DPDP Act: journalists not data fiduciaries, government sources say before SC hearing

Journalists and news organisations are not "data fiduciaries" under India's Digital Personal Data Protection (DPDP) Act, 2023, and so do not fall under its obligations, government sources said on Saturday, 7 November 2026, according to a news agency report. The sources also indicated that the government is open to amending the law if needed. The clarification came as the Supreme Court prepares to hear, on Tuesday, 17 November 2026, a petition by the Digital News Publishers Association (DNPA) challenging the Act and its rules for not carrying a specific exemption for journalism. No written notification or amendment has been issued so far.

A "data fiduciary" is the term the DPDP Act uses for any person or organisation that decides why and how personal data is processed. Data fiduciaries must, among other things, get a person's consent before processing their data, tell them how it will be used, and let them ask for it to be corrected or erased. If newsrooms were treated as data fiduciaries, publishers argue, a journalist might need the consent of the very person a story is about, including a public official accused of wrongdoing, before reporting on them. The DNPA has told the Supreme Court that newsrooms would effectively have to shut down without an exemption, according to reports of its petition.

The government's answer, through sources, is that journalism does not fit the definition at all. That is reassuring for newsrooms, but it is not law. A clarification given through unnamed officials does not bind a court, a regulator or a future government. An exemption for journalistic work was dropped from the final law, so the question rests on how "data fiduciary" is read. That is why the publishers have asked the Supreme Court for a clear answer, and why the government's openness to an amendment matters.

The issue also touches the start-up and digital-media world. Independent digital news outlets, newsletter writers and creator-journalists, many of them small businesses, would face the same compliance burden as large companies if the Act were read to cover them. The penalties under the Act can reach Rs 250 crore for a single serious failure, which would be ruinous for a small outlet.

Peepals timeline: the DPDP Act was passed in 2023 without a specific exemption for journalism; its rules were notified in November 2025, with most obligations due to apply from May 2027; the DNPA moved the Supreme Court against the Act and rules, and on 27 October 2026 the court issued notice to the Centre without staying the law; on 7 November 2026 government sources said journalists and newsrooms are not data fiduciaries and that the law could be amended if needed; the Supreme Court is due to hear the case on 17 November 2026.

Short-term: Newsrooms get an informal signal that the government does not intend the Act to apply to reporting, but no legal protection yet. The government's formal reply in court will matter more than the sources' statement.

Long-term: If the government writes an exemption into the law or the rules, journalists and digital publishers will have certainty. If it does not, the Supreme Court's reading of "data fiduciary" will decide how the Act applies to the press.

Who is affected: journalists, newspapers, TV channels and digital news publishers; independent creators and small media start-ups; people who are the subjects of news reports; and companies building compliance tools for the DPDP Act.

What to watch next: the Supreme Court hearing on 17 November 2026 and whether the Centre's formal reply includes a written exemption or amendment.

Questions and Answers