same purpose. In other words, it is within the responsibility and decision of the Controller to determine whether the GDPR applies to him or not.
What should the Government do?
Given the fact the definition of Data Fiduciary is on the same lines, the Government can easily address the main challenge of the litigation by taking either of the following courses of action:
- (i) bring about an amendment to Section 7 to expand the scope of legitimate use to include journalism. Section 7, in any event, comes into force in May 2027. There is significant history of amendments made to the Act even before it comes into force. The most recent example is the Income Tax Act, 2025.
- (ii) bring about an amendment to Section 17 to expand the scope of exemptions to cover journalism.
- (iii) exercise powers under Section 17(5). Under Section 17(5), the Central Government, before expiry of 5 years from the date of commencement of the Act can by notification declare that any provision of this Act shall not apply to such data fiduciary or classes of data fiduciary for such period as may be specified in the notification. However, this may not result in permanent relief, since, the exclusion is period oriented.
- (iv) exercise the powers under Section 43, which empowers the Government to issue an Order to remove any difficulties. Appropriate orders can be issued under this provision to protect the Freedom of Press from the DPDP Act and its requirements.
The primary concern of the media is the requirement to issue notice and obtain consent from Data Principals. If the journalists are insulated from the operation of the Act, then the major plank of the challenge may become infructuous. However, given the fact that there are other provisions of the Act under challenge, it is quite possible that the matter may not see a quietus and both parties may leave it to the Court to resolve the matter.
Topics
This note is a general account of the law at the date shown. It is not legal advice.