DPDP Act and Investigative Journalism: Privacy Versus the Right to Know

Context

The Supreme Court is reviewing a petition by major media groups to amend the Digital Personal Data Protection Act, 2023. Publishers argue that a lack of journalistic exemptions allows entities under investigation to weaponise privacy laws, forcing reporters to obtain consent or delete true investigative reports.

Data Privacy and Digital Data Protection Act

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s foundational legislation regulating the processing of digital personal data. It aims to balance an individual’s right to protect their personal information with the legal economic need to process data for lawful purposes.

1. The Core Architecture

The Act introduces two primary legal pillars:

• Data Principal: The individual citizen whose personal data is being collected and processed.
• Data Fiduciary: The entity (private company, state department, or individual) that determines the purpose and means of processing that data.

2. Main Compliance Mandates

• Explicit Consent: Data Fiduciaries must obtain clear, specific, and revocable consent from the Data Principal through a plain-language notice before collecting data.
• Purpose Limitation: Data can only be collected for specified, lawful purposes and must be deleted once that purpose is fulfilled.
• Rights of Citizens: Individuals gain the legal right to access their data summary, seek correction or absolute erasure (Right to Erasure), and nominate a representative in the event of death or incapacity.

3. Oversight and Enforcement

• Data Protection Board of India (DPBI): A dedicated adjudicating body set up by the central government to handle grievances, direct inquiries, and penalise non-compliance.
• Heavy Penalties: The Act prescribes strict financial penalties going up to ₹250 crore for significant data breaches or failure to prevent data leakages.

Need of strong Privacy Policy

1. Curbing Corporate Misuse: In the modern digital economy, predatory corporations routinely harvest, track, and monetize citizens’ phone numbers, live locations, and financial histories without consent.
2. Protecting Private Citizens: Unregulated media reports that publish the private details of ordinary citizens—who are not public figures—can cause severe real-world harm, harassment, and public embarrassment.
3. Differentiating Intent: While tech platforms exploit data for commercial profit, journalists handle data to inform the public. This highlights the need for a nuanced framework that treats public interest differently from business operations.
4. Enforcing Media Accountability: The law ensures journalists remain fair and precise, providing a necessary legal remedy for private individuals harmed by defamatory or false personal data reporting.
5. The Government’s Stance: The Union government maintains that the primary mandate of the Act is to secure personal data, assuring that specific operational concerns can be adjusted and balanced later through subordinate rules.

Concerns raised by Journalists

1. Absence of Press Exemptions: Unlike global frameworks like the GDPR, the Act provides no legal immunity for public-interest reporting, forcing media outlets to operate under the same strict digital rules as commercial corporations.
2. The Investigation Paradox: Mandating explicit consent means a reporter would legally have to ask a corrupt official for permission before conducting an undercover investigation, rendering investigative journalism impossible.
3. Weaponisation of Erasure: Corrupt or powerful figures can exploit Section 12 (Right to Erasure) to demand the deletion of their names and data from published, accurate news archives, effectively scrubbing their records.
4. Compromised Source Protection: Wide state powers under Section 36 allow the government to demand internal logs from data fiduciaries, creating a high risk that newsrooms will be forced to expose confidential whistleblowers and raw editorial notes.
5. Chilling Effect and Industry Decline: The threat of severe financial penalties creates an environment of fear, discouraging editors from pursuing high-risk exposes and further reducing the number of deep investigative journalists in India.

Legal Provisions and Past Judgments

1. Press Freedom (Article 19(1)(a)): While not explicitly stated in the Constitution, freedom of the press is judicially protected under the fundamental Right to Freedom of Speech and Expression.
2. The Right to Privacy (Article 21): Established as a fundamental right by the Supreme Court’s landmark S. Puttaswamy (2017) judgment, which directly necessitated the creation of the DPDP Act.
3. RTI Act, 2005: The core transparency tool for citizens. The DPDP Act dilutes it by removing the clause that allowed personal data disclosure when the public interest outweighed individual privacy.
4. DPDP Rules, 2025: Notified on 14 November 2025, these rules lay down the operational workflow for gathering explicit consent, issuing notices, and processing data complaints.
5. Vulnerable Source Protection: India has no dedicated law protecting a journalist’s confidential sources. While a Witness Protection Scheme was cleared in 2018, it offers no defense against government data demands under Section 36.

Way Forward

1. Public-Interest Journalism Exemption: Amend the core framework to explicitly protect good-faith, public-interest investigative reporting from mandatory consent requirements.
2. Judicial Shield for Sources: Mandate that any state order demanding a newsroom reveal its confidential sources must first be reviewed and cleared by an independent court.
3. Refining the Right to Erasure: Protect accurate, historically significant public news archives from deletion, while still allowing citizens to correct demonstrably false personal data.
4. Reinstating RTI Balance: Revive the public-interest balancing test within the RTI Act, permitting personal data disclosure when the public good clearly outweighs individual privacy.
5. Autonomous Oversight (DPBI): Insulate the Data Protection Board of India from executive control to guarantee complete impartiality during state-media disputes.
6. Rigorous Media Ethics: Encourage news organisations to enforce strict self-regulatory codes, preventing the unnecessary exposure of private citizens’ personal details.

FAQs

Q1. What is the DPDP Act?

Ans: The Digital Personal Data Protection Act, 2023 is India’s main law on how organisations may collect and use digital personal data. It gives people rights over their data and sets penalties for misuse.

Q2. What is a Data Principal and a Data Fiduciary?

Ans: A Data Principal is the person to whom the data belongs. A Data Fiduciary is the organisation that decides how and why the data is used.

Q3. What does Section 12 of the DPDP Act say?

Ans: Section 12 gives people the right to ask for correction, completion, updating or erasure of their personal data. Journalists worry that it could be used to remove information from published reports.

Q4. What is the RTI connection?

Ans: Section 44(3) of the DPDP Act changed Section 8(1)(j) of the Right to Information Act.

Q5. What is the chilling effect?

Ans: The chilling effect happens when people avoid doing something legal, such as publishing a story, because they fear punishment or legal trouble. Critics say that the DPDP Act could have this effect on investigative journalism.