The DIGIPUB News India Foundation and the Editors Guild of India have raised serious concerns over the Narendra Modi government’s newly notified Digital Personal Data Protection Rules, 2025 (DPDPR), warning that the framework risks undermining press freedom, weakens the Right to Information regime, and leaves journalists exposed to ambiguous compliance burdens.

Notified on November 15, the rules bring into effect specific provisions of the Digital Personal Data Protection Act, 2023 (DPDPA, 2023), and stagger the enforcement of several other provisions. “The DDPPA, 2023 and DPDPR, 2025, collectively cripple the Right to Information Act, which is one of the most important legislations for democratic accountability, but also create a regulatory framework that endangers journalism,” DIGIPUB said in a statement.

The rules lay out procedures for consent managers, data retention norms, processing of children’s data, obligations of significant data fiduciaries, and carve-outs for the state when processing personal data. But DIGIPUB said the framework gives the government sweeping access and enforcement powers without extending any statutory exemption for journalists, an omission the group had earlier flagged in its submissions to MEITY.

“They endanger source confidentiality, hinder public-interest investigations, obstruct anti-corruption disclosures, and weaken the information framework essential for democratic accountability. The Rules also create avenues for disproportionate state overreach and covert interference with editorial independence,” the statement said.

DIGIPUB said it had earlier submitted formal objections to the removal of the journalistic carve-out from the DPDPA, 2023 and also highlighted that Section 44(3) substitutes Section 8(1)(j) of the RTI Act, thereby abolishing the public-interest override and making access to information even more restrictive. 

“Following this, DIGIPUB’s director and representative met with the Secretary, MEITY, to formally present these concerns in the consultation hosted by the ministry. After the meeting, our members, along with our legal team, prepared a consolidated set of critical questions and concerns, which was sent by post. Despite these extensive efforts of good faith engagement, MEITY neither responded to these questions nor addressed any of the concerns raised by journalists and digital media organisations.”

It pointed out that although a government source had told the Press Trust of India in August that FAQs on the law would be released to address concerns raised by journalists and RTI activists, “even such FAQ has not been issued”. 

“This reflects a serious departure from the democratic consultative process expected in delegated legislation and demonstrates disregard for press freedom and the constitutional right to information. DIGIPUB believes that DPDPA, 2023 and DPDPR, 2025, pose a serious threat to the fundamental right to freedom of speech and expression under Article 19(1)(a) and impose an unreasonable, constitutionally suspect burden on independent media.”

The foundation urged the Union government, particularly the Ministry of Electronics and Information Technology, to “commence a reform process” to restore a clear statutory exemption for journalistic and public-interest processing. It said the government must “initiate a transparent, formal, and time-bound consultation on the issues submitted by DIGIPUB and others” and amend provisions “that undermine media freedom, the right to information, and the integrity of the digital public sphere”.

“A free and independent press is indispensable to any democratic republic,” the group said. “The DPDPA, 2023 and DPDPR, 2025, as notified, represent a serious setback to this foundational principle.”

Editors Guild raises similar concerns

In a statement on Wednesday, the Editors Guild of India has also expressed concern over the newly notified rules, saying they leave “critical questions unresolved for journalists and media organisations”. The Guild noted that it had earlier flagged the Act’s dilution of the RTI regime and the absence of an explicit journalistic exemption – gaps the Rules fail to address.

It recalled that in July 2025, the Secretary of MEITY had assured press bodies that journalistic work would not fall within the purview of the DPDP Act. Following this, the Guild and other media organisations submitted a detailed set of 35 questions and case-based scenarios seeking clarity on consent requirements, exemptions, data retention, research, and public-interest reporting. “However, there has been no official response since then,” the Guild said.

The notified rules, it warned, “do not alleviate these concerns”. Ambiguous consent obligations could expose newsrooms to compliance burdens that “may impede routine reportage”, and without explicit exemptions, journalistic activities risk being interpreted as personal data processing requiring consent – “thereby chilling newsgathering and hindering accountability journalism”.

The Guild urged MEITY to “urgently issue a clear and categorical clarification exempting bona fide journalistic activity” from the Act’s consent and processing requirements. Without such clarity, it said, “confusion and over-compliance will weaken press freedom and obstruct the media's essential role in a democratic society”. Data protection, it added, must be balanced with free speech and the public's right to know.

Update at 12.50 pm: This report and its headline were revised with details on the Editors Guild of India statement.

If the government can hike print ad rates by 26 percent, we can drop our subscription prices by 26 percent. Grab the offer and power journalism that doesn’t depend on advertisers.