Digital Privacy vs. Investigative Journalism: Can Data Protection Law Protect Privacy Without Silencing Public-Interest Reporting?

On 27 October 2026, a Bench led by Chief Justice Surya Kant issued notice on a petition by the Digital News Publishers Association challenging parts of the Digital Personal Data Protection Act, 2023 and its 2025 Rules. The petition joins a batch of challenges already before the Court, all listed for 17 November. The question is old: when does privacy outweigh the public’s interest in knowing? What is new is that Parliament has now answered it through a compliance statute, and that answer fits poorly with the kind of reporting that most needs protection.

A newsroom is just another Data Fiduciary

The DPDP Act applies to anyone who decides why and how digital personal data is processed, and nothing in it sets newsrooms apart. A reporter building a spreadsheet of shell-company directors must, in principle, give notice under section 5 and obtain consent under section 6, unless the processing falls within one of the “legitimate uses” in section 7. None of those uses mentions journalism or the public interest. Section 12 then allows the person concerned to seek erasure.

The gap is deliberate. The 2018, 2019 and 2021 drafts all exempted journalistic purposes and specifically the 2022 draft dropped the exemption without explanation. Yet the Act exempts research, archiving and statistics under section 17(2)(b), so a statistician has more statutory room than an investigative reporter. MeitY reportedly assured press bodies in July 2025 that journalism falls outside the Act, but the Editors Guild has noted that no binding clarification followed. An oral assurance cannot be pleaded before the Data Protection Board.

Two qualifications matter. Section 3(c)(ii) excludes data that a person has made public, or that must be published under law, so reporting from public records partly survives. And the notice and consent duties only take effect in May 2027. But investigations rarely rest on public records. They rest on leaked files, whistleblower emails and internal databases, which is exactly the digital, non-public data the Act governs. Newsrooms are deciding now whether such stories are worth the risk.

Constitutional balancing, replaced by paperwork

Indian constitutional law has never treated privacy and press freedom as a zero-sum contest. In R. Rajagopal v. State of Tamil Nadu, the Supreme Court refused to let the State restrain publication in advance and held that public officials cannot claim privacy over their official conduct and left the aggrieved person to remedies after publication. Puttaswamy located privacy within Article 21 but required every restriction on a fundamental right to satisfy legality, a legitimate aim and proportionality. In Subhash Chandra Agarwal, the Court weighed personal information against the larger public interest under the RTI Act.

In each case, a court struck the balance on the facts, usually after publication. The DPDP framework reverses that sequence. The subject of the story moves first, by refusing consent or demanding erasure, and the dispute then goes to a Board whose members are appointed by the Central Government. Consent is the wrong currency here, because the people investigative journalism scrutinises are the ones least likely to give it. The Act does not ban reporting. It makes the subject of a story its first gatekeeper.

Section 44(3) deepens the problem. It amends section 8(1)(j) of the RTI Act and removes the public-interest override that Agarwal had applied. That amendment is already in force, and the Court declined to stay it in February 2026. At an August hearing, counsel argued that even pending charge sheets against public officials could now be withheld as personal information. Therefore, because of which Journalists lose both the freedom to process data and a lawful route to obtain it.

Exemption without impunity

The answer is not a blanket carve-out. “Journalism” is easy to claim, and an unconditional exemption would protect doxxing as readily as an exposé. Justice Bagchi also observed at the August hearing that neither the RTI Act nor Agarwal gives journalists anything beyond Article 19(1)(a), which every citizen shares. That points towards a test based on purpose rather than profession. A workable provision would release processing for publication that the publisher reasonably believes serves the public interest from the consent, notice and erasure duties, while keeping security safeguards and accuracy obligations intact. Whether that public-interest claim holds should be decided by a court, not by an executive-appointed Board. Section 8(1)(j) should also regain its balancing test.

Data protection law should protect the person whose records leak in a breach. It should not shield the official whose decisions appear in the story about that breach. When the Court takes up the batch on 17 November, the real question is not whether privacy or press freedom wins, but who decides between them, and at what stage.

Divyansh Gurjar

Second-Year B.A.LL.B. (Hons.)

National Law University, Jodhpur