Open to probe

1. At a Glance

• Core issue: The Digital Personal Data Protection (DPDP) Act, 2023 and its Rules may restrict journalism and the Right to Information (RTI). The Act has no specific exemption for journalistic activity, and its Section 44(3) amended the RTI Act, 2005 [1].
• Why it matters: It pits the right to privacy against press freedom and transparency of public functionaries. The Hindu editorial's line is that public functionaries must not use privacy to escape scrutiny [1].
• UPSC value: It covers fundamental rights, statutory bodies (the Data Protection Board of India), RTI, media regulation and digital governance. That makes it a regular GS-II and GS-III theme [1][2].

2. Why in the News

• The Digital News Publishers Association (DNPA) has challenged the DPDP Act, 2023 and its Rules, citing a "chilling effect" on the media [1].
• The DNPA petition also challenges Section 44(3), which removed the earlier public-interest qualification on disclosing personal information under the RTI Act [1].
• The Supreme Court issued notice to the Centre on a plea against the data protection law [5]. It later sought the government's reply on petitions against the RTI changes made through the DPDP Act [4].
• The Hindu editorial "Open to probe" was published on 30 October 2026, Chennai edition, page 16 [1].

3. Background & Evolution

• Drafts: The 2018, 2019 and 2021 drafts of the data protection law all had a journalistic exemption. The final 2023 Act dropped it [1].
• 2023: The DPDP Act, 2023 was enacted. Its Section 44(3) replaces Section 8(1)(j) of the RTI Act, 2005 [4][6].
• April 2025: Opposition (INDIA bloc) MPs asked the Centre to repeal Section 44(3), arguing that it weakens RTI [6].
• August 2025: The government reportedly ruled out changes to the DPDP Act and said FAQs would address concerns [7].
• 14 November 2025: The DPDP Rules, 2025 were notified, which fully operationalised the Act [2][3].
• 2026: Challenges by the DNPA and others are pending in the Supreme Court [1][4][5].

4. Core Static Facts

Item	Fact
Law	Digital Personal Data Protection Act, 2023 [1]
Rules	DPDP Rules, 2025, notified 14 November 2025 [2]
Compliance window	18-month phased timeline [2]
Regulator	Data Protection Board of India: fully digital, 4 members [2]
Maximum penalty	Up to ₹250 crore for non-compliance [1]
Key term	"Data fiduciary": the entity that processes personal data and must give notice and obtain consent [1]
Exempted processing	Research and statistical purposes. There is no journalism exemption [1]
RTI link	Sec 44(3) of the DPDP Act substitutes Sec 8(1)(j) of the RTI Act, 2005 [4][6]
Old Sec 8(1)(j)	Personal information could be withheld only if it had no relation to public interest or caused an "unwarranted invasion of privacy" [6]

5. Multi-Dimensional Analysis

Legal / Constitutional

• Without a journalism exemption, reporters could be treated as data fiduciaries. They would have to notify, and seek consent from, the people they are investigating [1].
• The amended Sec 8(1)(j) drops the public-interest override. Critics say this makes the bar on disclosing personal information effectively absolute [1][6].
• The government says the amendment balances both rights without diminishing either. It also says personal details that other laws already require to be disclosed will still be disclosed under RTI [3].

Governance / Ethical

• Accountability: Investigations into official misconduct and corruption could be blocked if public officials claim privacy [1].
• The editorial argues that an overriding public interest must remain a valid ground for disclosure, especially for information held by public authorities [1].

Economic

• A ₹250 crore penalty is an existential threat to small and independent newsrooms [1].
• The 18-month phased compliance period affects compliance costs for all data fiduciaries [2].

Social / Democratic

• Routine newsgathering involves personal information, so the burden reaches everyday reporting, not just investigations [1].
• Weakening RTI could reduce citizens' ability to scrutinise public officials [1][6].

Administrative / Technological

• The Data Protection Board is designed as a fully digital body [2].
• The Rules complete the Act's operational framework [2][8].

6. Recent Developments (last 12–18 months)

• 14 November 2025: DPDP Rules, 2025 notified, with an 18-month phased rollout [2][3].
• 2026: The Supreme Court issued notice to the Centre on a plea against the DPDP law [5].
• 2026: The Supreme Court sought the Centre's reply on pleas against the RTI changes and gave it two weeks to respond [4].
• 30 October 2026: The Hindu editorial "Open to probe" backs the DNPA's case for a journalism exemption and a restored public-interest override [1].

7. Prelims Hooks

• The DPDP Act, 2023 has no express exemption for journalistic processing [1].
• The 2018, 2019 and 2021 drafts all contained a journalistic exemption [1].
• Research and statistical purposes are exempted under the Act [1].
• Maximum penalty under the DPDP regime: ₹250 crore [1].
• Section 44(3) of the DPDP Act amends the RTI Act, 2005 [1][4].
• The amended RTI provision is Section 8(1)(j), the personal information exemption [4][6].
• The DPDP Rules, 2025 were notified on 14 November 2025 [2].
• The Rules give an 18-month phased compliance timeline [2].
• The Data Protection Board of India has four members and is fully digital [2].
• Under the Act, the entity that decides how personal data is processed is the "data fiduciary" [1].
• The DNPA (Digital News Publishers Association) is a petitioner against the Act and Rules [1].

8. The State Gets Wide Exemptions, the Press Gets None

• The law treats the government and the reporter very differently
• The central government can exempt its own agencies from most of the Act. The grounds include security of the state, public order and prevention of offences [9].
• A newsroom has no such exemption. Only research, archiving and statistical work are exempted [1][9].

• So an investigating agency can collect personal data without consent, but a reporter checking that agency's work cannot.

• PRS itself warns that the State's exemption may go too far

• PRS Legislative Research says these exemptions may let the State collect, process and keep data "beyond what is necessary" [9].
• It says this "may not be proportionate" and may violate the fundamental right to privacy [9]. Proportionality (a test that a restriction must be no wider than its purpose needs) comes from the Supreme Court's privacy judgment.

• In short, the Act's privacy protection is weakest against the State, which is the actor the press most often reports on.

• The Srikrishna Committee wanted a check on the State that the Act does not have

• The 2018 committee said that for national security and crime processing, only fair processing and security safeguards should apply. It said a separate law should handle the rest [9].
• It also wanted judicial pre-approval (a court's permission in advance) for such actions [9].
• The 2023 Act gives the exemption by executive decision alone, with no court in between [9].

9. Why the RTI Change Moves the Choice From Officer to Statute

• The old clause made the officer weigh each request
• Under the old Section 8(1)(j), a PIO (Public Information Officer, who answers RTI requests) could refuse personal information only if it had no link to public activity or interest, or caused an "unwarranted" invasion of privacy [6].
• This forced a case-by-case test: is this about the person's public role? Is the intrusion justified?

• The new text removes that test. Personal information is now simply exempt [1][6].

• The remaining safeguard is weaker than it looks

• Section 8(2) of the RTI Act still allows disclosure when public interest outweighs the harm to protected interests [10].
• But 8(2) is a general override for all exemptions. It is used at the PIO's discretion, not as a built-in test, so an officer can refuse first and leave the citizen to appeal.

• Petitioners argue the change shields information about public officials, which is why the matter is now in court [10][4].

• The government's assurance covers only part of the gap

• The government says personal details that other laws already require to be disclosed will still be disclosed under RTI [3].
• That protects only what some other law already makes public. Anything not covered by another law now depends wholly on the exemption.
• In August 2025 the government chose FAQs over amending the Act [7]. FAQs explain a law. They cannot change what the law says, so a PIO is still bound by the new text.

10. The Best Case for the Government, and Where It Falls Short

• The strongest argument: a journalism exemption can be misused
• Privacy is a fundamental right, and the DPDP Act exists to protect it. The government says the RTI amendment balances both rights without weakening either [3].
• Even India's earlier journalism exemption was questioned. PRS asked whether the 2018 draft's exemptions met the standard set for restricting privacy [11].

• In the digital age, anyone with a website or social media page can call themselves a journalist. A broad exemption could become a free pass for doxxing (publishing someone's private details to harass them) or data trading.

• What is right about this argument

• A blanket, undefined exemption would weaken the Act. The concern about who counts as a journalist is real.

• Individuals in RTI files, such as junior employees or third parties, do deserve protection from unwarranted exposure.

• Why it still does not justify removing the exemption entirely

• The 2018, 2019 and 2021 drafts all solved this with a conditional exemption, not by leaving journalism out [1][11].
• The answer to a risky exemption is a narrow, tested one. Deleting it treats every news story as a privacy breach.
• The old RTI clause already protected private individuals through the "unwarranted invasion" test [6]. So removing the public-interest part added little privacy and cost a lot of transparency.

11. What Each Actor Should Do Next

• Parliament should restore the public-interest test in Section 8(1)(j)
• Opposition MPs asked for the repeal of Section 44(3) in April 2025 [6].

• A smaller fix is to bring back the old wording, which linked the exemption to public activity and "unwarranted" intrusion [6]. This keeps privacy protection for private persons and keeps officials open to scrutiny.

• MeitY should add a narrow journalism exemption, built on its own earlier drafts

• The 2018 and 2019 drafts already had journalistic exemptions [11][1].

• MeitY (Ministry of Electronics and IT, which runs the Act) can use that text, and tie the exemption to public interest so it does not become a loophole.

• Exemptions for the State should face an independent check

• The Srikrishna Committee recommended judicial pre-approval for security-related processing [9].

• Applying that check would answer the charge that the Act protects the State more than the citizen.

• The Data Protection Board should publish how it will set penalties

• ₹250 crore is the maximum, not a fixed fine [1]. But without clear guidelines, a small newsroom cannot know its risk, and that fear itself causes the chilling effect.

• Public guidelines linking the fine to the size of the entity and the harm caused would reduce that fear.

• The Supreme Court should test both changes for proportionality

• The petitions are now before the Court, and it has sought the Centre's reply [4][5].
• The question for the Court is whether removing both the journalism exemption and the public-interest test is the least restrictive way to protect privacy [9].

12. Anchors for Answers

• Data: Maximum penalty of ₹250 crore per breach under the DPDP regime [1]; 18-month phased compliance window under the 2025 Rules [2]
• Report/Committee: Justice B.N. Srikrishna Committee (2018) recommended judicial pre-approval for security-related processing [9]; PRS Legislative Brief on the DPDP Bill, 2023 flags State exemptions as possibly disproportionate [9]
• Law/Case: K.S. Puttaswamy v Union of India (2017), privacy as a fundamental right and the proportionality test; Article 19(1)(a) and 19(2); RTI Act Sections 8(1)(j) and 8(2) [10]; DPDP Act Section 44(3) [4]
• Comparison: India's own 2018 and 2019 draft bills carried journalistic exemptions that the 2023 Act dropped [11][1]
• Scheme: Whistle Blowers Protection Act, 2014, another route for exposing misconduct, which also depends on access to information about officials

13. Mains Relevance

• GS-II: Fundamental rights (Article 19(1)(a) and privacy); transparency and accountability; RTI; statutory bodies.
• GS-III: Challenges to internal security through communication networks; IT and data governance.
• GS-IV: Probity in governance; the conflict between privacy and the public interest.
• Question stems: 1. "The DPDP Act, 2023 protects informational privacy but risks a chilling effect on the press." Critically examine. 2. Does the amendment of Section 8(1)(j) of the RTI Act through the DPDP Act dilute transparency in public life? Discuss. 3. How can India balance the right to privacy with the public's right to know? Suggest institutional safeguards.

14. Related Topics to Study Next

• RTI Act, 2005, Section 8 exemptions: the provision that was directly amended.
• Right to privacy jurisprudence: the constitutional basis for the DPDP law.
• Article 19(1)(a) and 19(2): the free speech framework behind the press freedom claim.
• Data Protection Board of India: the new adjudicatory body and how it is designed.
• IT Rules, 2021 and the digital media code: the overlapping regulation of digital news publishers.
• Whistle Blowers Protection Act, 2014: a parallel mechanism for exposing misconduct.
• GDPR (EU): a comparative model that includes a journalism derogation.

15. NCERT Concepts to Revise

• Personal information exemption (Polity): This is Section 8(1)(j) of the RTI Act, the provision the DPDP Act amended and the petitions challenge.
• Right to Information Act 2005 (Polity): The law whose transparency powers are weakened by Section 44(3); you need its basics to follow the dispute.
• Public interest override (Polity): The editorial wants this safeguard restored so privacy claims cannot block disclosure of information in the public interest.
• Right to privacy (Polity): The constitutional basis of the DPDP Act, and the right set against press freedom and transparency.
• Freedom of speech and expression (Polity): Press freedom flows from Article 19(1)(a); the media's 'chilling effect' claim rests on it and its limits.
• Data fiduciary (Polity): Without a journalism exemption, reporters could count as data fiduciaries, needing consent from the people they investigate.

16. Common Errors / Trap Areas

• Section confusion: The amending provision is Sec 44(3) of the DPDP Act. The amended provision is Sec 8(1)(j) of the RTI Act. Do not swap them [4][6].
• Journalism exemption: It existed in the drafts, not in the final 2023 Act [1].
• Act vs Rules dates: The Act was passed in 2023. The Rules were notified on 14 November 2025 [2].
• Board strength: The Board has four members, and its design is "fully digital" [2].
• ₹250 crore is the maximum penalty, not a fixed fine for every breach [1].