DPDP rules for small business explained: what starts 13 Nov 2026, the May 2027 deadline and a simple consent, privacy and breach checklist for websites.

AI voice agent for small business in India: how it works, real costs, TRAI and DPDP rules, and a 7-step plan to answer calls 24/7 without losing trust.

The Digital Personal Data Protection (DPDP) Act, 2023, designed to empower Indian citizens with control over their personal data, has become the centre of a legal battle over the boundary between individual privacy and public accountability. The Digital News Publishers Association (DNPA), representing 21 media organisations, has moved the Supreme Court, arguing that the framework lacks essential safeguards for investigative journalism and fundamentally weakens the Right to Information (RTI) Act. At the core of the dispute is a structural omission: the absence of an explicit statutory exemption for journalistic activities. While the Act defines 'Data Fiduciaries' (entities determining the purpose of data processing) and 'Data Principals' (the individuals), it does not distinguish between commercial data mining and the collection of information for public-interest reporting. This creates a systemic risk where requirements for free, specific, and informed consent could alert subjects of investigations, effectively neutralising the ability of journalists to uncover corruption or administrative irregularities. The legal challenge focuses on several critical friction points within the legislation:

Every dated identity obligation in one calendar: eIDAS 2 wallets, NIS2, DORA, the EU AI Act, NYDFS MFA, US state privacy laws, India DPDP and more. Official...

India's DPDP Rules turn one this month. Why marketing under the DPDP Act now runs on consent, what changes for brands, and a 27-week plan before May 2027.

Learn how to build a shared evidence layer for SOC 2 and India's DPDP Rules using access logs, continuous monitoring, and historical control records.

  Digital News Publishers Association (DNPA), representing 21 prominent news organizations, has filed suit with the Supreme Court challenging provisions of India's Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025. As a result of the current data protection framework, journalists could be restricted in their activities, investigative reporting may become complex, and public access to information may be limited.  Upon receiving notices from the Union Ministry of Law and Justice and Ministry of Electronics and Information Technology (MeitY) on October 27, 2026, the Supreme Court requested the Centre's response to the challenge. This case emphasizes the conflict between preserving the right to maintain an individual's digital privacy and preserving the right to investigate and report issues of public interest for the press.  Indian Parliament passed the DPDP Act in August 2023, the first comprehensive law specifically designed to protect digital personal data. It establishes rules for organizations and other entities that collect and process personal information. Under the Act, these entities are considered Data Fiduciaries and are required to obtain the consent of individuals before processing personal data, except for certain permissible purposes listed below Section 7.  A significant financial penalty is also introduced in the legislation, with data protection violations resulting in fines as high as Rs 250 crore. On November 13, 2025, MeitY notified the DPDP Rules for setting up the operational framework, with phased implementation over a period of 18 months. However, news publishers contend that the legislation does not specifically exempt journalistic activities from its provisions.  A clear provision for news reporting is not provided by Section 7, which identifies legitimate purposes for processing personal information, nor by Section 17, which lists exemptions from the Act. According to the DNPA, this omission may pose significant challenges for reporters investigating individuals, institutions, or organizations.  While investigating issues involving public accountability, journalists often obtain personal information from public records, interviews, documents, and other sources. A lack of a journalistic exemption may raise questions about whether consent is required before such information may be collected or used. Further, the association emphasized that earlier versions of data protection legislation, drafted in 2018, 2019, and 2021, included exemptions for journalistic purposes. They have been removed from the final framework and are a key part of the legal challenge.  Moreover, the dispute also involves amendments to the Right to Information Act (RTI Act), which raise concerns regarding the impact of the new provisions on transparency and access to government information. DPDP Rule 23 also presents a challenge, which provides the Central Government with the authority to request information from Data Fiduciaries and intermediaries through an authorized agent. Moreover, the rule prohibits these entities from disclosing the fact that a request has been made. News publishers have expressed concern over the possibility that the provision could affect the confidentiality of journalistic sources and create confusion regarding the handling of information obtained during investigations. Moreover, the association has questioned the amendment to Section 8(1)(j) of the Right to Information Act, which was implemented by Section 44(3) of the DPDP Act.  A public authority previously had the option of withholding personal information that had no connection to public activities or that could cause an unwarranted invasion of privacy. If a larger public interest justified the disclosure, information could be released. Information related to personal information has been broadly exempted from the amended provision.  Publishers argue that this change could make it more difficult for them to obtain government records required for investigations of matters such as conflicts of interest, public appointments and the use of public funds. Those seeking information about welfare programs, recruitment processes, and government services can also benefit from such information. However, the amendment does not remove every route for disclosure.  Information may be released in accordance with Section 8(2) of the RTI Act when the public interest outweighs the potential harm to protected interests. Despite the government's assertion that stronger privacy safeguards are necessary for preventing misuse of personal information, the current provision pertaining to public interest continues to protect transparency as it does today. In addition, the legal dispute involves constitutional protections of privacy. In its 2017 Justice K.S. Puttaswamy decision, the Supreme Court recognized privacy as a fundamental right under Article 21, albeit clarifying that the right is not absolute. This case raises the question as to how that protection should be applied simultaneously with freedom of speech and information access rights for the public. After issuing notice to the Centre, the Supreme Court declined to grant an interim stay on the challenged provisions before hearing the government's response.  According to the bench, a blanket restriction on disclosure of digital personal information is not necessary, but a more proportionate approach is required. Additional hearings will be held on November 17, 2026 in regards to this matter. An examination by the court may have broader implications for how the privacy laws in India apply to news organizations, investigative reporting, and the public's right of access to public records. It is expected that the Supreme Court's decision in this case will have a significant impact on the balance between individuals' rights to privacy, freedom of the press, and access to information for the general public. Its findings may also affect the way news organizations handle personal data when conducting investigations in India.

Organizations that process personal data across India and Europe may find familiar principles in both the General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act). Both frameworks address how organizations collect, use, secure, and manage personal data, and both give individuals rights over their information. But the similarities should not be mistaken for equivalence.

The DPDP Act excludes certain publicly available personal data. What does this mean for the misuse of photographs posted on Instagram?

Organizations that process personal data across India and Europe may find familiar principles in both the General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act). Both frameworks address how organizations collect, use, secure, and manage personal data, and both give individuals rights over their information. But the similarities should not be mistaken for equivalence.

Where Indian candidates look, what the 2025 Labour Codes and DPDP Act mean for hiring, and how to stop strong hires vanishing during 60–90 day notice periods.

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

We’re a group of security and technology experts with a mission to fix gaps in application security.

The Digital Personal Data Protection (DPDP) Act, 2023, which was introduced to protect people's personal data in the digital space, is back in the news, this time over concerns about its impact on press freedom. Enacted by Parliament in August 2023, the law was seen as a major step towards protecting citizens' digital privacy. It established a legal framework for collecting, storing and processing personal data. However, the legislation is now facing criticism from the digital media industry, which says some of its provisions could make news gathering difficult and affect the ability of journalists to report on matters of public interest. The Digital News Publishers Association (DNPA), which represents 21 prominent news organisations, including The New Indian Express, The Hindu, Dainik Bhaskar, Times Internet, India Today, NDTV, Network18, Zee Media, ABP and Bennett Coleman, has challenged the DPDP Act and the Digital Personal Data Protection Rules, 2025, in the Supreme Court. In its petition, the association has argued that the law does not provide any specific exemption for the media and could restrict journalists' ability to collect and use personal information while reporting. It has also raised concerns that the law could weaken citizens' right to information. The Supreme...