Courting Controversy by Nakul Dewan
In 1972, five men were caught breaking into the offices of the Democratic National Committee at the Watergate complex in Washington, DC. What looked like a petty burglary to most, was not considered to be so by two reporters at The Washington Post, Bob Woodward and Carl Bernstein. Over the next two years, through late-night phone calls, doorstepping reluctant officials and clandestine meetings, they traced the break-in back to President Richard Nixon’s re-election campaign and, eventually, to the White House itself. Their reporting helped unravel the scandal that forced Nixon to resign in August 1974. Their account of it was made into a film called All the President’s Men, which took its title from Nixon’s aides whose names, money trails and private dealings were painstakingly exposed by the reporters.
Now imagine Woodward and Bernstein, before writing a single word, sending a polite note to each of Nixon’s men seeking consent to process their personal data. Imagine, too, the presses grinding to a halt the moment one of them withdrew that consent and demanded that his data be erased. The story, one suspects, would have ended somewhere around chapter one, and Nixon might well have served out his term.
That, in essence, is the scenario India’s legacy media has placed before the Supreme Court. On 27 October 2026, the Supreme Court issued notice in a petition by the Digital News Publishers Association (“DNPA”) challenging provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025. DNPA’s 21 members include established media houses and newspapers such as The Indian Express, The Hindu, the Times group, HT Digital, NDTV and Network18.
At the heart of their challenge is a law that is meant to protect privacy. India’s data is collected, on a vast scale, and until recently individuals had little say in how it was used. The DPDP Act changes that by putting consent at the centre. It applies to digital personal data, meaning any data that can identify an individual, including data first collected on paper and later digitised [Section 3, DPDP Act], and covers almost anything done with it, from collection and storage to sharing and publication [Section 2(x), DPDP Act]. Under Section 4, those who decide why and how such data is processed, called data fiduciaries, may do so only with the individual’s free, specific, informed and unambiguous consent [Section 6, DPDP Act], or for a legitimate use such as State functions, legal obligations, court orders or medical emergencies [Section 7, DPDP Act]. Section 17 further exempts courts, law enforcement, research, archiving and statistics from seeking consent. Journalism appears in neither list.
The European Union’s General Data Protection Regulation (“GDPR”), whose data controller mirrors the DPDP Act’s data fiduciary, takes a different approach in relation to journalistic expression. It requires every member state to pass laws that reconcile the right to data protection with the right to freedom of expression and information, including processing for journalistic purposes [Article 85, GDPR]. The reason for that lies in the wide net cast by GDPR and its onerous obligations upon data controllers. The GDPR covers personal data whether digital or held in paper records, and continues to apply to information that is publicly available. Even for sensitive data that a person has manifestly made public, controllers must generally tell subjects of when their data has come from a publicly accessible source. Since almost every news story involves processing personal data in some form, the GDPR carves out room for journalism. GDPR also relieves data controllers of the duty to inform individuals of data processing where doing so would be impossible, involve disproportionate effort, or seriously impair the purpose of the processing [Article 14(5)(b), GDPR].
The DPDP Act, by contrast, does not expressly provide an exemption for journalistic expression. However, it places data that individuals have themselves made publicly available, entirely outside its ambit. Arguably, this may make a journalism exemption seem unnecessary: a politician’s speech, a celebrity’s social media post or a company’s public filing can be reported freely. However, the investigative and time-sensitive stories that matter most often rely on information that people have not made public, which is precisely where a journalism exemption under the DPDP Act may be needed.
Think of a newsroom. An investigative team publishes bank statements showing a person’s undeclared transfers or a reporter runs a sting operation with a hidden camera to expose a doctor selling fake medical certificates or a fugitive’s current address is traced through his relatives, whose identities may stand exposed. In none of these instances would the subjects have consented to their identifiable information being published and the newsroom, processing such personal data, without an exemption for journalistic expression would have to face onerous obligations under the DPDP Act. Data principals may also withdraw consent [Section 6(4), DPDP Act] and seek erasure of their personal data [Section 12, DPDP Act], which could leave a newspaper’s archive punched with holes.
The aim of the publishers is not to dilute the DPDP Act. Its protections matter, and an exemption that is too wide would undermine them, becoming a licence for anyone with a camera phone to claim press privileges, or a shield for doxxing dressed up as news. But a privacy law that requires the subject of an investigation to sign off on it risks turning the press into a stenographer.
The answer probably lies in a calibrated middle path which ensures that the DPDP Act can be implemented effectively without curbing journalistic freedom. The middle path may lie in creating a public-interest exemption under the DPDP Act, tied to recognised reporting standards such as the Press Council norms, with publishers remaining accountable for inaccurate reporting. Whether such an exemption comes through a notification under Section 17(5) of the DPDP Act, which empowers the Centre to exempt classes of data fiduciaries, or through the courts reading down the DPDP Act, remains to be seen.
Nakul Dewan is a Senior Advocate and King’s Counsel.
