No Explicit Journalism Exemption in India’s DPDP Law: Why It Matters

India’s Digital Personal Data Protection (DPDP) law does not contain an express exemption for journalistic purposes. It also amends the Right to Information Act, 2005 (RTI Act) to remove the public interest override in Section 8(1)(j), replacing it with a broad exemption for all personal information.

These aspects have drawn renewed attention after a three-judge bench led by Chief Justice of India Surya Kant issued notice, on 27 October 2026, on the Digital News Publishers Association’s (DNPA) petition challenging specific provisions of the DPDP Act, 2023 and the DPDP Rules, 2025 on the ground that they infringe press freedom and the right to information.[1] The bench also issued notice on the stay application, declined to grant an ex parte stay, and tagged the plea with pending matters,[2] which will be heard together on 17 November.

This case raises important questions about the constitutional validity of the impugned provisions, their impact on news reporting, and the need to strike a balance between the right to privacy and the freedom of speech and expression.

Union IT Minister Ashwini Vaishnaw has since stated that the legislation was never intended to impinge on journalistic freedom, which is guaranteed under the Constitution of India. Reports citing government sources indicate that the Centre is open to amending the law.

In this update, we look at the challenge, explore the position in the UK and consider why this case matters.

DNPA’s case

Originally filed in July this year, DNPA’s petition challenges nine sections of the DPDP Act and the DPDP Rules, 2025 (in particular Rules 16, 17 and 23). Its counsel described it as the first comprehensive petition by ‘legacy media’.

The petition’s central grievance is the absence of an express carve-out for journalistic purposes, which some earlier versions of the law contained. Without one, DNPA contends, news organisations are treated like any other data fiduciary. It argues that the consent requirements could oblige journalists to notify the subjects of their investigations, while withdrawal of consent and erasure rights could force the takedown of factual, public-interest reporting. It also challenges the Central Government’s powers to call for information (Section 36) and to direct the blocking of access to information (Section 37(1)), arguing that the former lacks safeguards such as necessity, proportionality and judicial oversight and could expose confidential sources.

A key part of the challenge is Section 44(3), which substituted clause (j) of Section 8(1) of the RTI Act. Earlier, personal information was exempt only if its disclosure had no relationship to any public activity or interest, or would cause an unwarranted invasion of privacy, and even then it had to be disclosed if the Public Information Officer or appellate authority was satisfied that the larger public interest justified it. A proviso also barred denying any person information that could not be denied to Parliament or a State Legislature. The substituted clause exempts “information which relates to personal information”, with no public interest override within the clause and no proviso. DNPA says this could significantly restrict access to records relevant to public accountability.

Journalism exemption under UK data protection law

In the UK, data protection is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Generally, compliance with the requirements of the data protection law is necessary when personal information is used for journalism. However, specific exemptions from particular UK GDPR provisions have been created within the DPA 2018, which aim to balance individuals’ privacy rights with the freedom and independence that journalism requires. This is done through the exemption for journalistic, academic, artistic and literary purposes (together, the ‘special purposes’), as set out in DPA 2018, Schedule 2, Part 5, Paragraph 26.

Certain criteria need to be met for the journalism exemption to apply. These include, among other requirements, a reasonable belief that publication would be in the public interest, taking into account the special importance of the public interest in freedom of expression and information. In determining whether it is reasonable to believe that publication would be in the public interest, regard must, where relevant, be had to the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors’ Code of Practice.

DPDP implementation: Where things stand

Implementation of the DPDP framework is progressing, though unevenly. Earlier this month, MeitY issued the DPDP (Removal of Difficulties) Order, 2026, making two corrections to the Act (to Sections 9(1) and 10(2)(c)(ii)) that it described as textual and editorial in nature.

While the Data Protection Board of India was established on 13 November 2025, when the Rules were notified, it is not yet functional. No appointments of its Chairperson or Members have been publicly announced. Stakeholders have flagged the delay, which is significant given that the next phase of implementation is imminent. Rule 4 of the DPDP Rules, which governs the registration and obligations of consent managers, comes into force on 13 November 2026, one year after the Rules were notified. The remaining provisions, including the core obligations of data fiduciaries and the rights of data principals, take effect on 13 May 2027.

Looking ahead

The design of a journalistic exemption, including appropriate safeguards and qualifying conditions, will require careful deliberation. However, the absence of any such exemption marks a departure from earlier drafts of the law and from regimes such as the UK’s, and lies at the centre of the challenges now pending before the Supreme Court. On 27 October 2026, the Chief Justice of India observed that, as domain experts, the petitioners were best placed to suggest how to ensure there is no misuse, and that a balance has to be struck between the rights of citizens and those of the media. Read with reports that the Centre is open to amending the law, this suggests that further deliberations may lead to changes that reconcile the right to privacy with the freedom of speech and expression.

References:

[1] Digital News Publishers Association & Anr. v. Union of India & Anr., W.P. (Civil) Diary No(s). 45589/2026.

[2] Venkatesh Nayak & Anr. v. Union of India, W.P. (Civil) No. 177/2026, and connected matters.