In August 2023, India got its first comprehensive data protection law, the Digital Personal Data Protection (DPDP) Act, 2023. The government is in the process of framing rules and regulations to operationalise the law and the process is expected to be done after the general election. The law is largely based on users giving consent for the processing of their personal data. It provides basic rights such as access to and erasure of data, places some obligations on companies, and establishes a complaints body for grievance redress. However, the law might have an invisible impact on journalistic free speech.
Typically, data protection laws exempt journalistic activities from privacy obligations such as notifying users and taking their consent before using their personal data. Three previous drafts of the DPDP Act had exemptions for journalistic activities, but the final law withdrew such an exemption. The Editors Guild of India also pointed to this risk and in a letter to the government, requested that journalistic activities be exempted from the DPDP Act.
