DPDP Act vs Journalism and RTI: CLAT Legal Reasoning

📑 On this page

Every time a reporter digs into a dodgy road contract, a missing relief fund or a minister's foreign trip, she handles someone's personal data: a name, a phone number, a bank entry, a photograph. India's new data protection law says that kind of handling usually needs the person's consent. So what happens when the person is the one being investigated?

That is the question the country's biggest digital news publishers have now put to the Supreme Court. On 27 October 2026, a bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana issued notice to the Centre on a challenge by the Digital News Publishers Association (DNPA), which speaks for the digital arms of 21 news organisations including The Hindu, The Indian Express, India Today and NDTV, and by Delhi-based investigative journalist Yukta Mudgal. The case comes back on 17 November.

For a CLAT aspirant this is a double hit. Data protection has already turned up in two Legal Reasoning sections in a row, and this case adds the other half of the story: what a privacy law does to the press and to your right to information.

🎯 In a nutshell

The law: the Digital Personal Data Protection (DPDP) Act, 2023, with its 2025 Rules, lets anyone handling your personal data do so only with your consent or for a short list of legitimate uses.
Complaint 1, no journalism exemption: research, archiving, statistics and crime investigation get carve-outs; news reporting does not. Publishers say consent and erasure duties hand the subject of an investigation a veto.
Complaint 2, RTI weakened: the Act rewrote the Right to Information (RTI) Act's personal-information exemption. The old clause let public interest win; the new one simply withholds anything that "relates to personal information".
Complaint 3, the referee: the Data Protection Board, which can impose penalties of up to Rs 250 crore, is appointed by the Central Government, and no judicial member is required.
Where it stands: notice issued, no stay. The Chief Justice said citizens' rights and media rights have to be balanced. Nothing has been decided yet.

📌 What CLAT actually expects

CLAT 2024 and 2025 both built Legal Reasoning passages on this very law, and each one handed you the rules. Your job is to read an exemption or a consent rule exactly, apply it to new facts, and see how the answer changes when a single word in the rule changes. You never need a section number.

The backstory

Three ideas collide in this case, and each is a staple of Legal Reasoning passages.

1. Privacy is a fundamental right

In August 2017, a nine-judge bench of the Supreme Court held in Justice K.S. Puttaswamy v. Union of India that privacy is protected as an intrinsic part of the right to life and personal liberty, and as part of the freedoms in Part III of the Constitution. One strand of it is informational privacy: your control over facts about yourself.

The judges warned that private players, not just the State, can threaten privacy, and urged the government to build a robust data protection regime. Any intrusion must pass a three-part test: it needs a law, a legitimate aim, and means proportionate to that aim. The DPDP Act, passed in August 2023, is the law that followed.

2. Press freedom lives inside free speech

The Constitution never uses the words "freedom of the press". The Supreme Court has long read it into the freedom of speech and expression, reasoning that democracy depends on people being able to learn and debate what their government is doing. Like all speech, it can face reasonable restrictions, but only on grounds the Constitution lists, such as public order, decency, defamation and contempt of court.

3. RTI and the public-interest balance

The RTI Act, 2005 lets any citizen ask a public authority for information. Personal information was always protected, but conditionally. An official could refuse it only if it had no link to any public activity or interest, or if releasing it would be an unwarranted invasion of privacy. Even then, if a larger public interest justified disclosure, it had to come out.

In 2019, a Constitution Bench said this is how the RTI Act reconciles the right to know with privacy: by weighing the public interest in disclosure against the harm it causes. That weighing is the heart of the RTI complaint.

The DPDP Act in four lines

✓The person whose data it is: the data principal. Whoever decides why and how it is used: the data fiduciary.
✓Use is allowed with consent that is free, specific, informed, unconditional and unambiguous, or for listed legitimate uses such as medical emergencies or obeying a court order.
✓You can withdraw consent and ask for erasure of data you consented to share.
✓Some activities are exempt from these duties. Which ones made the list, and which did not, is what this case is about.

What happened

The DNPA filed its petition on 6 October 2026. It asks the Court to strike down several provisions of the Act and three of its Rules. Its counsel, Senior Advocate Madhavi Divan, called it the first comprehensive challenge by legacy media, as opposed to citizen journalists. She argued that if reporters must seek permission and consent before they report, the result is pre-censorship.

[The challenged provisions] will shut down the newsroom.

— Senior Advocate Madhavi Divan for the DNPA, as reported by LiveLaw, 27 October 2026

The four grievances

1
No journalism exemption
Draft bills in 2018, 2019 and 2021 carved out journalism. The 2022 draft dropped it, and the final Act has none. Yet research, archiving and statistics are exempt, and so is the State when it investigates crime. Why, petitioners ask, does a statistician get a pass when a reporter exposing corruption does not?
2
A blanket bar in RTI
The old RTI clause is now a single line exempting "information which relates to personal information". The public-activity test and the public-interest override are gone. Relying on the electoral bonds ruling, petitioners argue the right to know cannot simply be sacrificed to privacy.
3
An executive-picked referee
The Data Protection Board investigates breaches and imposes penalties. The Central Government appoints its members for two-year, renewable terms. One must be a legal expert, but none need be a judge. Petitioners say a body deciding questions that touch fundamental rights needs more independence.
4
Government access and blocking
The Centre can make any data fiduciary hand over information, and can order content blocked on the Board's advice. With no judicial check, petitioners say, confidential sources could be exposed and whistleblowers scared off.

The DNPA said it had raised these concerns with two Union ministries in August 2026 and met officials, without result.

What the bench did

It issued notice on the petition and on the request for a stay, but did not halt the law. The Chief Justice described the publishers as domain experts, suggested they propose safeguards against misuse to the Union and the Court, and said a balance had to be struck between citizens' rights and media rights.

This is not the first challenge. In February 2026, a bench led by the Chief Justice refused to stay the Act and referred petitions against the RTI amendment, filed by RTI activist Venkatesh Nayak, The Reporters' Collective with journalist Nitin Sethi, and the National Campaign for People's Right to Information, to a larger bench. Those are still pending.

The debate

The government has not yet filed its reply, so the left column below is the strongest case that can be made for the law as written, not its official defence.

For the law as written	For the challengers
Privacy is a fundamental right too. If journalism is exempt, a private person named or photographed in a story loses every remedy the Act gives.	Press freedom is part of free speech. Requiring consent from the person being investigated defeats investigative reporting at its root.
"Journalism" is hard to define. Anyone with a phone and a page could claim an exemption and publish people's addresses or medical details.	It can be defined narrowly. Earlier Indian drafts did it, and the EU's GDPR asks member states to reconcile data protection with journalistic processing.
Officials are people too. The old RTI clause could be used to fish for their private details.	The old clause already protected genuinely private information. It released only what was tied to public activity or outweighed by public interest. A blanket bar shields misconduct along with privacy.
A specialist Board can act quickly; information-calls help enforce the law.	The government is often the subject of reporting. An executive-appointed referee and unchecked information-calls put sources at risk.

→ scroll to see more

Settled: privacy and press freedom are both fundamental rights, and neither is absolute. Open: whether the Court reads in a journalism exemption, strikes provisions down or leaves it to Parliament; whether the RTI change survives the larger bench; and whether the Centre offers an exemption itself.

Principles and terms to know

Principle / term	Plain meaning	How it is applied
Personal data	Any information about an individual who can be identified from it.	Name, address and Aadhaar number all count. CLAT 2024 asked exactly this.
Consent	Free, specific, informed, unconditional, unambiguous agreement, limited to the stated purpose.	Consent to one use does not cover another. It can be withdrawn at any time.
Legitimate uses	A closed list of situations where consent is not needed.	If the facts fit none of them and no exemption applies, consent is required.
Exemption	A carve-out from the law's duties for a named activity.	Read it word for word. It covers only what it names, as far as it names it.
Publicly available data	Data the person herself made public, or that a law requires to be public.	Outside the Act. Being famous is not the same as having made the data public.
Informational privacy	Control over facts about yourself; part of the right to privacy.	Any law intruding on it must be backed by law, serve a legitimate aim and be proportionate.
Press freedom	The freedom to gather and publish news, read into free speech.	Restricted only on grounds the Constitution lists, and only reasonably.
Larger public interest test	Weighing the public benefit of disclosure against the harm to privacy, case by case.	The old RTI rule used it; the amended rule does not.
Qualified vs blanket exemption	A qualified bar has conditions and exceptions; a blanket bar covers everything in the category.	Swap one for the other and the same facts can produce the opposite answer.

→ scroll to see more

ℹ️ Good to know, not to memorise

Cases: Justice K.S. Puttaswamy v. Union of India (24 August 2017, nine judges); Express Newspapers v. Union of India (1985), on press freedom within Article 19(1)(a); CPIO, Supreme Court v. Subhash Chandra Agarwal (2019, Constitution Bench), on RTI balancing. Law: the RTI change is Section 44(3) of the DPDP Act, replacing Section 8(1)(j) of the RTI Act; the challenge also targets Sections 7, 17(2), 18, 19, 27, 29, 36 and 37 and Rules 16, 17 and 23. The highest penalty in the Act's Schedule is Rs 250 crore. GDPR Article 85 is the EU journalism-reconciliation clause. Past papers: CLAT 2024's passage came from The Wire (22 August 2023); CLAT 2025's came from Anirudh Burman's explainer for Carnegie India (3 October 2023).

⚠️ Reasoning traps

1. "The law bans journalism." No. It imposes consent, notice and erasure duties with no carve-out for news work; the fight is over those duties. 2. Stretching an exemption. In CLAT 2024, a rule letting a bank process a defaulter's data to find his assets and liabilities did not let it touch his family's medical history. An exemption reaches only as far as its words. 3. Public figure, public data. The Act's carve-out is for data the person herself made public. Fame alone does not count. 4. Qualified vs blanket. The old RTI rule was a balance, not "disclose everything". The new rule removes the balance. 5. Notice is not a verdict. The Court has only asked for the government's reply. 6. Outside knowledge. If a passage states a rule that differs from the real Act, apply the passage.

How CLAT could test this

Use only the rules in the passage. Question 5 changes the law on purpose.

🧩 Worked example

Personal data is any information about an individual who can be identified from it, such as a name, an address or an identity number. A law on digital personal data lays down the following rules. A person or organisation that decides why and how personal data is used (a "data fiduciary") may use the data of an individual (the "data principal") only for a lawful purpose, and only on one of two grounds. The first is consent. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative act, and it covers only the data needed for the stated purpose. The individual may withdraw consent at any time, and may ask for her data to be erased, which must then be done unless the law requires it to be kept. The second ground is a "legitimate use": a short list of situations, such as a medical emergency, compliance with a court order, or data that the individual has voluntarily handed over for a specific purpose without objecting to its use for that purpose. The law does not apply at all to personal data that the individual has herself made publicly available. Certain activities are exempt from the duties of consent and erasure: processing to prevent, detect or investigate offences, and processing for research, archiving or statistics, provided the data is not used to take a decision about a particular individual. There is no exemption for news reporting. A separate transparency law gives every citizen the right to request information from public authorities. Before the data law, the transparency law allowed an official to refuse personal information only if it had no relationship to any public activity or interest, or if disclosing it would be an unwarranted invasion of privacy. Even then, the official had to release it if satisfied that a larger public interest justified disclosure. The data law amended this clause. It now permits refusal of any information which relates to personal information, with no reference to public activity or public interest. Critics say these rules leave journalists in a bind. A reporter investigating a powerful person would need that person's consent to process his data, and the person could later withdraw consent or demand erasure. Supporters reply that privacy is itself a fundamental right, that "journalism" is hard to define, and that ordinary people named in news stories deserve protection too. Courts must therefore reconcile two constitutional values: an individual's control over information about herself, and the public's right to know how power is being used.

Q1. Riya, a reporter, obtains a spreadsheet listing the names and phone numbers of employees of a private road contractor, and uses it to investigate inflated bills. She has not asked the employees for consent, and none of the legitimate uses applies. Under the rules in the passage:

ARiya's use of the data is exempt, because exposing inflated bills serves the public interest.

BRiya's use of the data is exempt as research, because she is analysing a dataset.

CRiya needs the employees' consent, because news reporting is not exempt and no legitimate use applies.

DThe law does not apply, because the contractor carries out public works.

▸ Show solution

Answer: C. The passage allows processing only on consent or a legitimate use, and says there is no exemption for news reporting. A is the trap: public interest may be a good argument, but in this passage it is not a ground for processing. B fails because the research exemption needs data not to be used for decisions about particular individuals, and an exposé that names people does exactly that. D confuses public works with publicly available data.

🧩 Worked example

Q2. Karan, a city councillor, posts a photo of his new car and the dealer's invoice on his public social media page. A news website reproduces the invoice in a story about his assets. Karan complains that his data was used without consent. Which is most correct?

AThe complaint fails, because the law does not apply to data Karan himself made publicly available.

BThe complaint succeeds, because consent must be specific and he never consented to the website's use.

CThe complaint succeeds, because Karan may demand erasure of any data at any time.

DThe complaint fails, because councillors are public officials and have no right to privacy.

▸ Show solution

Answer: A. The law does not apply at all to data the individual has herself made public, and Karan posted the invoice himself. B and C apply consent and erasure rules to data outside the law; C also overstates erasure. D is the trap: the answer follows from Karan's own act of publishing, not from his office. Officials keep their privacy.

🧩 Worked example

Q3. Meena asks a municipal corporation for the travel expenses its commissioner claimed from public funds for official trips last year. The corporation refuses, calling the details personal information. Based on the passage, which statement is correct?

ABoth versions of the transparency rule require disclosure, because public money was spent.

BBoth versions permit refusal, because anything about a named officer is personal information.

CUnder the earlier version, refusal was hard to justify because the information relates to public activity; under the amended version, the corporation may refuse because it relates to personal information.

DThe earlier version permitted refusal, while the amended version requires disclosure.

▸ Show solution

Answer: C. The earlier rule allowed refusal only where the information had no link to public activity or interest, and official travel paid from public funds plainly has one. Even beyond that, a larger public interest could compel release. The amended rule drops both tests and allows refusal of anything relating to personal information. A ignores the amendment, B ignores the earlier rule's conditions, and D reverses the two versions.

🧩 Worked example

Q4. Which of the following best expresses the principle behind the earlier version of the transparency rule?

APrivacy must always give way to the public's right to know.

BPersonal information held by the government must never be disclosed.

CNeither privacy nor the right to know wins automatically; the official must weigh the harm of disclosure against the public interest it serves.

DInformation about private citizens may be withheld, but information about officials must always be disclosed.

▸ Show solution

Answer: C. The earlier rule protected personal information but allowed disclosure where it related to public activity or where a larger public interest justified it. That is a case-by-case balance, not a rule that one side always wins. A and B each describe one side winning every time. D invents a distinction based on who the person is, when the old rule turned on what the information is and what disclosure would achieve.

🧩 Worked example

Q5. Suppose the data law is amended to add: "Processing of personal data for journalistic purposes is exempt from the requirement of consent and from the right to erasure, where the processing is necessary for publishing information in which there is a public interest." A gossip portal publishes the hospital records of a private schoolteacher with no public role, showing she was treated for depression, because such stories draw readers. She demands erasure. Under the amended law:

AThe portal is protected, because it publishes news and the amendment exempts journalism.

BThe portal is not protected, because publishing a private person's medical history to attract readers is not necessary for informing the public on a matter of public interest.

CThe portal is protected, because the records are true.

DThe teacher has no remedy, because the amendment removes the right to erasure for everyone.

▸ Show solution

Answer: B. The new exemption has two conditions: the purpose must be journalistic, and the processing must be necessary for publishing something in which there is a public interest. A matter the public is curious about is not the same as a matter of public interest. A private teacher's medical history has no bearing on public affairs, so the exemption does not apply and her erasure right stands. A reads only half the condition. C adds a truth test the rule does not contain. D overstates the change, which removes erasure only where the exemption applies.

Connect the dots

Constitutional law for CLAT

Privacy, free speech and reasonable restrictions.

Legal Reasoning

Legal GK and public policy

New laws and the debates around them.

Legal GK

CLAT 2024 question paper

The data protection passage from The Wire, with six questions.

Past paper

CLAT 2025 question paper

The Carnegie India passage on consent and data rights.

Past paper

National affairs and polity

Courts, Parliament and new legislation.

Current Affairs

Legal Reasoning practice questions

More principle-and-facts drills.

Practice

Test your Legal Reasoning

A full-length CLAT mock with principle-and-facts passages like this one.

Take a free CLAT mock

Sources

Frequently asked questions

Does the DPDP Act have an exemption for journalists?

No. The Act exempts activities such as crime investigation and research, archiving or statistics, but not journalism. Draft bills in 2018, 2019 and 2021 had a journalism exemption; the 2022 draft dropped it and the final 2023 Act did not restore it. That gap is the main ground of the news publishers' challenge.

How did the DPDP Act change the RTI Act?

The RTI Act used to let officials withhold personal information only if it had no link to public activity or interest, or would unjustifiably invade privacy, and even then it had to be released if a larger public interest justified it. The DPDP Act replaced that clause with a one-line exemption for any information that relates to personal information, removing the public-interest balance.

What did the Supreme Court decide on 27 October 2026?

Nothing on the merits. A bench of CJI Surya Kant, Justice Joymalya Bagchi and Justice V Mohana issued notice to the Centre on the DNPA's petition and stay application and listed the case for 17 November 2026. The law was not stayed. The Chief Justice said citizens' rights and media rights must be balanced.

What is the Puttaswamy judgment?

Justice K.S. Puttaswamy v. Union of India (2017) is the nine-judge Supreme Court ruling that privacy is a fundamental right, protected as part of the right to life and personal liberty and the other freedoms in Part III. It also recognised informational privacy and urged the government to create a data protection law.

Has data protection been asked in CLAT before?

Yes, in two straight years. CLAT 2024 had a Legal Reasoning passage adapted from a 2023 article in The Wire on the DPDP Act and the right to privacy, and CLAT 2025 used Anirudh Burman's 2023 explainer for Carnegie India on consent and data rights. Both supplied the rules in the passage.

Do I need to memorise DPDP Act section numbers for CLAT?

No. Legal Reasoning needs no prior knowledge of law, and both data protection passages gave the rules themselves. Learn what consent, legitimate uses, exemptions and the public-interest test mean, and practise applying an exemption exactly as it is worded.