India: Could Privacy Law Become a Tool of Censorship?

Section: Law & Justice
Format: Analysis
Author: Sinisa Brkic (sb)

Twenty-one of India's leading news publishers have taken their fight against the country's digital privacy law to the Supreme Court, warning that it could severely restrict investigative journalism, expose confidential sources, and threaten the survival of newsrooms. The legal challenge has united some of India's most influential media organizations against legislation introduced under Prime Minister Narendra Modi. The dispute raises a constitutional question with implications far beyond India: can a law designed to protect personal information also become a means of restricting legitimate public scrutiny?

Supreme Court Takes Up Major Challenge to India's Privacy Law

India's Supreme Court has formally sought a response from the central government after 21 major news publishers challenged key provisions of the Digital Personal Data Protection Act, arguing that the legislation could undermine press freedom and fundamentally change how journalists investigate matters of public interest. At a hearing on October 27, 2026, a three-judge bench led by Chief Justice Surya Kant considered arguments presented by the Digital News Publishers Association (DNPA). The organization represents prominent Indian media companies seeking to overturn provisions they consider incompatible with constitutional guarantees of freedom of expression and access to information. Senior advocate Madhavi Divan, representing the publishers, warned that the legislation could make ordinary newsroom operations unworkable. Her arguments extended beyond investigative reporting to include the practical difficulties of producing live news coverage if journalists were required to obtain consent before processing personal information. The court issued notice to the central government and scheduled further proceedings for November 17. It has not ruled on the constitutionality of the challenged provisions or accepted the publishers' interpretation of their potential effects. The proceedings follow a petition filed on October 6 and detailed in a 698-page submission. While legal challenges to the legislation have previously emerged from press freedom advocates and smaller media organizations, the participation of major national publishers substantially broadens the dispute.

The Consent Requirement at the Center of the Conflict

India's Digital Personal Data Protection Act was enacted in August 2023 to establish a framework governing the processing of digital personal information. Its provisions are intended to give individuals greater control over their data while imposing obligations on organizations that collect, store, or use it. For commercial platforms, consent requirements are a familiar element of digital privacy regulation. For investigative journalists, however, the same principle can create fundamentally different problems. The publishers argue that requiring consent from individuals who are the subjects of journalistic investigations could compromise reporting before it begins. A journalist investigating suspected corruption, corporate misconduct, or abuse of public office may need to collect and verify personal information without notifying the individuals involved. Advance notification could alert those under investigation, potentially creating opportunities to destroy evidence, influence witnesses, or obstruct further inquiries. The DNPA maintains that applying general consent requirements to journalism without adequate safeguards could therefore operate as a form of censorship before publication. That interpretation remains legally contested. The legislation does not expressly require journalists to obtain permission before publishing every critical report, nor has a court determined that its provisions establish a general system of prior approval. The dispute concerns whether the law's rules on processing personal data could impose such restrictions in practice when applied to legitimate journalistic activities.

An Existing Exception Does Not Resolve Every Concern

The legislation already contains limitations on its application. Section 3 excludes certain personal information that individuals have themselves made publicly available, as well as information disclosed by another person under a legal obligation to make it public. This distinction is important because the law does not automatically regulate every use of personal information appearing in public records or online sources. Some material used in ordinary news reporting may fall outside its scope. The exception is nevertheless narrower than a general exemption for journalism. Information obtained through confidential documents, whistleblowers, unpublished records, or independent investigations would not necessarily qualify simply because its eventual publication serves the public interest. The publishers argue that this leaves essential reporting activities exposed to legal uncertainty. Their concern is not that every news article would violate the legislation, but that the absence of explicit journalistic protections could make some of the most important forms of investigative reporting legally vulnerable.

Confidential Sources Could Face Greater Exposure

A second major concern involves the government's authority to demand information from organizations handling personal data. Section 36 of the legislation permits India's central government to require information from the Data Protection Board, data fiduciaries, and intermediaries for purposes connected with the Act. The DNPA fears these powers could extend to information held by news organizations, including material capable of identifying confidential journalistic sources. The publishers argue that insufficient safeguards could weaken relationships between reporters and whistleblowers, particularly when disclosures concern government misconduct or powerful corporate interests. The legal provision does not explicitly authorize unrestricted access to journalists' confidential communications. Its reach, limitations, and interaction with constitutional protections are among the issues requiring judicial examination. The consequences of uncertainty, however, could extend beyond individual investigations. People considering whether to disclose sensitive information may become less willing to approach journalists if they believe their identities could be revealed through government demands. For investigative journalism, confidentiality can determine whether evidence of wrongdoing reaches the public at all. The publishers contend that protections for confidential sources must therefore be established through enforceable law rather than left to administrative discretion.

Could Published Investigations Be Removed?

The legislation's provisions concerning personal data correction and erasure have created another point of contention. Section 12 provides individuals with rights to request the correction or erasure of personal information in defined circumstances. These rights are subject to conditions, including situations where retaining information remains necessary for an established purpose or compliance with legal obligations. The publishers fear that such provisions could be invoked to pressure news organizations into removing or substantially altering previously published investigations. A public official or business executive criticized in an accurate report might seek deletion of personal information contained in the article, potentially creating legal disputes over reporting that remains relevant to public accountability. The legislation does not expressly create an unrestricted right to erase published journalism. Whether particular requests could lawfully affect news archives would depend on the applicable provisions, their interpretation, and any constitutional protections recognized by the courts. The distinction matters because journalism serves a function beyond the immediate circulation of information. News archives preserve records of political decisions, corporate conduct, and events that may remain significant long after their original publication.

Substantial Fines and Possible Access Restrictions

The publishers' concerns are reinforced by the financial and regulatory consequences contemplated under the legislation. India's Data Protection Board will be empowered to investigate significant breaches and impose monetary penalties according to the nature and seriousness of the violation. The maximum penalty under the Act reaches 2.5 billion rupees, although that ceiling applies specifically to failures involving reasonable safeguards against personal data breaches. Other categories of noncompliance carry different maximum penalties. The amounts are not automatic and can be imposed only through the procedures established by the legislation. For smaller and regional news organizations, substantial penalties could create considerable financial exposure if their activities are found to fall within the law's requirements. Section 37 also establishes a mechanism under which public access to certain information may be blocked. Such a measure is not available merely because an article attracts a privacy complaint. The provision requires prior penalties in at least two instances, a written referral and recommendation from the Data Protection Board, an opportunity for the affected organization to be heard, and a government determination concerning the general public interest. These procedural conditions are significant. Nevertheless, publishers argue that the prospect of financial sanctions and access restrictions could encourage excessively cautious editorial decisions, particularly where the legal status of investigative reporting remains uncertain.

India's Media Giants Form an Unusual Alliance

The challenge has attracted particular attention because of the organizations involved. Among the participating publishers are Network18, part of the business empire associated with billionaire Mukesh Ambani, and NDTV, controlled by the Adani Group led by Gautam Adani. The coalition also includes organizations associated with The Indian Express and Times Internet. These media companies operate across different markets, ownership structures, and editorial traditions. Their participation in a common constitutional challenge suggests that concerns about the legislation extend well beyond smaller independent outlets. The presence of corporations associated with two of India's most influential business figures is especially notable. Their wider business interests span industries in which government regulation and public policy play major roles. The publishers' shared legal position does not imply identical political views or editorial priorities. It does, however, demonstrate the scale of concern surrounding the possibility that privacy regulation could interfere with established journalistic practices.

A Separate Dispute Over the Public's Right to Information

The constitutional challenge also encompasses an amendment to India's Right to Information Act, a major instrument for obtaining information from public authorities. Section 44 of the data protection legislation amended the existing exemption relating to personal information under the Right to Information Act. The amended wording has been in force since November 2025. The DNPA argues that this change could make it harder to obtain information concerning public officials and government activities, weakening an important mechanism for investigative scrutiny. The issue differs from the disputed consent and data processing requirements, many of which have not yet taken effect. It concerns the legal boundaries governing disclosure of information already held by public authorities. Privacy protections can legitimately restrict access to sensitive personal details. The constitutional question is how those restrictions interact with transparency requirements when information is relevant to public accountability. By challenging the amendment alongside the broader privacy framework, the publishers have placed both the collection of information and access to government records within the same judicial dispute.

Europe Provides a Different Legal Approach

The European Union offers an important comparison because its General Data Protection Regulation explicitly recognizes the relationship between privacy and freedom of expression. Article 85 of the GDPR requires member states to reconcile personal data protection with freedom of expression and information, including the processing of personal data for journalistic purposes. Where necessary, national legislation must provide exemptions or derogations from specified data protection obligations to preserve those freedoms. European journalists do not enjoy unlimited immunity from privacy law. Their activities remain subject to national safeguards, legal interpretation, and the balancing of competing fundamental rights. The decisive difference is that the European framework expressly acknowledges journalism as an activity requiring particular legal consideration. India's legislation contains exemptions for certain forms of data processing, but it does not establish an equivalent general exemption specifically for journalism. The Indian publishers argue that this omission exposes reporting activities to obligations designed primarily for other forms of personal data processing. The comparison demonstrates that privacy and press freedom do not have to be treated as opposing objectives. Legal systems can recognize both rights while establishing specific protections intended to prevent either from unnecessarily undermining the other.

Government Assurances Have Not Ended the Dispute

The Modi government's stated objective is to strengthen privacy protection in an increasingly digital economy. The legislation addresses genuine concerns about unauthorized data collection, misuse of personal information, and the responsibilities of organizations handling sensitive information. Privacy itself enjoys constitutional protection in India. In 2017, the Supreme Court recognized it as a fundamental right, creating an important legal foundation for subsequent data protection measures. The government has maintained that press freedom is respected. According to the publishers' court filing, officials provided assurances during discussions in August that the new privacy framework would not undermine legitimate journalism. Those assurances have not resolved the publishers' concerns. They argue that protections for investigative reporting should be explicitly established in legislation rather than depend on future administrative interpretations. The government's formal response to the current constitutional challenge remains an important part of the pending proceedings. The dispute therefore cannot be reduced to a simple choice between protecting citizens' information and allowing unrestricted access to personal data. It concerns how two constitutionally significant interests can operate within the same legal system.

The Most Controversial Requirements Are Still Ahead

The timing of the proceedings is particularly important. Although the Digital Personal Data Protection Act was enacted in 2023, its implementation has been divided into stages. Many of the provisions concerning consent, erasure, government information demands, financial penalties, and access restrictions are scheduled to become operative in May 2027. The publishers are challenging those provisions before their full implementation, seeking judicial intervention against consequences they believe could seriously damage journalism. No court has established that the legislation creates a system of censorship or requires universal advance consent for journalistic reporting. Those remain allegations and legal interpretations advanced by the challenging organizations. The Supreme Court's decision to request a government response should not be mistaken for a ruling in their favor. It marks a procedural step in a constitutional dispute whose substantive questions remain unresolved. The next hearing is scheduled for November 17, 2026.

A Test of Privacy Rights and Democratic Accountability

The confrontation in India highlights a problem that extends well beyond national borders. Digital privacy legislation is becoming an essential part of modern governance, but its practical effect depends on how carefully governments distinguish legitimate protection of personal information from restrictions on information that the public has a right to know. The publishers' challenge raises concerns about the ability of journalists to investigate powerful institutions, preserve confidential sources, and maintain accurate public records without facing disproportionate legal or financial consequences. At the same time, the constitutional protection of journalism cannot eliminate individuals' legitimate rights to privacy. The challenge for lawmakers and courts is to establish workable boundaries that protect both interests. India's Supreme Court must now examine whether the existing legislation provides sufficient safeguards or whether its provisions risk imposing excessive restrictions on freedom of expression and public scrutiny. The eventual decision could shape the legal environment for one of the world's largest media markets and influence wider debates over the relationship between digital rights and press freedom. At its core, the case presents a fundamental question about democratic accountability: whether a law created to protect citizens from the misuse of personal information also provides adequate protection for journalists investigating those who exercise public and economic power.