"The DPDP Act, 2023 protects informational privacy but risks a chilling effect on the press." Critically examine.
New · District CollectorCan you hold the district for 72 hours?Floods, a heatwave, an outbreak, a grievance queue. Take the decisions, see the consequences.Play →In this answer
In K.S. Puttaswamy (2017), the Supreme Court held that privacy is a fundamental right. The Digital Personal Data Protection (DPDP) Act, 2023 builds on that with a consent-based system for digital personal data. It does strengthen citizens' control over their data. But it gives journalism no exemption and it narrows the RTI Act, so it risks chilling the press.
How the Act protects informational privacy
- Consent and rights: Personal data can be processed mainly with the person's consent. Individuals can ask for information about their data and have it corrected or erased [1].
- Deterrence: Failing to take security measures against data breaches can attract penalties of up to ₹250 crore [1].
- Enforcement: A four-member, digital-first Data Protection Board hears complaints. The DPDP Rules, 2025 phase in compliance over 18 months, which eases the burden [4].
- Claimed balance: The government says Section 8(2) of the RTI Act still lets officers disclose information when the public interest outweighs the harm [3].
How it risks a chilling effect on the press
- No journalism exemption: Only research, archiving and statistical processing are exempt [1]. The 2018 draft Bill did exempt journalistic purposes [2]. Reporters may now count as data fiduciaries who must notify, and seek consent from, the people they investigate.
- Fear of penalties: The ₹250 crore ceiling [1] comes with no published guidelines on how fines will be set. For small newsrooms that uncertainty is an existential risk, and it encourages self-censorship.
- RTI dilution: The Act amends Section 8(1)(j) of the RTI Act [3]. This removes the public-interest test built into that clause. Disclosure now depends on the officer's discretion under Section 8(2), so an officer can refuse first and leave the citizen to appeal.
- Unequal treatment of the State: The Centre can exempt its own agencies on grounds such as security and public order. PRS warns this may be disproportionate. The Srikrishna Committee had instead asked for judicial pre-approval of such processing [1]. The press, which watches these agencies, gets no comparable exemption.
Way forward
- Add a narrow journalism exemption, tied to public interest and modelled on the 2018 draft [2].
- Restore the public-interest test in Section 8(1)(j).
- Have the Board publish penalty guidelines based on the size of the entity and the harm caused.
- Require judicial oversight of exemptions granted to the State [1].
In short, the Act is a much-needed privacy law, but it leans against public scrutiny. Calibrated safeguards would reconcile Article 21 with Article 19(1)(a) and satisfy Puttaswamy's proportionality test. They would also advance SDG 16.10, public access to information, so that privacy protects citizens rather than shielding the powerful.
Sources
- 1PRS Legislative Brief: The Digital Personal Data Protection Bill, 2023: consent-based processing, individual rights, ₹250 crore penalty, research/archiving/statistical exemptions, State exemptions possibly disproportionate, Srikrishna Committee's judicial pre-approval
- 2PRS Legislative Brief: The Personal Data Protection (Draft) Bill, 2018: exemption for journalistic purposes in the 2018 draft
- 3PIB: Government notifies DPDP Rules to empower citizens and protect privacy: amendment of RTI Section 8(1)(j); Section 8(2) remains operative
- 4PIB: DPDP Rules, 2025 Notified: four-member digital-first Data Protection Board; 18-month phased compliance