New Indian Data Law Sparks Fears of Expanded Surveillance and Threats to Press Freedom

Journalists’ unions and international media bodies call for an urgent review of the Digital Personal Data Protection Act amid warnings of censorship, curtailed transparency and weakened privacy safeguards.

IFJ, Belgium, November 28, 2025 : India’s contentious Digital Personal Data Protection (DPDP) Act, 2023, formally came into effect on 14 November, prompting intense backlash from press freedom organisations, civil society groups and academics who warn that the legislation could heighten state surveillance, restrict access to information and undermine independent journalism. The International Federation of Journalists (IFJ), together with its Indian affiliate, the Indian Journalists Union (IJU), has urged the government to undertake a comprehensive review of the law and to consult media stakeholders to prevent erosion of democratic freedoms.

The law’s implementation by the Ministry of Electronics and Information Technology follows its passage through Parliament on 9 August 2023. Critics argue that the Act grants the government “arbitrary and undisputed powers” while diluting essential privacy protections. Concerns centre largely on the legislation’s sweeping and vaguely defined exemptions, which allow government agencies to access personal data with minimal independent oversight. Rights advocates also highlight the absence of an explicit guarantee that individuals can prevent their personal data from being retained in official databases, raising alarms about potential misuse.

One of the most contentious elements of the Act is its amendment to a key provision of the Right to Information (RTI) Act, which journalists and the public previously used to obtain and disclose information crucial to transparency and accountability. Media bodies warn that this change introduces new procedural and legal barriers to public-interest reporting, thereby limiting scrutiny of institutions and government decisions.

Supporters of the legislation say the DPDP Act aims to protect the personal data of Indian citizens by compelling both government departments and private platforms to adopt robust security measures and obtain meaningful user consent. It also stipulates penalties of up to INR 2.5 billion (about USD 28 million) for entities that fail to maintain adequate safeguards. The Act establishes the Data Protection Board of India, authorised to investigate breaches, enforce compliance and impose sanctions. Digital platforms and service providers have been afforded an 18-month transition period to fully comply with the new regulatory framework.

Despite these stated protections, journalists’ organisations have issued stern warnings. The IJU has expressed fears that the Act could be used to expand censorship and impose arbitrary checks on media outlets, mirroring past instances where sedition and anti-terror laws were used to pressure independent journalism. It cautioned that the law may enable authorities to block or restrict publications critical of the government. The Press Club of India echoed these concerns, arguing that the Act’s ambiguity could be weaponised to intimidate media workers. Earlier this year, in July, the Editors Guild of India warned that the legislation would impose administrative burdens, hinder accountability journalism, and obstruct journalists’ access to information.

In a strongly worded statement, the IFJ said the DPDP Act “poses a dire threat to critical and independent media by increasing surveillance and restrictions on digital expression in the world’s largest democracy,” urging the Indian legislature to “immediately review the law to ensure that press freedom and the right to information are upheld.”

As debate intensifies, journalists and rights advocates continue to call for greater clarity, safeguards and accountability mechanisms to ensure that data protection does not come at the expense of transparency, democratic oversight or the freedom of the press.