"Newsrooms Will Shut Down": Why the Supreme Court's DPDP Notice Is the Press Freedom Battle India Cannot Afford to Lose

The Collision Course: Data Protection Meets the Fourth Estate

On 27 October 2026, the Supreme Court issued notice in what may well become the defining press freedom litigation of this decade. The Digital News Publishers Association (DNPA) — a body whose members include some of India's largest legacy and digital media houses — has challenged the constitutional validity of key provisions of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, seeking an interim stay on their operation. The petitioners' argument is stark and, frankly, difficult to dismiss: as currently drafted, the DPDP framework could make routine investigative journalism functionally impossible.

Let us be clear about what is at stake. This is not a fringe challenge by privacy absolutists. This is the mainstream media establishment — including, as Bar and Bench reports, groups linked to Mukesh Ambani and Gautam Adani — telling the Supreme Court that the law threatens to shut down newsrooms. When publishers who are ordinarily aligned with the establishment find themselves on the same side as press freedom advocates, the Court should pay attention.

The Core Problem: Journalism Was Not Exempted

The DPDP Act, 2023, imposes obligations on "data fiduciaries" — entities that determine the purpose and means of processing personal data. News organisations, which collect, store, and publish personal data as a core function, fall squarely within this definition. Unlike the GDPR, which contains a broad journalistic exemption under Article 85 read with recital 153, the DPDP Act offers no such carve-out. There is no provision equivalent to Section 38 of the UK's Data Protection Act 2018, which exempts processing for "journalistic, artistic and literary purposes" where there is a reasonable belief that publication is in the public interest.

The practical consequences are severe. Under Sections 5 and 6 of the DPDP Act, a data fiduciary must provide notice and obtain consent before processing personal data, unless the processing falls within the "legitimate uses" enumerated in Section 7. Investigative journalism — which by its nature involves processing personal data of individuals who have not consented and would actively refuse consent — does not comfortably fit within any of these categories. A reporter investigating corruption, sexual harassment, or corporate fraud cannot reasonably be expected to send a notice to the subject of the investigation before processing their personal data. That is not journalism; that is a courtesy call to the accused.

"A reporter investigating corruption cannot reasonably be expected to send a notice to the subject of the investigation before processing their personal data. That is not journalism; that is a courtesy call to the accused."

Source Protection: The Unaddressed Casualty

The DNPA petition reportedly raises concerns about source protection — and rightly so. Under the DPDP framework, data principals have rights of access, correction, and erasure (Sections 11-15). If a public figure who is the subject of investigative reporting can invoke the right to erasure to demand that a news organisation delete their personal data, the chilling effect on source-based reporting is immediate and profound. Whistleblowers who share documents containing personal data of wrongdoers would be placing news organisations in potential violation of the law simply by acting as sources.

This sits uneasily with the Supreme Court's own jurisprudence. In R. Rajagopal v. State of Tamil Nadu (1994), the Court recognised that the press has a right to publish information about public officials and public figures, subject to limited exceptions. In Justice K.S. Puttaswamy v. Union of India (2017), the nine-judge bench recognised privacy as a fundamental right — but the Court was careful to note that privacy is not absolute and must be balanced against other fundamental rights, including the freedom of speech and expression under Article 19(1)(a). The DPDP Act, as drafted, appears to have performed no such balancing exercise for journalistic activity.

The Government's Response: Too Little, Too Late?

Union Minister Ashwini Vaishnaw's statement on 29 October 2026 — that the government is "open to suggestions from the media" on the DPDP Act — is welcome but rings hollow at this stage. The Act was passed in August 2023. The Rules were notified in November 2025. The phased implementation is already underway, with consent-manager registration scheduled to begin on 13 November 2026 and the Data Protection Board's complaint and penalty functions set to come into force on 13 May 2027. The time for "suggestions" was during the legislative process, not after the framework has been notified and enforcement timelines have been set.

Moreover, the government's own track record on consultation is poor. The DPDP Rules were criticised for being notified without adequate public consultation on several key provisions. The Removal of Difficulties Order issued on 5 October 2026 — which clarified consent rules for persons with disabilities and equated periodic Significant Data Fiduciary reviews with "data audits" — addressed technical ambiguities but did nothing to address the structural problem of journalistic exemptions.

The Enforcement Paradox: A Board Without Members

There is a deeper institutional concern that this litigation has thrown into sharp relief. As the Economic Times reported on 27 October 2026, the Data Protection Board of India — the adjudicatory body under the DPDP Act — remains unfilled or not fully operational, even as the enforcement timeline approaches. This is not merely an administrative lapse; it is a governance failure. A law that creates obligations backed by penalties of up to Rs. 250 crore per instance of non-compliance cannot credibly be enforced by a board that does not exist.

For lawyers advising media clients, this creates an impossible situation. The obligations are live — or will be shortly — but the enforcement machinery is incomplete. Should clients comply with a framework that may be judicially stayed or struck down? Should they invest in compliance infrastructure for obligations that the government itself seems uncertain about? These are not hypothetical questions; they are the daily reality of legal practice in this space.

What the Court Should Do

The Supreme Court has an opportunity — and, I would argue, an obligation — to read a journalistic exemption into the DPDP framework, even if the legislature failed to provide one. The Court has done this before. In Shreya Singhal v. Union of India (2015), the Court struck down Section 66A of the IT Act but read down Section 79 to preserve intermediary liability protections. In Anuradha Bhasin v. Union of India (2020), the Court held that restrictions on fundamental rights must be proportionate and necessary. A data protection law that does not exempt journalism fails the proportionality test: it restricts press freedom in a manner that is neither necessary nor the least restrictive means of achieving the legitimate aim of protecting personal data.

Alternatively, the Court could direct the government to issue a notification under Section 17(2) of the DPDP Act — which empowers the Central Government to exempt certain data fiduciaries or classes of data fiduciaries from specific provisions — to create a journalistic carve-out. This would be the less disruptive path, but it requires the government to act in good faith, which its track record does not inspire confidence in.

The Bigger Picture: India Needs a Privacy Law That Works

None of this is to say that India does not need a data protection law. It does — desperately. The absence of a comprehensive privacy framework has left Indian citizens vulnerable to data exploitation by both state and private actors. But a law that protects privacy by sacrificing press freedom is not a privacy law; it is a surveillance-enabling statute dressed up in the language of rights.

The DNPA challenge forces the Supreme Court to confront a question that the legislature ducked: can a data protection framework coexist with a free press? The answer, as every mature democracy has recognised, is yes — but only if the law explicitly protects journalistic activity. India's DPDP Act does not. The Court must either fix it or strike it down. There is no third option.