ComplyDP5 mins
Publishers Challenge DPDP Act Over Consent Rules: Implications for Media Organizations
21 publishers challenge the DPDP Act over the lack of a journalism exemption. We examine how consent and notice obligations under the statute impact media entities.
Last updated:
What Happened
A group of 21 publishers challenged the Digital Personal Data Protection Act, 2023. ThePrint reports that the statute makes journalism harder in India. The publishers state it creates a specific business problem for the entire industry. Media entities operate as Data Fiduciaries when they process personal data for news operations. The law currently lacks a blanket exemption for journalistic activities. Reporters face practical hurdles getting verifiable consent before they publish stories about private individuals. The 21 publishers argue these compliance requirements disrupt standard editorial timelines. Getting prior consent for investigative reporting restricts daily newsgathering.
Will the DPDP Act Govern Media Processing?
Section 3 governs the processing of digital personal data within the territory of India. The statute expressly excludes personal data made publicly available by the Data Principal or under a legal obligation. For publishers, collecting private details or digital behavioral data triggers the statutory framework. Processing this information to offer news services directly engages the Act. The legislation omits a specific carve-out for the press. If a journalist digitizes non-digital records for a story, Section 3(a)(ii) places that processing under the law. Media organizations face definite boundaries when covering private citizens who have not publicized their own data.
Legal Implications Under DPDP
Section 4 dictates that a Data Fiduciary may process personal data only for a lawful purpose. Consent remains the primary basis. Processing without consent is illegal unless Section 7 legitimate uses authorize the action. The publishers state that getting prior consent for investigative reporting disrupts operations. The DPDP Rules, 2025 mandate an itemized notice before getting consent. Media companies need to unbundle broad terms of service from specific newsletter opt-ins. A publisher cannot tie subscriber paywall data to third-party ad targeting without offering distinct choices. Rule 3 requires translating privacy notices into 22 regional languages. This localization rule forces regional news platforms to set up new consent architectures for all digital readers.
Operational Hurdles for Publishers
The lack of a journalism exemption creates immediate compliance bottlenecks. A newsroom archiving old articles retains personal data indefinitely. This retention complicates data limits under the Act. The Data Protection Board of India reviews verifiable consent trails during an inquiry. Failing to produce this electronic record exposes the publisher to financial penalties. Media executives need to set up internal workflows that physically separate editorial databases from commercial subscriber lists. This division prevents the unauthorized processing of journalistic materials for advertising. If a data breach occurs, the Rules, 2025 mandate notifying the affected Data Principals without delay. A detailed incident report to the Board then follows within 72 hours.
What Media Companies Should Do in the Next 30 Days
1. Map existing consent flows across reader paywalls and newsletter signups to identify bundled opt-ins.
2. Set up internal guidelines separating editorial research databases from commercial subscriber lists.
3. Model the financial impact of a verifiable consent failure regarding digital advertising revenue.
4. Apply a clear plan for Rule 3 notice translations across all regional news platforms.
5. Review article take-down procedures to address Data Principal erasure requests under the new framework.
6. Audit third-party vendor contracts to verify data processing boundaries for external marketing.
What to Watch
We will monitor the courts to see if they grant any relief to the publishers regarding notice exemptions. The Central Government will bring the DPDP Act into force in phases. Section 1(2) states that different dates may be appointed for different provisions of the Act. Media companies face a shrinking window to adjust their internal data practices. Act now. General counsels should test their subscription flows against the new statutory rules immediately. A successful challenge by these 21 publishers could force regulatory clarification on how press organizations process digital records.
Sources
Frequently asked questions
Will the DPDP Act govern media and publishing companies?
Yes. Section 3 governs any entity processing digital personal data within India. This jurisdiction covers digital interview transcripts, subscriber details, and digital behavioral data.
Can publishers continue bundling newsletter consent with subscription terms?
No. The Act requires a clear, itemized notice under the Rules, 2025. Consent remains the primary basis for processing, except where Section 7 legitimate uses authorize the specific action. Media entities separate commercial marketing data from editorial or operational data.
What are the language requirements for privacy notices?
Rule 3 of the DPDP Rules, 2025 directs that privacy notices be available in English and 22 regional languages specified in the Eighth Schedule. This mandate ensures that Data Principals across local markets can read the consent request.
How will the lack of a journalism exemption affect business operations?
Media organizations face practical difficulties getting prior consent for daily newsgathering. An inability to prove verifiable consent trails increases the risk of financial penalties. The Data Protection Board of India evaluates these compliance gaps during official inquiries.
When will the DPDP Act take effect?
The Central Government will implement the statute in phases. Section 1(2) confirms that different dates may be appointed for different provisions. Media companies need to set up verifiable consent mechanisms before the official notification dates take effect.