When a Consent Form Becomes a Censor: The Missing Journalism Clause in India's Data Protection Law

The Missing Clause: How a Consent Regime Built for Platforms Turns Into Prior Restraint for the Press Article

19(1)(a) protects the freedom of speech and expression and the press shelters under it. Article 19(2) lists the only grounds on which the State may restrict that freedom: sovereignty, security, public order, decency, defamation and a few others. Privacy is not among them. That gap in the text is the real constitutional question behind the Digital News Publishers Association's challenge to the DPDP Act, 2023.

Three steps from consent to censorship The Act was written for platforms that collect personal data at scale.

Applied to newsrooms without any carve-out, it works in three steps.

1. Notice and consent warn the target. A journalist investigating a person is a data fiduciary processing that person's data. The regime of notice and prior, verifiable consent would require the reporter to tell the subject. The publishers argue this gives the subject time to destroy evidence or intimidate witnesses.
2. Erasure can unpublish the truth. A data principal can withdraw consent and demand erasure. The Act has no public-interest safeguard against that demand, so an accurate report could be forced offline or heavily redacted.
3. Section 36 can reach the source. Section 36, read with Rule 23 and the Seventh Schedule of the 2025 Rules, lets the Centre demand information from any data fiduciary. The petition argues this power has no judicial oversight, no test of necessity or proportionality and no notice to the person concerned and could reach a reporter's communications with an informant. The first two steps restrain speech before or after it appears. The third reaches the confidential relationship on which investigative reporting depends. In the Pegasus case in 2021, the Supreme Court described the protection of sources as a basic condition of press freedom.

The government's real concern The case for no exemption is not frivolous.

As it is commonly put on the government's side, the Act creates one uniform framework against data misuse. A broad carve-out for "journalism" could become a loophole for any entity that calls itself a news outlet, whether it is a data broker or a doxxing site. Press freedom, on this view, is already protected by Article 19(1)(a) and does not need immunity from data protection law.

The answer is a bounded exemption, not a blanket one India has already drafted that middle path once.

Section 47 of the Srikrishna Committee's 2018 draft exempted processing for journalistic purposes from several obligations, provided the processing was fair and reasonable. Article 85 of the GDPR leaves the balance to each member state and the EU, Singapore and Britain all have written carve-outs. A defensible exemption would have three limits:

• it would be purposive, covering an activity and not a credential; - it would be public-interest tested; - it would keep security safeguards in place for the data newsrooms hold. That approach meets the loophole objection without licensing journalists. For the aspirant, the lesson goes beyond this case. When a law restricts speech on a ground Article 19(2) does not list, the Court must decide whether privacy can be balanced against speech through Article 21 or whether the restriction must fit within the text of Article 19(2). That question is genuinely unsettled.