Parliament Question: Protection of journalistic privilege and source confidentiality under DPDP Act, 2023

GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY RAJYA SABHA UNSTARRED QUESTION NO. 1712 TO BE ANSWERED ON: 13.02.2026 PROTECTION OF JOURNALISTIC PRIVILEGE AND SOURCE CONFIDENTIALITY UNDER DPDP ACT, 2023 1712. DR. JOHN BRITTAS: Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state: (a) whether Government is empowered under Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and its Rules to collect or access personal data relating to journalists and their sources by requiring disclosure of information from a data fiduciary or intermediary; (b) whether digital information pertaining to journalistic privilege and source confidentiality can be compelled to be disclosed by data fiduciary or intermediary; (c) whether any exemptions or safeguards exist under DPDP Act or Rules to protect journalistic privilege and source confidentiality; and (d) if so, the details thereof? ANSWER MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA) (a) to (d): The Digital Personal Data Protection Act, 2023 (“the Act”) establishes a principle- based, sector-agnostic framework for the protection of digital personal data. The Act seeks to protect personal data, facilitate lawful and legitimate processing, and empower citizens with enforceable rights. To operationalise the Digital Personal Data Protection Act, 2023, the Ministry of Electronics and Information Technology notified the Act and the Digital Personal Data Protection Rules, 2025 on 13th November, 2025. The Act and the Rules provide that personal data shall be processed only for lawful purposes and on the basis of free, informed, specific and unambiguous consent, accompanied by a notice specifying the nature of personal data collected and the purposes of processing. They also lay down obligations on Data Fiduciaries to adopt appropriate technical and organisational measures to ensure compliance with the Act. The Act provides for specific exemptions from its applications in cases where processing of personal data is necessary for legal enforcement, judicial and regulatory functions, law enforcement purposes, court-approved corporate restructuring, specified cross-border contractual processing, and recovery of financial defaults. The Act also empowers the Central Government to exempt the State and its instrumentalities from certain provisions of the Act in the interests of national security, sovereignty and integrity of India, maintenance of public order and allied considerations. It further permits limited exemptions for processing of personal data for research and statistical purposes, subject to prescribed standards. The Digital Personal Data Protection framework is being implemented in a balanced and proportionate manner, consistent with the constitutional values of India, including the freedom of speech and expression and the right to life and personal liberty, of which the right to privacy forms an integral part. ******