21 Indian news publishers challenge the DPDP Act in the Supreme Court: publicly available data, journalism and subscriber rules

When twenty-one Indian news publishers and digital media houses approached the Supreme Court raising constitutional concerns over how the Digital Personal Data Protection Act, 2023 affects investigative reporting, newsroom archives and public-interest journalism, the petitions brought a practical statutory reality into sharp focus: unlike the European Union's General Data Protection Regulation or earlier Indian draft bills, the enacted DPDP Act contains no blanket sectoral carve-out for media organisations or journalistic reporting. Ahead of 13 May 2027, every digital publisher, broadcast portal, subscription newsletter and commercial content studio must understand where the Act's publicly available data exclusion stops and where full Data Fiduciary obligations begin.

Why news publishers and media portals are contesting the DPDP Act

In a modern digital newsroom, personal data is processed across two very different tracks. The first track is editorial and investigative work: reporters gather documents, interview sources, maintain notes on public officials or corporate executives, and publish articles containing names, photographs and biographical facts. The second track is commercial audience operations: reader registration walls, newsletter subscriptions, mobile app push notifications, ad-tech audience segmentation, subscription billing and event ticketing.

Because the DPDP Act applies to all processing of digital personal data within India—or outside India if connected with offering goods or services to individuals in India—both tracks fall within the statute unless a specific exclusion or exemption applies. Media houses have petitioned the Supreme Court arguing that requiring prior notice, consent and erasure on demand for unpublished journalistic source files or investigative notes could chill reporting if a subject demands to know what personal data a newsroom holds or asks for its deletion before publication.

What the publicly available personal data exclusion covers—and what it leaves out

The primary statutory relief the DPDP Act offers for public reporting and open-web publishing sits in its application clause. The Act does not apply to personal data that is made or caused to be made publicly available either:

• By the individual to whom the personal data relates—for example, statements, photographs or biographical details an individual posts on an open public profile or states in a public press conference; or
• By any other person who is under a legal obligation under any law in force in India to make that personal data publicly available—such as company director filings on the Ministry of Corporate Affairs portal, court judgments, electoral declarations or statutory regulatory disclosures.

However, this exclusion has strict limits. It does not cover unpublished whistle-blower files, private leaked databases, non-public personal details gathered during an investigation before any statutory disclosure obligation arises, or the subscriber and reader data that a publisher collects through its own website, app and paywall.

How commercial media, newsletter and ad-tech operations are regulated under the DPDP Rules

Regardless of how the Supreme Court eventually rules on editorial and journalistic source protections, no constitutional press-freedom plea exempts a media company's commercial subscriber database, mobile app telemetry or advertising technology stack. On the commercial side of the house, a digital publisher is a standard Data Fiduciary whose substantive duties take effect on 13 May 2027:

Where children's data rules and the 90-day grievance window affect digital publishers

Digital publishers that run student editions, exam-preparation portals, youth supplements or general-audience apps must also account for the statute's children's data provisions. Before processing any personal data of an individual under 18 years of age, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian, and must not undertake tracking, behavioural monitoring or targeted advertising directed at children.

In addition, every publisher must publish the business contact details of its Data Protection Officer (if notified as a Significant Data Fiduciary) or a designated person able to answer questions from readers about the processing of their personal data, and must resolve reader grievances within a maximum period of 90 days under its grievance redressal system.

Our view: a six-step DPDP compliance separation for publishing and media teams

In our view, media companies, digital newsrooms, B2B trade publishers and corporate content teams should separate editorial governance from commercial audience compliance before 13 May 2027 through six steps: