ComplyDP4 min read
21 Publishers Challenge DPDP Act Over Journalistic Scope and Consent Burdens
A group of 21 publishers has challenged the Digital Personal Data Protection Act, 2023, citing friction with newsgathering and media business models. The case highlights data processing risks that apply across sectors reliant on public data and digital tracking.
Last updated:
What happened
A group of 21 publishers has officially challenged the Digital Personal Data Protection Act, 2023. According to a report by ThePrint, the publishers argue that the legislation restricts the practice of journalism in India. The petition also targets specific compliance obligations that introduce operational friction for digital media business models. The challenge focuses on the intersection of data privacy mandates with investigative reporting and routine subscriber data processing.
Does the DPDP Act apply here?
The Act governs digital personal data processing within India under Section 3(a). Media companies process high volumes of digital subscriber data and publicly sourced information. Section 3(c)(ii) excludes personal data that is made publicly available by the Data Principal to whom it relates, or by a person under a legal obligation to publish it. How courts interpret this exemption for independent newsgathering and third-party data scraping remains unclear from public sources.
Legal implications under DPDP
Section 4(1) establishes that processing requires a lawful purpose based on consent or specific legitimate uses. For digital publishers, tracking readers across paywalls and ad networks requires explicit consent. The DPDP Rules, 2025 mandate itemised notices before processing begins. Media companies must generate these notices, secure affirmative consent, and manage requests for data erasure within statutory timelines. Relying on journalistic exemptions for operational business data is a significant legal risk under the current framework.
Could this happen to you
While this challenge originates in the media sector, the underlying legal friction applies directly to large fintech platforms. Lending startups and payment aggregators rely heavily on alternative data sources and public records for credit underwriting. If your product teams scrape data assuming the Section 3(c)(ii) public data exemption covers all third-party sources, your exposure is high. Fintechs face the same business problem as these publishers: mapping consent across rapid sprint cycles and complex API integrations. If the Data Protection Board of India (DPBI) audits a lending platform, regulators will demand a precise Record of Processing Activities (RoPA) and verifiable consent artefacts for every data point feeding your risk models.
What companies should do in the next 30 days
1. Map alternative data pipelines. The Head of Compliance must identify every public data source used for underwriting and determine if the Data Principal actually made that data public themselves.
2. Review digital tracking flows. Product leads must audit onboarding screens to confirm that itemised notices meet the specifications detailed in the DPDP Rules, 2025 before deploying new code.
3. Centralize consent records. Control owners must build regulator-ready evidence packs that prove consent was obtained for RBI-mandated data sharing and marketing analytics.
What to watch
The outcome of this petition will clarify how statutory exemptions apply to specific industries. Enterprises should monitor the formation of the DPBI and any preliminary court orders affecting enforcement timelines. Exactly 191 days remain until the DPDP hard compliance deadline of 13 May 2027. Teams managing rapid product deployments can check their current exposure and audit-readiness by running a free scan at https://www.complydp.com/audit-preview before the regulatory window closes.
Sources
Frequently asked questions
Why are publishers challenging the DPDP Act?
A group of 21 publishers argues that the Digital Personal Data Protection Act, 2023 complicates journalistic newsgathering. They also claim the compliance obligations for digital tracking and subscriber data create operational friction for media business models.
Does the DPDP Act exempt publicly available data?
Section 3(c)(ii) exempts personal data made publicly available by the Data Principal or by someone under a legal obligation to do so. Data scraped from other third-party public sources may still fall under the scope of the Act.
What are the consent rules for digital tracking under DPDP?
Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Organizations tracking users online must provide itemised notices and maintain verifiable consent records as specified in the DPDP Rules, 2025.
How should enterprise compliance teams respond to this legal challenge?
Firms should not wait for court rulings on sectoral exemptions. Compliance heads must document alternative data sources in their Record of Processing Activities (RoPA) and ensure consent flows match rapid product sprint cycles.