A group of 21 news publishers, including companies owned by Mukesh Ambani and Gautam Adani, has gone to court against India's Digital Personal Data Protection (DPDP) Act. Their argument is that the law would trample upon investigative journalism and could allow the government to identify journalists' sources. The story has since taken a new turn, with the government reportedly signalling that the media is "not covered" under the Act. For anyone following the DPDP Act journalists' sources privacy debate, the gap between those two positions is where the real questions sit.

What the publishers are challenging in court

The petitioners are 21 news publishers, a notable group because it includes companies owned by two of India's best-known business figures. Their central claim is twofold. First, that the DPDP Act would harm investigative journalism. Second, that it would let the government identify the people who give reporters information in confidence.

This is not the first legal step on the issue. The Supreme Court has previously issued notice on a plea from the Digital News Publishers Association against the Act and its rules, and it has also sought the Centre's reply on press concerns. The challenge from 21 publishers adds weight to a dispute that is already before the courts.

The government's "media not covered" signal

The Telegraph India headline frames the government's position as a possible blink: media is "not covered under DPDP Act." If that is the government's stated view, it would appear to ease the publishers' main worry. But a verbal or reported signal is not the same as a legal guarantee.

Several questions remain open, based on the reporting available:

  • Does "not covered" mean a written exemption in the law or rules, or only an interpretation offered in a hearing or statement?
  • Would it apply to individual freelance reporters and independent journalists, or only to institutional publishers?
  • Would it bind future governments and regulators?

The government has also previously said it is open to input. Our earlier piece on Vaishnaw's openness to media input sets out the stated position on press concerns. Openness to input, however, is different from a codified carve-out.

How the Act's powers could expose journalists' sources

The publishers' concern is about state access. A data protection law normally constrains companies that handle personal data. The worry arises when the same law also gives the government broad powers to demand information or to exempt its own agencies from the rules that bind everyone else.

The mechanism, as the publishers describe it, is straightforward. Reporting depends on collecting personal information: names, contact details, messages, documents. If a journalist or a newsroom is treated as an entity handling personal data, the state could in principle use the Act's powers to seek that information. That could include material that points to a confidential source.

We should be careful here. The source article gives us the publishers' argument and the government's reported response, not a final ruling on how the provisions work. The court will decide how far those powers actually reach.

What this means for you

If you are a journalist, a source, or simply someone who shares information with reporters, the practical lesson is that legal protection and technical protection are separate layers. A court case may eventually settle the law. It will not change what is already stored on a phone, a server or a network log today.

For source confidentiality and online anonymity, consider these points:

  • Minimise what is collected. Data that was never recorded cannot be demanded. Newsrooms can review what they keep about sources and for how long.
  • Separate identity from contact. Using channels that do not tie a source's real identity to their messages reduces what any request could reveal.
  • Understand what a VPN does and does not do. A VPN can hide your IP address from the sites you visit and protect traffic on untrusted networks. It does not stop a legal demand to a newsroom or platform, and it does not protect information you hand over voluntarily.
  • Use end-to-end encrypted tools for sensitive conversations, and keep devices updated and locked.
  • Ask about retention. Sources can ask a news organisation how it stores and protects their information before sharing it.

None of these replace legal safeguards, but they limit exposure while the legal position is unclear.

Key takeaways

The dispute over the DPDP Act journalists' sources privacy question is still moving. Twenty-one publishers say the law threatens investigative reporting and source confidentiality, while the government's reported line is that media is not covered. Until that is made binding or tested in court, caution is reasonable.

To stay informed, follow the case as it proceeds through the Supreme Court, along with coverage of the DNPA petition. For the government's stated position on press concerns, read our report on Vaishnaw's openness to media input. In the meantime, treat source protection as something you build into your own tools and habits, not something to leave to the law alone.