Data protection law faces scrutiny: The key concerns explained

NewsIndia NewsData protection law faces scrutiny: The key concerns explained Data protection law faces scrutiny: The key concerns explained Abhishek Mishra / TIMESOFINDIA.COM / Nov 07, 2026, 18:54 IST The legal challenge raises questions over how the law could affect investigative journalism, RTI access and government accountability India's new data protection framework was introduced with a clear objective: to give citizens greater control over their personal information and make organisations accountable for how they collect, store and use it.

But as the government moves towards implementing the law, a growing debate has emerged over whether safeguards designed to protect individual privacy could also affect investigative journalism, access to public records and government accountability.The Digital Personal Data Protection (DPDP) Act, 2023, is facing a legal challenge from the Digital News Publishers Association (DNPA), which represents 21 news organisations.

The association has approached the Supreme Court, arguing that several provisions of the law and its accompanying rules could restrict journalistic activities, compromise confidential sources and undermine the Right to Information (RTI) framework.The Supreme Court issued notice to the Centre on October 27 and listed the matter for further hearing on November 17.

The government, meanwhile, has indicated that it is open to amending the rules or even the law itself if necessary to address concerns over press freedom. The challenge has brought an important question into focus: Where should the line be drawn between an individual's right to privacy and the public's right to know?

While one view holds that constitutional protections and judicial scrutiny can address competing interests, another argues that journalism needs explicit statutory safeguards.What is the DPDP Act and why was it introduced?

Parliament passed the Digital Personal Data Protection Act in August 2023, establishing a legal framework to regulate the processing of digital personal information.The legislation came against the backdrop of India's rapidly expanding digital economy, where personal information has become central to everyday activities.

Banking transactions, online shopping, digital payments, social media accounts, healthcare services and government welfare schemes all involve the collection and processing of personal data.While this has made services more accessible, it has also increased the risks of data breaches, identity theft, unauthorised sharing and misuse of personal information.The need for a comprehensive data protection framework gained importance after the Supreme Court, in its landmark 2017 Puttaswamy judgment, recognised privacy as a fundamental right under the Constitution.The DPDP Act seeks to establish obligations for organisations handling personal data and provide individuals with rights over how their information is processed.The ministry of electronics and information technology (MeitY) notified the Digital Personal Data Protection Rules, 2025, on November 14, 2025, following consultations with stakeholders.According to a Press Information Bureau (PIB) backgrounder published on November 17, 2025, the government received 6,915 inputs during the consultation process.

These included suggestions from startups, micro, small and medium enterprises, industry bodies, civil society organisations, government departments and citizens.The government described the framework as citizen-centric, with an emphasis on consent, transparency, accountability and responsible use of digital personal information.What does the law provide?

The Act revolves around two key categories: Data Fiduciaries and Data Principals.A Data Fiduciary is an organisation or individual that determines the purpose and means of processing personal data. This could include a bank collecting customer details, an e-commerce platform storing purchase histories or a company maintaining employee records.A Data Principal is the individual to whom the personal information belongs.The legislation requires Data Fiduciaries to obtain consent before processing personal data, except in specified circumstances where processing is permitted under the law.

Such consent must be free, specific, informed, unconditional and unambiguous.Individuals must also be informed about the purpose for which their information is being collected and how it will be used.The Act provides Data Principals with several rights, including the right to access information about the processing of their personal data, seek correction and erasure, withdraw consent and raise grievances.

They can also nominate another person to exercise their rights in certain circumstances.Organisations are required to implement reasonable security safeguards to protect personal information. In case of a data breach, they must notify the Data Protection Board of India and affected individuals in accordance with the prescribed framework.The legislation also provides additional safeguards for children's data.

Organisations are generally required to obtain verifiable parental consent before processing the personal data of children below 18 years. The law also restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions.The framework provides for the Data Protection Board of India, which is responsible for examining complaints, conducting inquiries and determining penalties for non-compliance.The financial consequences can be significant.

Under the Act, failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to Rs 250 crore. Violations relating to breach notifications and obligations concerning children's data can attract penalties of up to Rs 200 crore.Why are news publishers challenging the law?

The most prominent concern raised by the DNPA is the absence of a specific exemption for journalistic...