Journalism plays an important role in informing the public, promoting transparency and holding individuals and institutions accountable. In performing these functions, journalists collect, examine and publish mammoth amounts of information, including personal data. This often brings journalistic activities into conflict with individual privacy rights, especially when reporting involves sensitive or confidential information. Further, protecting personal data without restricting the ability of the press to investigate and report on matters of public interest also becomes difficult due to the nature of these activities.
Data protection laws protect individuals against the unauthorised collection, processing and disclosure of their personal information. However, applying these requirements to journalistic activities presents numerous issues, as news reporting and investigative journalism often involve obtaining and publishing information about individuals without their prior knowledge or consent.
Journalists may need to examine financial transactions, investigate allegations of misconduct, report on public officials or obtain information from confidential sources. Requiring consent from the individuals concerned could compromise investigations, delay publication or prevent information of public importance from reaching the public. At the same time, journalistic freedom cannot operate without reasonable safeguards for individual privacy, particularly where personal information is collected or disclosed without a legitimate public-interest justification.
This issue gained significance in India after the Digital News Publishers Association (DNPA) challenged the constitutional validity of various provisions of the data protection laws in India. The case has highlighted the lacunas that exist regarding the application of the Digital Personal Data Protection Act, 2023 (DPDP Act) to journalism and the need for a detailed examination of how India’s position compares with other jurisdictions.
Recommendations of the Justice B.N. Srikrishna Committee and Draft DPDP Bill in India
An express journalistic exemption was considered during the development of India’s data protection framework. In its 2018 report, the Justice B.N. Srikrishna Committee recognised the need to reconcile informational privacy with freedom of speech and expression. The Committee acknowledged the important role played by journalists and media organisations in disseminating information and promoting public accountability. It was observed that requiring journalists to comply with ordinary requirements for processing personal data, especially when it comes to consent requirements, could hinder reporting. Individuals whose conduct was being investigated might refuse consent, preventing the publication of critical information.
The Committee recommended a qualified exemption for processing for journalistic purposes, stating that certain requirements relating to notice, consent, purpose limitation and storage limitation could be incompatible with journalism, including the preservation of news archives. However, the Committee did not recommend an unrestricted exclusion, and emphasised the need for appropriate ethical standards, fair processing and security safeguards. The Committee also considered the position of independent journalists, recognising that journalistic protection should not necessarily be restricted to established media organisations.
These recommendations were carried forward in the Draft Personal Data Protection Bill, 2018, which proposed exemptions from specified obligations for journalistic processing, subject to compliance with applicable professional or self-regulatory ethical standards. Requirements relating to fair and reasonable processing and security safeguards were retained.
The Personal Data Protection Bill, 2019, provided a similar exemption, allowing processing of personal data when necessary for or relevant to a journalistic purpose and compliant with a code of ethics issued by the Press Council of India or a media self-regulatory organisation. The 2019 Bill was subsequently withdrawn, and the specific exemption was not retained in the DPDP Act, 2023.
Current Legal Position in India
The Digital Personal Data Protection Act, 2023 establishes a legal framework governing the processing of digital personal data in India. As per the DPDPA, personal data may generally be processed on the basis of the individual’s consent or for certain legitimate uses recognised under the Act. Further exemptions have been provided for specified purposes, including certain legal, judicial, regulatory, investigative, research and archival activities. However, the Act does not recognise journalism as an independent ground for processing personal data or provide a general exemption for news organisations.
The absence is significant as journalistic activities involve processing personal information without obtaining the consent of the concerned individuals. While Section 3(c)(ii) excludes personal data made publicly available by the individual or by a person legally required to disclose it, the exclusion does not extend to information obtained through confidential sources or investigative reporting. Similarly, the exemptions relating to research and archiving given do not specifically address news gathering and publication.
The Act also provides rights to access information and to correct and erase personal data. These rights are subject to statutory qualifications and do not create an unconditional entitlement to have every published news report removed. However, their potential application to news records and journalistic archives has raised concerns among publishers.
The October 2026 Supreme Court Proceedings
On October 27, 2026, the Supreme Court issued notice to the Central Government on a petition filed by the Digital News Publishers Association (DNPA) and an independent investigative journalist challenging provisions of the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025. The petition, Digital News Publishers Association and Another v. Union of India, Diary No. 45589/2026, challenged Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the DPDP Act, along with Rules 16, 17 and 23 of the DPDP Rules. It was contended that the lack of a specific journalistic exemption could interfere with freedom of speech and expression under Article 19(1)(a) of the Constitution and restrict the functioning of news organisations.
The primary issue raised was that consent and personal data processing requirements could make investigative journalism and time-sensitive news reporting difficult. According to the petitioners, needing journalists to obtain consent from individuals whose activities are being investigated could compromise reporting and permit those individuals to prevent the publication of unfavourable information.
The petitioners also challenged Section 36 of the DPDP Act, read with Rule 23, which gives the Central Government the power to require information from data fiduciaries and intermediaries. It was argued that these provisions could affect the confidentiality of journalistic sources. Further concerns were raised regarding restrictions on access to information, the powers and composition of the Data Protection Board of India, and the potential application of personal data rights to journalistic records.
Another significant aspect of the proceedings concerns Section 44(3) of the DPDP Act, which amended Section 8(1)(j) of the Right to Information Act, 2005. The earlier provision contained qualifications relating to public activity, public interest and unwarranted invasion of privacy. The amended provision exempts information relating to personal information. The petitioners argued that this change could restrict access to information concerning public officials and matters of public importance. However, the broader public-interest override under Section 8(2) of the RTI Act remains in the legislation, and its interaction with the amended provision is relevant to the challenge.
During the hearing, the Supreme Court emphasised the need to balance individual privacy rights with the rights of the media and asked the petitioners to suggest safeguards against misuse. The Court issued notice on the petition and the application seeking interim relief. The matter is listed for November 17, 2026. As of October 28, 2026, the constitutional questions had not been decided, and no interim stay had been granted.
Comparative Position in Other Jurisdictions
The treatment of journalism under data protection laws differs across jurisdictions. Although several countries expressly recognise journalistic activities, the scope of protection depends on whether the legislation creates a general exclusion, a conditional exemption from specified obligations or an alternative legal basis for processing without consent. These distinctions are important when comparing international frameworks with India’s DPDP Act.
European Union
The European Union expressly recognises the relationship between data protection and freedom of expression under Article 85 of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. The provision requires Member States to reconcile the right to personal data protection with freedom of expression and information, including processing for journalistic purposes.
Article 85 requires Member States to provide exemptions or derogations from specified GDPR obligations where necessary to achieve this balance. Such exemptions may concern processing principles, data-subject rights and certain obligations imposed on controllers and processors. Article 17(3)(a) also recognises an exception to the right to erasure where processing is necessary for exercising freedom of expression and information.
However, Article 85 does not establish a uniform or unrestricted journalistic exemption across the European Union. The scope of protection depends on the implementing laws of individual Member States. The European approach therefore establishes a legislative obligation to reconcile privacy and freedom of expression, leaving Member States to determine the necessary safeguards.
United Kingdom
The United Kingdom provides a specific exemption for journalism under Schedule 2, Part 5, Paragraph 26 of the Data Protection Act, 2018, read with the UK GDPR. The exemption applies to processing for journalistic, academic, artistic or literary purposes where the processing is done for publication, the controller believes that publication would be in the public interest, and compliance with the relevant data protection provision would be incompatible with the protected purpose.
The law also requires giving importance to freedom of expression and information and relevant editorial standards, including the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors’ Code of Practice. The exemption is conditional and applies to specified obligations rather than removing all privacy responsibilities.
United States
The United States does not have a single comprehensive federal data protection law similar to the GDPR or the Indian DPDP Act. Privacy regulations are put in place through federal sector-specific laws and state laws, along with constitutional protections for freedom of speech and the press under the First Amendment. The California Constitution in fact overrides provisions mentioned in the California Consumer Privacy Act (CCPA), The constitutional provision protects publishers, editors, reporters, and certain other media professionals, including protection against compelled disclosure of journalistic sources and unpublished information in specific circumstances.
Australia
Australia has an express exemption for journalism under Section 7B(4) of the Privacy Act, 1988, which exempts acts or practices by a media organisation in the course of journalism, provided that the organisation has publicly committed to observing published privacy standards. These standards must address privacy in media activities and may be adopted by an individual media organisation or a representative industry body. The exemption is not intended to cover every activity by a media business. Processing for unrelated purposes, such as certain commercial or advertising activities, may remain under privacy obligations.
South Africa
South Africa has express protection for journalism under Section 7 of the Protection of Personal Information Act, 2013 (POPIA), which excludes personal information processed solely for journalistic, literary or artistic expression to the extent necessary to reconcile privacy with freedom of expression in the public interest. It also recognises the role of professional codes of ethics containing adequate safeguards for personal information.
Where qualifying journalistic processing is governed by such a code, the code applies in place of the ordinary requirements of POPIA, subject to the statutory framework. In determining whether appropriate safeguards exist, the legislation recognises the importance of freedom of expression, the public’s right to be informed, journalistic professional integrity and media self-regulation.
China
China’s Personal Information Protection Law (PIPL), 2021 expressly recognises public-interest news reporting as a lawful ground for processing personal information. Article 13(5) permits personal information to be processed within a reasonable scope for news reporting, media supervision and other activities conducted in the public interest. Under Article 13, consent is not required where processing falls within this ground. However, the provision is not a general exclusion for journalism, and processing remains subject to the requirement of reasonable scope and other applicable legal obligations.
South Korea
South Korea expressly recognises journalistic activities under Article 58(1)(4) of the Personal Information Protection Act (PIPA). The provision excludes personal information collected or used by the press for its inherent purposes, including news gathering and reporting, from the application of Chapters III to VIII of the legislation. The exemption is substantial but not unrestricted, as Article 58(4) still requires appropriate measures for the necessary scope of processing, personal information protection, security and complaint handling.
Singapore
Singapore provides a specific exception for news organisations under its Personal Data Protection Act, 2012 (PDPA). Paragraphs 5 and 6 of Part 2 of the First Schedule allow qualifying news organisations to collect, use or disclose personal data without obtaining consent where the processing is done solely for their news activities. News activity is defined to include gathering news, preparing or compiling articles or programmes concerning news and current affairs and disseminating such material to the public. However, the exception applies to organisations falling within the definition of a news organisation, related to specified newspaper, broadcasting and newswire activities. The exemption deals with consent and does not remove all obligations imposed by the PDPA.
Malaysia
Malaysia provides a specific journalism exemption under Section 45(2)(f) of the Personal Data Protection Act, 2010. The provision exempts personal data processed solely for journalistic, literary, or artistic purposes from specified data protection principles, including those on consent, notice, disclosure, retention, data integrity and access.
However, the exemption is conditional, and processing must be done with a view to publication. Further, the data controller must reasonably believe that publication would be in the public interest and that compliance with the particular obligation is incompatible with the journalistic purpose.
Taiwan
Taiwan has a narrower approach under Article 9(2)(5) of its Personal Data Protection Act, which permits an exception where personal information is collected by a mass communication enterprise for news reporting in the public interest. The exception recognises that notifying individuals about the collection of information obtained from third parties could interfere with journalistic investigations. However, it is limited to the notification requirement and does not provide a comprehensive exemption from the legislation.
Conclusion
Several jurisdictions worldwide expressly recognise journalistic activities within their data protection frameworks, although the nat ure and extent of protection vary. The DPDP Act, 2023, is a nascent law and the path chosen by India is very different from what is envisaged in other laws. At present it does not therefore expressly identify journalism as a separate category of protected processing. However as practitioners of this law understand that there is always going to be a gestation period wherein the law will go through some churn and jurisprudence set. Although some existing exclusions and exemptions may apply in certain cases in other situations, they do not address the operational requirements of investigative journalism, confidential sources, news archives and publication of information without the subject’s consent.
The ongoing Supreme Court case is a step in that direction and highlights an important question regarding the relationship between informational privacy under Article 21 and freedom of speech and expression under Article 19(1)(a) of the Constitution. In light of this, the central issue is whether the existing legal framework in India adequately protects both individual privacy and legitimate journalistic activities, or whether a specific, appropriately qualified exemption is needed to deal with the practical challenges faced by news publishers and journalists. The outcome of these proceedings could play an important role in shaping how India balances data protection with the public-interest function of the press.
Authors: Manisha Singh and Shivi Gupta