Why in news?
Supreme Court issued notice on Digital News Publishers Association (DNPA)’s plea against DPDP Act and Rules over missing journalism exemption and RTI dilution.
UPSC Relevance
Prelims – DPDP Act 2023, DPDP Rules 2025, Data Protection Board, RTI Act Section 8(1)(j).
Mains GS2 – Fundamental rights; transparency and accountability; role of media; statutory bodies; government policies and their design.
DPDP Act, 2023
- Background – Privacy declared a fundamental right in K.S. Puttaswamy v. Union of India (2017). This led to the Justice B.N. Srikrishna Committee (2018), the PDP Bill 2019, the JPC report (2021), withdrawal in 2022 and finally the DPDP Act passed in August 2023.
- Scope – Applies to digital personal data processed in India, and to processing outside India if it involves offering goods or services to people in India.
- Not covered – Data processed for personal or domestic purposes, and data made publicly available by the person himself or under a legal obligation.
- Consent-based model – Data can be processed only with consent that is free, specific, informed, unconditional and unambiguous, after giving a clear notice. Consent can be withdrawn anytime.
- Legitimate uses (Section 7) – Processing without consent is allowed for certain purposes such as State subsidies and services, medical emergencies, disasters, employment and compliance with law.
- Children – Anyone below 18 is a child. Verifiable parental consent is needed; tracking, behavioural monitoring and targeted ads aimed at children are barred.
- Cross-border transfer – Negative list approach: transfer is allowed except to countries the Centre restricts.
- Exemptions (Section 17) – Centre can exempt government agencies for sovereignty, security, public order etc. Research, archiving and statistical purposes get a conditional exemption. There is no exemption for journalism.
- Data Protection Board of India (Sections 18-19) – Adjudicates breaches and imposes penalties. Members are appointed by the Central Government for two years (eligible for reappointment). Appeals go to TDSAT (Section 29).
- Penalties – Up to ₹250 crore per instance (for failure to take reasonable security safeguards). Data Principals can be fined up to ₹10,000 for false complaints.
- Centre’s powers – Section 36 lets the Centre call for information from fiduciaries; Section 37 lets it block access to a platform on the Board’s advice in certain cases.
DPDP Rules, 2025 and phased rollout
MeitY notified the DPDP Rules on 13 November 2025, after draft rules in January 2025. The law is being brought into force in three phases over 18 months.
| Phase | What came into force |
|---|---|
| Immediately (November 2025) | Definitions, Data Protection Board provisions, and Section 44(3) amendment to the RTI Act |
| After 12 months (November 2026) | Registration and obligations of Consent Managers |
| After 18 months (May 2027) | Core duties: notice and consent, security safeguards, breach reporting, children’s data, rights of Data Principals |
Important features of the Rules
- Breach reporting – Fiduciaries must inform affected persons without delay and send a detailed report to the Board within 72 hours.
- Data deletion – Large e-commerce, social media and online gaming platforms must erase data of inactive users after a fixed period (generally three years), with prior notice.
- Consent Managers – Must be Indian companies meeting minimum net-worth and technical standards.
- Significant Data Fiduciaries – Annual impact assessment and audit; checks on algorithms; some data may be required to stay in India.
- Rule 16 – Sets standards for the research and statistical exemption.
- Rule 23 and Seventh Schedule – Specify when the government can call for information from fiduciaries.
- Board set-up – In May 2026, MeitY invited applications for the Chairperson and Members of the Board.
- Possible faster timeline – Reports have suggested the 18-month compliance window may be shortened, but this has not been formally notified.
The RTI amendment – Section 44(3)
| Basis | Old Section 8(1)(j) | New Section 8(1)(j) |
|---|---|---|
| Exemption | Personal information with no link to public activity or interest, or causing unwarranted invasion of privacy | Simply “information which relates to personal information” |
| Public interest test | PIO could disclose if larger public interest justified it | Removed |
| Proviso | Information that cannot be denied to Parliament or State Legislature cannot be denied to any person | Removed |
| Effect | Case-by-case balancing | Near-blanket bar on personal information |
- Why it matters – Asset declarations, tender documents, beneficiary lists, attendance and service records of officials all contain personal data. RTI activists and journalists rely on these to expose corruption.
- Government’s view – The change aligns RTI with the right to privacy and prevents misuse of RTI to harass individuals. Section 8(2) of the RTI Act still allows disclosure if public interest outweighs harm.
Concerns raised
1. No exemption for journalism
- Reporters could be treated as Data Fiduciaries, needing to notify and seek consent from the very people they are investigating, and to erase data on request.
- Earlier drafts of 2018, 2019 and 2021 carried a journalistic exemption, which was dropped in 2023.
- Research and statistics get an exemption, making the denial to journalism hard to justify.
- Global practice: the EU’s GDPR (Article 85) requires member states to reconcile data protection with journalism; the UK’s Data Protection Act, 2018 has a “special purposes” exemption.
- Penalties up to ₹250 crore could wipe out small and independent newsrooms, creating a chilling effect.
2. Dilution of the Right to Information
- Removing the public interest test shifts the balance away from transparency. The right to information is part of Article 19(1)(a).
- Social audits, MGNREGA muster rolls and ration beneficiary lists may be harder to access.
3. Wide powers of the State
- Section 17(2)(a) allows the Centre to exempt its own agencies, raising surveillance concerns and questions under the proportionality test of Puttaswamy.
- Section 36 (calling for information) and Section 37 (blocking) lack clear safeguards such as judicial oversight or notice to affected persons.
4. Independence of the Data Protection Board
- Members are chosen and appointed by the Centre with a short two-year term, even though the government itself is the largest data fiduciary.
5. Other gaps
- Delayed protection – Main citizen rights apply only from May 2027.
- No compensation – Penalties go to the government; affected persons get no compensation, unlike under GDPR.
- Age of consent at 18 – Higher than many countries; may restrict teenagers’ access to online services.
- Who is a journalist? – The rise of independent creators makes the category hard to define. A 2026 Reuters Institute report shows 18-24-year-olds using social media as their main news source rose from 21% (2015) to 39% (2025).
The balancing debate
| Case for the current law | Case for changes |
|---|---|
| Privacy is a fundamental right (Puttaswamy); journalists too must respect it | Press freedom and RTI are also fundamental rights under Article 19(1)(a) |
| A broad journalism exemption may be misused by anyone claiming to be a journalist | A narrow, public-interest-based exemption can prevent misuse |
| RTI was sometimes misused to target private individuals | Public servants and those handling public money must remain open to scrutiny |
Way forward
- Narrow journalistic exemption – Tied to public interest and ethical codes (such as the Press Council norms), as recommended by the Srikrishna Committee.
- Restore the public interest override – Public functionaries and those handling public funds should not be shielded under the guise of privacy.
- Independent regulator – A selection committee with judicial members and a longer, fixed tenure for the Board.
- Safeguards on State exemptions – Written reasons, time limits and independent oversight.
- Graded penalties – Lower penalties and simpler compliance for small newsrooms and startups.
- Consultation – A stakeholder dialogue among government, editors, digital creators and civil society, as signalled by the minister’s outreach.
Conclusion
India needs a strong data protection law, but privacy cannot become a shield against accountability. A balanced framework should protect ordinary citizens’ data while keeping public power open to scrutiny by the press and the people.
Practice MCQ
Q1. Consider the following statements regarding the Digital Personal Data Protection Act, 2023:
- It applies to processing of digital personal data outside India if it is connected with offering goods or services to Data Principals in India.
- Appeals against the orders of the Data Protection Board of India lie with the concerned High Court.
- Cross-border transfer of personal data follows a negative list approach.
How many of the above statements are correct?
(a) Only one
(b) Only two
(c) All three
(d) None
Answer: (b)
Explanation: Statement 2 is incorrect. Appeals against the Board’s orders go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Q2. Consider the following statements:
Statement I: After Section 44(3) of the DPDP Act, 2023, Section 8(1)(j) of the RTI Act no longer contains a “larger public interest” ground for disclosing personal information.
Statement II: The DPDP Act, 2023 provides a specific exemption for processing of personal data for journalistic purposes.
Which one of the following is correct in respect of the above statements?
(a) Both Statement I and Statement II are correct and Statement II explains Statement I
(b) Both Statement I and Statement II are correct and Statement II does not explain Statement I
(c) Statement I is correct but Statement II is incorrect
(d) Statement I is incorrect but Statement II is correct
Answer: (c)
Explanation: The journalistic exemption found in the 2018, 2019 and 2021 drafts was dropped from the 2023 Act. Only research, archiving and statistical purposes get a conditional exemption.
Mains Practice Question
“The Digital Personal Data Protection Act, 2023 protects informational privacy but risks weakening transparency and press freedom.” Critically examine this statement in the light of recent challenges to the Act and suggest a balanced framework. (15 marks, 250 words)
Tell Google you want more of this.
Add Anantam IAS as a preferred sourceOne tap, and this site shows up more often in your own Top Stories, AI Overviews and AI Mode. Remove it any time.
