The Law Was Not Meant for Us: Legacy Media Finally Takes India's Data Protection Act to the Supreme Court

On Tuesday, 27 October, the Supreme Court issued a notice to the Centre on a petition from 21 news publishers, including companies owned by Mukesh Ambani and Gautam Adani. The petitioner is the Digital News Publishers Association, which represents the digital wings of 21 major news organisations such as The Indian Express, The Hindu, India Today, Times Group, Zee, NDTV and Network 18. The bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana issued notice on both the petition and the stay application, returnable on November 17. The court has not ruled on the constitutional validity of the challenged provisions.

What the law is

The Digital Personal Data Protection Act received assent on 11 August 2023, and the Rules were notified on 14 November 2025. The Rules give organisations an eighteen-month phase-in, which places full compliance in May 2027. Among the pieces that switch on at that point are Rules 3, 5 to 16, 22 and 23.

The law governs anyone who decides why and how personal data is processed, which it calls a Data Fiduciary. The individual is the Data Principal. A four-member digital Data Protection Board enforces the framework, with appeals going to the TDSAT. Penalties reach ₹250 crore for failing to maintain reasonable security safeguards, ₹200 crore for breach notification failures and violations involving children, and ₹50 crore for other violations.

What it does for citizens

Every bank, app, retailer and website that holds your phone number, address or purchase history becomes accountable for it, and ordinary people gain tools they have never had. The government describes the framework as placing the individual at the centre, and the rights translate into everyday terms.

You decide what you share. Consent has to be clear, informed and easy to understand, and you can withdraw it at any time. Each company must issue a separate notice explaining the specific purpose for which it wants your data, so a delivery app can no longer bury a dozen uses inside one tick box.

You can look under the hood. You can ask what personal data a company holds, why it was collected and how it is used, and request a copy. If the record is wrong, you can demand a correction, and if your address or number has changed, an update.

You can ask for deletion. Individuals may request removal of their data in certain situations, and companies must act on access, correction, updating and erasure requests within ninety days. You can also name another person to exercise these rights for you, which helps if you are ill or cannot manage the paperwork.

You must be told when a leak happens. After a breach, the company must inform affected individuals without delay, in plain language, explaining what happened, the possible impact and what they can do. The Rules were pitched with a familiar harm in mind, since citizens can take recourse if their phone numbers are leaked for unauthorised calls.

Children get a lock. A child's data requires verifiable consent from a parent or guardian, except for essential services such as healthcare, education or real-time safety.

Complaints have a home. Citizens can file complaints online and track their cases through a dedicated portal and mobile app, before a Board that can fine companies up to ₹250 crore for failing to secure data.

Nobody in this fight is asking for these protections to be withdrawn. The dispute concerns who else the same machinery lands on.

Where journalism breaks

The law was built around a customer who signs up for a service. A reporter has no such relationship with the people she investigates, and each safeguard that protects an ordinary user turns into an obstacle when applied to a newsroom. What follows are the petitioners' readings of the law, which the government disputes.

Consent. Platforms and retailers collect consent when you create an account. A reporter working on a contractor who pocketed welfare funds (an illustration, not a case from the petition) would have to notify him and ask permission before processing his data. The petition argues that notifying the subject of an investigation and obtaining consent would allow that subject to destroy evidence and intimidate witnesses. Senior Advocate Madhavi Divan told the court that if consent rests on the mercy of the person being reported on, the concept of news disappears, because news has to be new.

Erasure. Consent can be withdrawn at any time, and a withdrawal can arrive with a demand for deletion. The law offers no public-interest safeguard, which DNPA says could force publishers to unpublish or heavily redact factual reports. A story that took eight months to report could be pulled by the person it exposed.

Sources. Section 36 and Rule 23 let the Centre order any organisation holding personal data to furnish such information as it may call for, with enforcement due from May 2027. The petitioners say the power carries no judicial oversight, no test of necessity or proportionality and no notice to the person affected, and that it can extend to privileged communications in the hands of a reporter or the informant. Anyone weighing whether to hand a journalist a document will ask whether the government can ask for the file.

The referee. Disputes go to the Data Protection Board, whose chair and members are selected by the executive, with no judicial member required, even though it can inquire into violations and impose penalties. A government that features in much investigative reporting would appoint the body that judges the reporters.

The RTI Act. Reporters have long used Right to Information requests to extract records about public officials. Section 44(3) rewrote the exemption for personal information. The old clause allowed disclosure where larger public interest justified it, while the new text lets officials refuse anything that relates to personal information, with no public-interest consideration. The government answers that Section 8(2) of the RTI Act still allows release where the public interest in disclosure outweighs the harm.

What the government says. MeitY told press bodies in July 2025 that journalists are not considered data fiduciaries under the Act, and that criminal penalties had already been removed, so any process would be civil. That assurance has never been written into the law or the Rules.

What it does to investigative journalism

Investigative reporting depends on a chain of trust: a clerk who photocopies a file, an engineer who explains the real specifications, a former colleague who confirms what everyone suspects. Every link is a person taking a risk, and the petitioners' case is that this law raises the price of that risk. DNPA's pleading warns the law would render investigative journalism a benign and neutered recorder of events. DIGIPUB says the framework endangers source confidentiality, hinders public-interest investigations and obstructs anti-corruption disclosures.

The fears fall into four groups.

Sources go quiet. The petition argues that the government's information powers could discourage whistleblowers from sharing information on matters of public importance. A source rarely gets a second chance at anonymity.

Process becomes punishment. Media bodies told MeitY that even a civil process could become a punishment without an exemption. A complaint before the Board costs lawyers, time and attention long before any fine arrives.

The smallest feel it first. Reports note that independent journalists and freelancers face compliance challenges under the Act, risking self-censorship and reduced news coverage. A newsroom backed by a large group has a legal department, while a freelancer has a phone and a deadline.

Editors grow cautious. The Editors Guild warns that without an exemption, journalism could be read as processing that requires consent, chilling newsgathering and hindering accountability journalism. Chilled stories leave no trace, because nobody reports the story that was never filed.

What happens when sources are exposed

None of the cases below arose under the DPDP Act. They show what follows when a source is identified, and why journalists treat source protection as the foundation of the trade.

Reality Winner, United States, 2017. A government contractor mailed The Intercept a classified report on Russian hacking. The outlet sent scans of the document to intelligence officials to confirm it was real, without obscuring the tracking dots printed on the pages. Those dots revealed which printer produced the copy and when, and only six people had printed the report. The Justice Department announced her arrest the same day the story was published. Winner took a plea deal and was sentenced to five years and three months, which prosecutors called the longest sentence served for an unauthorised disclosure to the media. The Intercept later acknowledged shortcomings in its handling of the document.

Judith Miller, United States, 2005. The New York Times reporter refused to name the source who leaked a CIA officer's identity and spent 85 days in jail for contempt of court.

James Risen, United States, 2010 to 2014. A grand jury indicted former CIA officer Jeffrey Sterling for leaking to Risen, and the indictment contained details of phone conversations and email exchanges with the unnamed journalist, so records alone told the story. Prosecutors then subpoenaed Risen, an appeals court ordered him to testify, and the Supreme Court let that requirement stand, leaving him exposed to a contempt sentence.

Pegasus, India, 2021. The Pegasus Project found that at least 40 journalists were among 174 Indians named as potential surveillance targets, and forensic analysis confirmed infections on the phones of The Wire's founding editors. The government denies any wrongdoing. A Supreme Court committee examined 29 phones and found malware on five, though not Pegasus, and the court said no conclusive evidence had been found of Pegasus on those devices. The court had earlier observed that surveillance affects journalists' ability to gather information and speak to sources. One investigative reporter told CPJ her immediate concern was to avoid compromising her sources.

The Wire raids, India, 2022. After The Wire retracted its Meta reports, Delhi Police seized 18 devices from the newsroom and its staff. The Editors Guild objected that journalists' devices hold sensitive information about sources and stories in progress, and seizure can seriously compromise that confidentiality.

The pattern repeats across all five. A source is identified through records, devices or a legal order, and the person who trusted the reporter pays the price. According to the petitioners, Section 36 would add another channel to that list.

What the publishers are asking for

The petition, filed under Article 32, asks the court to declare Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) unconstitutional and to strike down Rules 16, 17 and 23. It runs to 698 pages and points to carve-outs for journalism in the European Union, Singapore and Britain. Earlier drafts of this very law carried one: the 2018 bill included a journalism exemption in Section 47, and the 2019 and 2021 bills kept it, before the 2022 draft dropped it. The petition also points out that research, archiving and statistical processing receive exemptions, while journalism serving the public interest receives none. The sole individual petitioner is Yukta Mudgal, an independent investigative journalist based in New Delhi.

The Chief Justice's response was practical. He told the petitioners they are the domain experts and should propose safeguards against misuse, adding that a balance must be struck between citizens' rights and the media's.

The paper trail the government never produced

In July 2025 MeitY met press bodies after a memorandum from 22 press bodies signed by more than a thousand journalists. When the Rules arrived in November, the Editors Guild said no formal response had followed that assurance and urged MeitY to issue a categorical clarification. The Guild had also sent 35 questions that went unanswered. DNPA then sent its own representation on 10 August 2026 and met ministry officials on 25 August, and the outcome, per the Newslaundry report, was another verbal assurance with no written carve-out. A journalist facing a complaint before the Board cannot cite a conversation in a ministry meeting room.

The reaction so far

The Opposition has pressed the issue since 2025. At a joint press conference, INDIA bloc leaders urged repeal of Section 44(3), and 120 MPs signed a petition seeking amendments. The government's reply invoked the Puttaswamy privacy judgment. DIGIPUB warned the framework gives the government sweeping access and enforcement powers without any statutory exemption for journalists.

The question for the owners

The independents moved first. In February, The Reporters' Collective and journalist Nitin Sethi petitioned the court, and RTI activist Venkatesh Nayak filed on 2 February, challenging Sections 17(1)(c), 17(2), 33(1), 36 and 44(3). On 16 February the court issued notice, referred the RTI-amendment questions to a larger bench and declined a stay. DNPA filed on 6 October, and Divan herself called it the first comprehensive petition by legacy media. Some of the petitioners' owners face Opposition allegations of proximity to the government, which the businesses and the government deny, and neither DNPA nor MeitY responded to Reuters' request for comment.

The court tests the law on 17 November. The smaller outlets and freelancers, who have no legal department to absorb a Board proceeding, will find out whether the protection reaches them too.