Following Union IT Minister Ashwini Vaishnaw’s assurance to the media industry that the government would listen to concerns regarding press freedom arising from certain provisions and the lack of exemptions in the Digital Personal Data Protection (DPDP) Act, here is a brief list of 10 changes that could be made to the DPDP Act. It also includes the recommendations given by the Sri Krishna Committee, in 2018 that had set the founding blueprint for India’s data protection laws. 

Brief context on what happened: 

After the Supreme Court of India recently heard the 21 news publication’s challenge to the DPDP Act, Union IT minister Ashwini Vaishnaw had assured, as reported first by MoneyControl  that the intent of the Act is not to affect the press freedom. Furthermore, he invited the media industry and editors for a meeting to submit their submissions for the government to consider. 

“Journalistic freedom is guaranteed by the Constitution, and there is no intention to affect that… I am inviting all editors. We are happy to take on record all suggestions, and if there is any doubt, the government is open to act accordingly,” –  Ashwini Vaishnaw. 

MoneyControi also reported that the “Government sources indicate that the government is prepared to ‘hard-code’ an explicit exemption for the media into the DPDP Act.” However, the union minister’s didn’t provide assurances of amendment to the Act; only assured that the government would listen to the media industry.

The Supreme Court is likely to hear this case again on November 17, where the government’s Solicitor General might submit their affidavit. Here is a brief list of contentious clauses in the DPDP Act that impacts press freedom and why they need to be amended: 

What did media companies argue in the Supreme Court? The Digital News Publishers Association (DNPA) filed its petition on October 6. Its 21 members include The Indian Express, The Hindu, NDTV, Network18 and Bennett Coleman. A three-judge bench led by Chief Justice of India Surya Kant heard it on October 27. As MediaNama reported, the Court declined to stay the DPDP Act without hearing the government and listed the matter for November 17.

Advocate Madhavi Divan, appearing for the DNPA, argued that the subjects and sources of news stories could count as data principals. The people whose data is processed then withhold consent or demand correction and erasure. That, she said, amounts to a “complete regime of pre-censorship”. She added that earlier versions of the law had carved out journalism, and that the Act was not designed for news. [Read more about it here, either on MediaNama, or Reuters as they have reviewed the 698-page petition in the SC first and reported about it.]

What are the contested provisions and why do they need to be amended? 

MediaNama’s reading of the Act and the DPDP Rules, 2025 list the following points. These are not claims made in the petition. Some of these concerns were raised by Editors Guild of India (EGI), the Press Club of India (PCI) as well as RTI activists and INDIA alliance bloc. 

  1. No exemption for journalistic activities in the ‘legitimate uses’: Under Sections 4(1) and 7 of the DPDP Act, data processing needs consent or a “legitimate use” and the Section 7, which lists the “certain legitimate uses” doesn’t specify the journalistic clauses.  
  2. How would voluntary consent work in Journalism? Section 7(a) of the act, which covers data a person voluntarily gave for a stated purpose, which could cover interviews. As argued in the SC, how would this practically be possible? How can the reporters take the consent of the politician on who they report on? What if they deny? This may result in pre-censorship, as placed before SC. 
  3. Personal data that is already public: The Section 3(c)(ii) of the DPDP Act states that the Act does not apply to personal data made public by the data principles themselves. However, this carve-out is very narrow in the context of journalism. It does not cover data that a journalist may obtain from a source and then verifies or contextualises. Additionally, the Act also doesn’t cover data that is already public in some respects but private in others. 
  4. People’s withdrawal and erasure rights would erode institutional trust in journalism: The Sections 6(6) and 8(7) of the DPDP Act guarentees that the data principals can withdraw the consent and even seek the erasure of the data. If sources come to publication seeking removal or edits, it would create havoc in the institution of journalism and the credibility itself would be questioned. 
  5. Government’s information demands could compel journalists to reveal confidential information: Section 36 of the DPDP Act and DPDP Rule 23 gives the government the right it can ask any data fiduciary to furnish information for a few purposes listed in the Seventh Schedule, including sovereignty/integrity/security of the State as well as “any law for the time being in force”. This provides broad rights to the government. Additionally, Rule 23(2) lets the government bar a fiduciary from telling the people affected and Rule 8(3) separately requires fiduciaries to keep personal data and processing logs for a year for the same purposes. One possible way this could go wrong is: what if the government summons the journalist/editor to disclose the sources’ information under the grounds of state security? If editors and journalists are not in a position to protect their sources it can erode the institutional trust in journalism itself. Justice Sri Krisna called the government exemptions as a “great concern.”

“The Bill is fundamentally flawed as it would permit, and may encourage, the executive to act capriciously and infringe on the fundamental right of privacy of personal data. The so-called regulator will be a puppet of the government and will have no independence.” –  Justice B.N. Srikrishna DPDP Bill (2023)

  1. Content blocking powers that go beyond the Section 69 of the IT Act: Section 37(1) of the DPDP Act can let the governments block information on Data Protection Board of India’s reference, reporting two or more penalties on the same fiduciary after a hearing and recorded the reasons. The ground is “the interests of the general public”. Concerned about this provision, the Editors Guild of India argued in 2023 that this goes beyond Section 69A of the IT Act and Article 19(2) of the Constitution.
  2. Upto Rs 50 Crore Penalties: According to the Schedule of the Act under Section 33(1), data breach of “any other provision” can attract a penalty of up to Rs. 50 crore. While this can make the journalistic institutions be wary of the personal data that they hold, this can also damage the career of a journalist/editor, especially at a time when the definitions of a journalist and “content creator” is blurring. 
  3. The amendment to RTI Act that undermines public interest: The Section 44(3) of the DPDP Act enables to changle the clause (j) of Section 8(1) of the Right to Information Act, 2005. The old clause exempted personal information with no link to any public activity or interest, or whose disclosure would be an “unwarranted invasion of the privacy of the individual”. Even then, an information officer could disclose it if the larger public interest justified. The new clause undermines the public interest and broadly states: “information which relates to personal information”. It means that the so-called personal information, like names and other details, could be exempted from the RTI responses even when there might be a clear public interest cause, like the names of the contractor who might have built the faulty roads. 

In April 2025, the INDIA Alliance bloc wrote a letter to the MeitY’s Ashwini Vaishnaw, asking the government to repeal the provisions that go against the RTI Act in the name of privacy protection. However, the DNPA’s arguments, as reported by Reuters, do not cover this.

In addition to the above mentioned provisions that needs an amendment, a few additional changes could be:

  1. A statutory amendment to the Act, not just notification: The Section 17(5) of the Act allows certain exemptions by the separate notification, which the EGI asked for in February 2024. However, such notifications could generally come up with a  certain time period or could be revoked at any time too as it will be under the control of the executive wing of the government. On the other hand, a statutory amendment to the Act would make it more durable and would require due parliamentary process if the government wishes to amend the Act.
  2. The definition and acknowledgement of the journalistic activities: The Srikrishna Committee, which laid the foundational blueprint for India’s data laws in India, tied the press freedom to the public interest, and proposed a self-regualtion style regime where the even independent journalists could self-declare the adherence to a certain ethical standards as defined in the other status like Press Counsil of India’s Journalistic Norms. 

What did the Srikrishna Committee say about press freedom and right to privacy?

The Justice B.N Srikrishna Committee, which drafted the Personal Data Protection Bill, 2018 (the precursor to the DPDP Act), devoted significant attention to the conflict between privacy and free speech in the context of journalistic activities. Some of the core points and the recommendations from the Report are: 

First the Committee acknowledged the journalism, which derives its right from the right to freedom of speech, is necessary for “participatory democracy where citizens have free and fair access to information”. It further highlighted that “Journalism acts in public benefit since it helps in building social accountability and brings about discussions on issues of public concern.” Why the Sri Krishna Committee felt that data privacy protections on journalism would burden the media: 

 “If journalists were made to adhere to the grounds of processing personal data, it would be extremely onerous for them to access information. Further, mandating grounds of processing like consent would mean that accounts that are unfavourable to the data principal would simply not get published. There therefore exists a public interest in the untrammelled dissemination of news, current affairs and documentaries, especially when they inform, criticise and analyse issues of public importance. However, it could be argued that even material apart from the above may be relevant to the general interests of the public and the flow of such information should not be impeded.” – Justice B.N. Srikrishna Committee (2018)

You can access a copy of the report here: [pdf]

Committee Recommendations: Among many other recommendations, here are a few by the committee that are particularly related to journalistic activities and the right to privacy:

  1. A journalistic exemption should be included in the data protection law, applicable where public interest in disclosure is overriding. The Committee framed this as allowing “recourse to the journalistic exemption where public interest in the disclosure of the personal data is overriding.”
  2. Purpose limitation should not apply to journalistic processing. The Committee stated: “The standards of specificity as ordinarily required under purpose limitation should not apply in case of journalistic exemption since it is often exploratory in nature.” However, “journalists should still be expected to outline the broad contours of the purpose for which the personal data is being collected.”
  3. Storage limitation should not apply so long as data is stored only for further journalistic purposes. The Committee recommended: “under the journalistic exemption storage limitation should not apply so long as it is clear that the personal data is being stored for only for further journalistic purposes.“
  4. Prior notice and consent obligations should not apply, especially in investigative journalism. The Committee held: “The notice and consent obligation will not apply, especially in cases of investigative journalism where notifying the individual of the collection of information about them would defeat the purpose of the exercise.” But the journalist “must have a clear reason (usually public interest) which outweighs the violation of privacy.”
  5. Data principal rights, like edit and erasure, may be refused where compliance would be incompatible with the principles of journalism. The Committee stated: “Requests to implement data principal rights like right to access, confirm and correct can be refused by those taking cover of the journalistic exemption because complying with such requests would often be incompatible with journalism.” Such requests “may be rejected both before and after publication.”
  6. Ethics standards should be a condition for availing the exemption. The Committee recommended that “to be accorded an exemption from the data protection law, journalists should be bound by ethics standards like honesty and fairness in collecting and disseminating personal data for the purpose of news reporting.” It further proposed that “all media houses should be publicly committed to observe published privacy standards which are considered adequate by the data protection regulatory authority.”
  7. Independent journalists may self-certify adherence to ethics standards. The Committee recommended: “Independent journalists may self-certify through a declaration that they are adhering to the aforementioned ethics standards.”
  8. Security safeguards must be implemented. The Committee stated: “Security safeguards should be implemented for all personal data processed by journalists. Therefore, they must take reasonable steps to prevent the data’s loss, theft or misuse.”
  9. The definition of “journalist” should be inclusive, covering citizen journalists and freelancers, not just those employed by media organisations. The Committee warned: “constraining the definition of a journalist to someone employed by a media organisation would exclude a sizeable proportion of people who disseminate news to the public.” It suggested that “factors such as how often a person does activities for a journalistic purpose or whether they obtain their livelihood from carrying out activities for a journalistic purpose may be better suited in determining who a journalist is.”
  10. Existing media codes need to be revised to provide more detailed guidance and accountability mechanisms. The Committee observed that “the codes as they exist now will need to be revised to ensure that they act as a sufficient measure of accountability such that the application of journalistic exemption does not lead to undue violation of the data protection rights of data principals.”
  11. The basic obligation of fair and reasonable processing continues to apply. The Committee clarified: “the exemptions from obligations would only apply so long as the personal data is being processed for journalistic purposes and in a fair and reasonable manner. Thus, the basic obligation of fair and reasonable processing would continue to apply, shaped by this context.”

While the advocates representing DNPA argued that existing regulatory norms like Press Counsil norms would be sufficient, the Srikrishna committee however didn’t treat the existing codes as sufficient. It said the reforms could be pursued in the following aspects: 

The commiite expected the codes to be revised so that an exemption does not lead to undue violation of the right to privacy.

Also read

The post In favour of press freedom: 10 changes that could be made in the DPDP Act appeared first on MEDIANAMA.